Re: Should we automatically generate a module signing key at all?

[David Howells <dhowells@redhat.com>]

Theodore Ts'o <tytso@mit.edu> wrote:

> Is module signing really meant for distro kernels, or would anyone
> besides people creating distro kernels care about this?

I think this is mainly for distro kernels where we need to provide certainty
and security.

Fedora and RHEL make good use of this for their kernel modules and are now
making use of it for kexec too.  Kernel images are EFI objects - ie. signed PE
files using Microsoft's spec.

Firmware validation isn't a consideration yet, but UEFI interaction is (UEFI
keys, blacklists).

For my own purposes when running kernels on my test machines, I build kernels
with all the necessary drivers built in and boot them directly out of the
build tree by PXE.  Then I copy any modules I'm testing by scp and use them.
I don't generally use signed modules anymore because the modules aren't signed
during the build phase but rather during the module installation phase (which
isn't of any use to me).   I'm not too worried about being attacked on those
machines though as they're rebooted (or powered off) regularly and are crashed
a lot.

> If not, maybe it's simpler just make things easy for people who will be
> storing the key in some external hardware device, and just be done with it.

Did you mean make it possible to only use external hardware for storing the
key?  That wouldn't very convenient for building our kernels in our build farm
- we have a lot of machines and all of them would have to be equiped with the
key.  Besides, we *want* to discard the private key where possible as soon as
possible because then we can't leak it and we can't be forced to disclose it.

David