Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755239AbbESQX3 (ORCPT ); Tue, 19 May 2015 12:23:29 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53660 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751288AbbESQX1 (ORCPT ); Tue, 19 May 2015 12:23:27 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20150519155532.GB2871@thunk.org> References: <20150519155532.GB2871@thunk.org> <31154.1431965087@warthog.procyon.org.uk> <555A88FB.7000809@kernel.org> <29742.1432025631@warthog.procyon.org.uk> <1752.1432049417@warthog.procyon.org.uk> To: "Theodore Ts'o" Cc: dhowells@redhat.com, Andy Lutomirski , Andy Lutomirski , Linus Torvalds , Michal Marek , David Woodhouse , Abelardo Ricart III , Linux Kernel Mailing List , Sedat Dilek , keyrings@linux-nfs.org, Rusty Russell , LSM List , Borislav Petkov , Jiri Kosina Subject: Re: Should we automatically generate a module signing key at all? MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <3252.1432052599.1@warthog.procyon.org.uk> Date: Tue, 19 May 2015 17:23:19 +0100 Message-ID: <3253.1432052599@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1884 Lines: 39 Theodore Ts'o wrote: > Is module signing really meant for distro kernels, or would anyone > besides people creating distro kernels care about this? I think this is mainly for distro kernels where we need to provide certainty and security. Fedora and RHEL make good use of this for their kernel modules and are now making use of it for kexec too. Kernel images are EFI objects - ie. signed PE files using Microsoft's spec. Firmware validation isn't a consideration yet, but UEFI interaction is (UEFI keys, blacklists). For my own purposes when running kernels on my test machines, I build kernels with all the necessary drivers built in and boot them directly out of the build tree by PXE. Then I copy any modules I'm testing by scp and use them. I don't generally use signed modules anymore because the modules aren't signed during the build phase but rather during the module installation phase (which isn't of any use to me). I'm not too worried about being attacked on those machines though as they're rebooted (or powered off) regularly and are crashed a lot. > If not, maybe it's simpler just make things easy for people who will be > storing the key in some external hardware device, and just be done with it. Did you mean make it possible to only use external hardware for storing the key? That wouldn't very convenient for building our kernels in our build farm - we have a lot of machines and all of them would have to be equiped with the key. Besides, we *want* to discard the private key where possible as soon as possible because then we can't leak it and we can't be forced to disclose it. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/