All of lore.kernel.org
 help / color / mirror / Atom feed
From: Rusty Russell <rusty@rustcorp.com.au>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>,
	linux-security-module@vger.kernel.org
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
	linux-kernel@vger.kernel.org, Mimi Zohar <zohar@us.ibm.com>,
	"David Howells" <dhowells@redhat.com>
Subject: Re: [RFC][PATCH 2/2] modsig: differentiate between ephemeral and persistent key names
Date: Mon, 03 Dec 2012 11:56:39 +1030	[thread overview]
Message-ID: <874nk4j580.fsf@rustcorp.com.au> (raw)
In-Reply-To: <1353939786-4829-2-git-send-email-zohar@linux.vnet.ibm.com>

Mimi Zohar <zohar@linux.vnet.ibm.com> writes:
> Using the same name for ephemeral and "persistent" keys results
> in deleting the "persistent" key.  This patch renames the normal
> kbuild asymmetric key pair name to "default_signing_key" and the
> ephemeral key pair name to "ephemeral_signing_key".

I like the idea: I was always uncomfortable with the mixing of
persistent and temporary keys.  But it's a bit misguided, because surely
persistent keys don't belong in the build tree at all.

How about we do something like:

# Default to temporary keys
MODKEYPREFIX = ./temp_signing_key

MODSECKEY = $(MODKEYPREFIX).priv
MODPUBKEY = $(MODKEYPREFIX).x509

Then encourage people to do:

        make MODKEYPREFIX=...

We could also use a config option to set the path, but that's probably
less convenient.

Cheers,
Rusty.

  reply	other threads:[~2012-12-03  2:44 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-11-26 14:23 [RFC][PATCH 1/2] modsig: add support to sign kernel modules using ephemeral keys Mimi Zohar
2012-11-26 14:23 ` [RFC][PATCH 2/2] modsig: differentiate between ephemeral and persistent key names Mimi Zohar
2012-12-03  1:26   ` Rusty Russell [this message]
2012-12-03  4:09     ` Mimi Zohar
2012-12-03  1:19 ` [RFC][PATCH 1/2] modsig: add support to sign kernel modules using ephemeral keys Rusty Russell
2012-12-04 18:14   ` David Howells
2012-12-04 19:11     ` Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=874nk4j580.fsf@rustcorp.com.au \
    --to=rusty@rustcorp.com.au \
    --cc=dhowells@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=zohar@linux.vnet.ibm.com \
    --cc=zohar@us.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.