Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20170807195027.13192-1-mjg59@google.com> <CACdnJus-X533K0Bgqjc-MoZ2NbLz0ac9x+rryHUtnjrnmJ+Kmg@mail.gmail.com>
 <20180215152514.rxmh7webdg2i2fct@redbean> <CACdnJutL7rJE=1bsh45RmvunU-GZJCYaejyznENrAgFB6nbCLA@mail.gmail.com>
 <ff79053c-4a4c-714e-4098-bf973eaefd63@pmhahn.de>
In-Reply-To: <ff79053c-4a4c-714e-4098-bf973eaefd63@pmhahn.de>
From:   Matthew Garrett <mjg59@google.com>
Date:   Sat, 17 Feb 2018 00:08:51 +0000
Message-ID: <CACdnJuv4nKbrzzyJ9dAEgUqNSuZpCF6ARRK91f0fa6639G217g@mail.gmail.com>
Subject: Re: [PATCH] Make kernel taint on invalid module signatures configurable
To:     pmhahn@pmhahn.de
Cc:     Jessica Yu <jeyu@kernel.org>, Ben Hutchings <ben@decadent.org.uk>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Feb 16, 2018 at 12:25 AM Philipp Hahn <pmhahn@pmhahn.de> wrote:
> Sadly didn't work for me :-(
> If my understanding is correct and iff that would work, Debian (and
> others) could load their public key into Shim and then use the
> associated private key for singing their modules.

This works for UEFI systems, but distributions have to support non-UEFI as
well.