Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755928AbbESR6b (ORCPT ); Tue, 19 May 2015 13:58:31 -0400 Received: from mail-la0-f44.google.com ([209.85.215.44]:33108 "EHLO mail-la0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751261AbbESR62 (ORCPT ); Tue, 19 May 2015 13:58:28 -0400 MIME-Version: 1.0 In-Reply-To: References: <31154.1431965087@warthog.procyon.org.uk> <555A88FB.7000809@kernel.org> From: Andy Lutomirski Date: Tue, 19 May 2015 10:58:06 -0700 Message-ID: Subject: Re: Should we automatically generate a module signing key at all? To: Linus Torvalds Cc: Andy Lutomirski , David Howells , Michal Marek , David Woodhouse , Abelardo Ricart III , Linux Kernel Mailing List , Sedat Dilek , keyrings@linux-nfs.org, Rusty Russell , LSM List , Borislav Petkov , Jiri Kosina Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1260 Lines: 28 On Tue, May 19, 2015 at 10:44 AM, Linus Torvalds wrote: > On Mon, May 18, 2015 at 5:51 PM, Andy Lutomirski wrote: >> >> I think we should get rid of the idea of automatically generated signing >> keys entirely. Instead I think we should generate, at build time, a list of >> all the module hashes and link that into vmlinux. > > Ugh. I think that would be a mistake. It doesn't add any new security > (it's 100% equivalent to just using a throw-away key), and it adds new > complexity and a new ordering dependency. > > Yes, yes, "throwing away the key" is a somewhat gray area, and just > unlinking the key-file without any secure erase in theory makes it > recoverable. In practice, though, it is fine. If you have an attacker > that has raw access to your disk and almost infinite resources, they > have easier ways to make your life miserable. Throwing away the key is outright impossible in some contexts. https://wiki.debian.org/ReproducibleBuilds --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/