Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751769AbbESUZQ (ORCPT ); Tue, 19 May 2015 16:25:16 -0400 Received: from bombadil.infradead.org ([198.137.202.9]:60576 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751121AbbESUZO (ORCPT ); Tue, 19 May 2015 16:25:14 -0400 Message-ID: <1432067105.3277.95.camel@infradead.org> Subject: Re: Should we automatically generate a module signing key at all? From: David Woodhouse To: Andy Lutomirski Cc: Linus Torvalds , Andy Lutomirski , David Howells , Michal Marek , Abelardo Ricart III , Linux Kernel Mailing List , Sedat Dilek , keyrings@linux-nfs.org, Rusty Russell , LSM List , Borislav Petkov , Jiri Kosina Date: Tue, 19 May 2015 21:25:05 +0100 In-Reply-To: References: <31154.1431965087@warthog.procyon.org.uk> <555A88FB.7000809@kernel.org> <1432058889.3277.73.camel@infradead.org> <1432060732.3277.77.camel@infradead.org> <1432065634.3277.81.camel@infradead.org> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org See http://www.infradead.org/rpr.html Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1671 Lines: 35 On Tue, 2015-05-19 at 13:05 -0700, Andy Lutomirski wrote: > > I appreciate why that's a problem in your scenario, but it's a valid and > > useful feature of signatures, and I don't think we can just abandon it. > > True, but I'd consider that use case (running a kernel built on a > development machine) to be more in line with unsigned use or long-term > (maybe medium-term) signing keys. > > IOW, for this use case, running scripts/generate_module_signing_key or > whatever and configuring accordingly seems entirely reasonable to me. > Or you could just turn off forced module signature verification since > keeping the signing key in plaintext on your machine mostly negates > any benefit of verifying signatures on that machine at runtime. Perhaps so (although it's ignoring use cases where the build tree is somewhere secure and internal and I'm deploying to a server which is more accessible). But we already *fixed* the problem of generating the signing key automatically. The in-tree signing_key.{priv,x509} are always transient auto-generated files now, and the ambiguity is gone. As a side-effect of what I was already doing to enable PKCS#11. It was mostly just a documentation change. So I'm not sure I see the point of ditching it, now that it's working. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/