Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751974AbbEDVk7 (ORCPT ); Mon, 4 May 2015 17:40:59 -0400 Received: from 66.63.173.11.static.quadranet.com ([66.63.173.11]:49344 "EHLO q1.ich-9.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751013AbbEDVkm (ORCPT ); Mon, 4 May 2015 17:40:42 -0400 Message-ID: <1430775634.5845.30.camel@memnix.com> Subject: Re: [PATCH] MODSIGN: Change default key details [ver #2] From: Abelardo Ricart III To: Linus Torvalds Cc: Michal Marek , Greg Kroah-Hartman , LSM List , Rusty Russell , keyrings@linux-nfs.org, David Howells , James Morris , Sedat Dilek , Linux Kernel Mailing List Date: Mon, 04 May 2015 17:40:34 -0400 In-Reply-To: References: <1430516505-4812-1-git-send-email-aricart@memnix.com> <1430559977.5803.12.camel@memnix.com> <1430714551.5800.93.camel@memnix.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.16.1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - q1.ich-9.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - memnix.com X-Get-Message-Sender-Via: q1.ich-9.com: authenticated_id: aricart@memnix.com Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3355 Lines: 77 On Sun, 2015-05-03 at 22:16 -0700, Linus Torvalds wrote: > On May 3, 2015 21:42, "Abelardo Ricart III" wrote: > > > > That's correct. I was under the impression that having the Makefile generate > > the signing keys was something that was done just to prevent a build failure > > with CONFIG_MODULE_SIG but no keys. > No, that's absolutely not the case. > In fact, the whole "external keys" model is entirely bogus for any same use > case. > The sane use case is to have the build process generate a random key at build > time, that gets thrown away after installing the kernel and modules. That, > together with "require signed modules" makes module as safe as building > everything into the kernel - you won't be open to things like rootkits that > try to load modules, because nobody has access to the key any more. > The only time you will have an external non-generated key is when you either > want to do the insane secure boot thing, or when a distro builds an official > kernel. But those are *not* the common development situations. > So the "generated random throwaway key" is absolutely not some of special > case to not break the build. It should be seen as the *default* case. > Linus Here's a (barely tested) patch to show what I mean with the config option. The default case is to always generate a new key at build (MODULE_SIG_BUILDGEN=y) and fallback on generating keys during build only if one doesn't exist (MODULE_SIG_BUILDGEN=n). This fixes the issues with keys being unexpectedly overwritten when you don't want them to be. Also fixes keys _not_ always being regenerated when they really should be (the default use case). --- diff --git a/init/Kconfig b/init/Kconfig index dc24dec..5ab8b97 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1903,6 +1903,16 @@ config MODULE_SIG_ALL comment "Do not forget to sign required modules with scripts/sign-file" depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL +config MODULE_SIG_BUILDGEN + bool "Always generate keys during build" + default y + depends on MODULE_SIG + help + Always generate new signing keys at build time. Only say N here if + you intend on supplying your own signing keys. + + Say Y here unless you know what you are doing. + choice prompt "Which hash algorithm should modules be signed with?" depends on MODULE_SIG diff --git a/kernel/Makefile b/kernel/Makefile index 60c302c..86d836d 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -170,6 +170,15 @@ ifndef CONFIG_MODULE_SIG_HASH $(error Could not determine digest type to use from kernel config) endif +.PHONY: generate_keys +ifeq ($(CONFIG_MODULE_SIG_BUILDGEN),y) + # Always generate new signing keys + generate_keys: signing_key.priv signing_key.x509 FORCE +else + # Only generate signing keys if they don't exist + generate_keys: | signing_key.priv signing_key.x509 +endif + signing_key.priv signing_key.x509: x509.genkey @echo "###" @echo "### Now generating an X.509 key pair to be used for signing modules." -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/