Re: Should we automatically generate a module signing key at all?

[David Howells <dhowells@redhat.com>]

Linus Torvalds <torvalds@linux-foundation.org> wrote:

> I forget the exact details of the signature ..., but for the modules
> themselves, it's just appended to the module contents.

Yes.

> And because the size of the certificate list is variable, you can't just
> zero it out or anything like that to make things compare equal.

Since it's discarded at the end of boot, it could be padded significantly.

Also the kernel image gets compressed and a prologue attached before being
placed in the binary RPMs or whatever, so you can't zero out the keys in those
very easily.

> But we might also simply decide to pack the keys differently. I'd
> personally be ok with it being in the initrd, for example, although
> for all I know that might screw up the people who actually want to use
> the BIOS secure booting thing

We wouldn't be able to trust any key loaded from the initrd unless the initrd
was itself verifiable.  Further, the initrd, at least in Fedora, gets composed
on the running system upon kernel installation so that it holds just the
modules you need to keep the size down.

> (I don't know how much that verifies).

The BIOS secure booting thing verifies the shim, grub and the kernel, as I
understand it.  The kernel then verifies modules and kexec images.

David