Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933481AbbFWUiF (ORCPT ); Tue, 23 Jun 2015 16:38:05 -0400 Received: from atrey.karlin.mff.cuni.cz ([195.113.26.193]:35724 "EHLO atrey.karlin.mff.cuni.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932648AbbFWUiA (ORCPT ); Tue, 23 Jun 2015 16:38:00 -0400 Date: Tue, 23 Jun 2015 22:37:57 +0200 From: Pavel Machek To: Linus Torvalds Cc: Andy Lutomirski , David Howells , Michal Marek , David Woodhouse , Abelardo Ricart III , Linux Kernel Mailing List , Sedat Dilek , keyrings@linux-nfs.org, Rusty Russell , LSM List , Borislav Petkov , Jiri Kosina Subject: Re: Should we automatically generate a module signing key at all? Message-ID: <20150623203756.GA30826@amd> References: <31154.1431965087@warthog.procyon.org.uk> <555A88FB.7000809@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1603 Lines: 34 On Tue 2015-05-19 10:44:47, Linus Torvalds wrote: > On Mon, May 18, 2015 at 5:51 PM, Andy Lutomirski wrote: > > > > I think we should get rid of the idea of automatically generated signing > > keys entirely. Instead I think we should generate, at build time, a list of > > all the module hashes and link that into vmlinux. > > Ugh. I think that would be a mistake. It doesn't add any new security > (it's 100% equivalent to just using a throw-away key), and it adds new > complexity and a new ordering dependency. > > Yes, yes, "throwing away the key" is a somewhat gray area, and just > unlinking the key-file without any secure erase in theory makes it > recoverable. In practice, though, it is fine. If you have an attacker > that has raw access to your disk and almost infinite resources, they > have easier ways to make your life miserable. We should really implement secure erase, and it probably needs to be at kernel level. > Even a non-secure unlinking of the temporary key file is going to make > things like rootkit authors give up on trying to recover it. Really. Placing the key in some kind of ram filesystem where erase is easy to do might be easy solution to this... Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/