Re: Fw: signed kernel modules?

[David Howells <dhowells@redhat.com>]

> Sign the whole thing.  Use a signature format which doesn't suck (ASN1
> parsing in the kernel?  Hmm...).  Have your build system spit out two
> RPMs, one with full debug modules, and one without.  This is not rocket
> science.

You make it sound so simple...

I've adapted my patches to sign the whole thing 'cos I know you're just going
to fight it otherwise[*]:-)

However, I'm having trouble getting it working... I didn't realise just how
many strips get applied to the module before it gets loaded into the kernel
(when making initrd's for instance):-/

The old way of just signing the stuff that is required is definitely more
robust against all the valid things people want to be able to do to modules,
especially those involving strip for the purposes of producing initrds and
stuff. Some of this is done upon or after installation where it isn't possible
to get hold of the private key[**].

I could make the signature section non-ALLOC, but that would just mean that
any stripped module is unsigned.

Since much of ELF is an arch-independent format, I think my latest "signing
only the requisite bits" method _is_ sufficient. You say that you can see a
gaping security hole - please elaborate... it may not be what you think.

David

[*] You're still wrong, of course, but that's your prerogative:-)

[**] Before anyone suggests it, no, I'm not going to ship the private key just
     so that the module can be re-signed after stripping.