Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757558AbbEVWPp (ORCPT ); Fri, 22 May 2015 18:15:45 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36305 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757136AbbEVWPl (ORCPT ); Fri, 22 May 2015 18:15:41 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: References: <20150522141358.2581.qmail@ns.horizon.com> To: Linus Torvalds Cc: dhowells@redhat.com, George Spelvin , David Woodhouse , Linux Kernel Mailing List , LSM List , Andy Lutomirski , petkan@mip-labs.com, "Theodore Ts'o" , Mimi Zohar Subject: Re: Should we automatically generate a module signing key at all? MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <24756.1432332934.1@warthog.procyon.org.uk> Date: Fri, 22 May 2015 23:15:34 +0100 Message-ID: <24757.1432332934@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1527 Lines: 37 Linus Torvalds wrote: > I forget the exact details of the signature ..., but for the modules > themselves, it's just appended to the module contents. Yes. > And because the size of the certificate list is variable, you can't just > zero it out or anything like that to make things compare equal. Since it's discarded at the end of boot, it could be padded significantly. Also the kernel image gets compressed and a prologue attached before being placed in the binary RPMs or whatever, so you can't zero out the keys in those very easily. > But we might also simply decide to pack the keys differently. I'd > personally be ok with it being in the initrd, for example, although > for all I know that might screw up the people who actually want to use > the BIOS secure booting thing We wouldn't be able to trust any key loaded from the initrd unless the initrd was itself verifiable. Further, the initrd, at least in Fedora, gets composed on the running system upon kernel installation so that it holds just the modules you need to keep the size down. > (I don't know how much that verifies). The BIOS secure booting thing verifies the shim, grub and the kernel, as I understand it. The kernel then verifies modules and kexec images. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/