Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752069AbbEDHTI (ORCPT ); Mon, 4 May 2015 03:19:08 -0400 Received: from 66.63.173.11.static.quadranet.com ([66.63.173.11]:34055 "EHLO q1.ich-9.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751282AbbEDHS6 (ORCPT ); Mon, 4 May 2015 03:18:58 -0400 Message-ID: <1430723934.5845.20.camel@memnix.com> Subject: Re: [PATCH] MODSIGN: Change default key details [ver #2] From: Abelardo Ricart III To: Linus Torvalds Cc: Michal Marek , Greg Kroah-Hartman , LSM List , Rusty Russell , keyrings@linux-nfs.org, David Howells , James Morris , Sedat Dilek , Linux Kernel Mailing List Date: Mon, 04 May 2015 03:18:54 -0400 In-Reply-To: References: <1430516505-4812-1-git-send-email-aricart@memnix.com> <1430559977.5803.12.camel@memnix.com> <1430714551.5800.93.camel@memnix.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.16.1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - q1.ich-9.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - memnix.com X-Get-Message-Sender-Via: q1.ich-9.com: authenticated_id: aricart@memnix.com Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2154 Lines: 44 On Sun, 2015-05-03 at 22:16 -0700, Linus Torvalds wrote: > On May 3, 2015 21:42, "Abelardo Ricart III" wrote: > > > > That's correct. I was under the impression that having the Makefile generate > > the signing keys was something that was done just to prevent a build failure > > with CONFIG_MODULE_SIG but no keys. > No, that's absolutely not the case. > In fact, the whole "external keys" model is entirely bogus for any same use > case. > The sane use case is to have the build process generate a random key at build > time, that gets thrown away after installing the kernel and modules. That, > together with "require signed modules" makes module as safe as building > everything into the kernel - you won't be open to things like rootkits that > try to load modules, because nobody has access to the key any more. > For varying degrees of accessibility. If the key gets overwritten with data during removal that would be ideal. > The only time you will have an external non-generated key is when you either > want to do the insane secure boot thing, or when a distro builds an official > kernel. Or maybe signing and deploying a custom module for a very large amount of machines that enforce module signing? Quite cumbersome when not utilizing your own keys... > But those are *not* the common development situations. > So the "generated random throwaway key" is absolutely not some of special > case to not break the build. It should be seen as the *default* case. > Linus So one-time keys is the default case. What of the idea of a config option for the other case as I'd proposed? One-time key generation being both the default (always regenerate, sign, then throwaway. Overwrite existing keys and config.) as well as the fallback (config option for one-time keys is unset, but external keys are absent or invalid. Generate and use a new key pair as per usual). Thanks. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/