Re: RFC: sign the modules at install time

[Rusty Russell <rusty@rustcorp.com.au>]

Linus Torvalds <torvalds@linux-foundation.org> writes:
> On Wed, Oct 17, 2012 at 3:19 PM, David Howells <dhowells@redhat.com> wrote:
>>
>> It's probably even better to just get rid of all the automatic module signing
>> stuff completely and leave the sign-file script for the builder to use
>> manually.  The module verification code will still be present.
>
> That's just disgusting crazy talk.
>
> Christ, David, get a grip on yourself. You seem to dismiss the "people
> want to build their own kernel" people entirely.
>
> One of the main sane use-cases for module signing is:
>
>  - CONFIG_CHECK_SIGNATURE=y
>  - randomly generated one-time key
>  - "make modules_install; make install"
>  - "make clean" to get rid of the keys.
>  - reboot.
>
> and now you have a custom kernel that has the convenience of modules,
> yet is basically as safe as a non-modular build. The above makes it
> much harder for any kind of root-kit module to be loaded, and
> basically entirely avoids one fundamental security scare of modules.

If you only want this, we could SHA all the built modules, put that in
the kernel, and verify the module being loaded matches one of them.

Sure, it means a bit of trickery to get the module sums into the
bzImage, but the rest is trivial.

Cheers,
Rusty.