Re: [RFD] linux-firmware key arrangement for firmware signing

[Posted May 26, 2015 by corbet]

From:		Greg Kroah-Hartman <gregkh-AT-linuxfoundation.org>
To:		One Thousand Gnomes <gnomes-AT-lxorguk.ukuu.org.uk>, Seth Forshee <seth.forshee-AT-canonical.com>, "Luis R. Rodriguez" <mcgrof-AT-suse.com>, linux-security-module-AT-vger.kernel.org, james.l.morris-AT-oracle.com, serge-AT-hallyn.com, linux-kernel-AT-vger.kernel.org, linux-wireless-AT-vger.kernel.org, David Howells <dhowells-AT-redhat.com>, Kyle McMartin <kyle-AT-kernel.org>, David Woodhouse <david.woodhouse-AT-intel.com>, Joey Lee <jlee-AT-suse.de>, Rusty Russell <rusty-AT-rustcorp.com.au>, zohar-AT-linux.vnet.ibm.com, mricon-AT-kernel.org
Subject:		Re: [RFD] linux-firmware key arrangement for firmware signing
Date:		Wed, 20 May 2015 21:41:04 -0700
Message-ID:		<20150521044104.GH22632@kroah.com>
Archive‑link:		Article

On Wed, May 20, 2015 at 07:46:13PM +0300, Petko Manolov wrote:
> On 15-05-20 17:24:46, One Thousand Gnomes wrote:
> > 
> > More to the point why do you want to sign firmware files ? Leaving aside the 
> > fact that someone will produce a device with GPLv3 firmware just to p*ss you 
> > off there's the rather more relevant fact that firmware for devices on a so 
> > called "trusted" platform already have signed firmware.
> 
> For "trusted" systems one would like to make sure everything that goes in has 
> known provenance.  Maybe this was the idea?

If so, then just do what people do today, verify their known valid disk
image before mounting it and then they know they can trust the data on
it to be use for whatever (including firmware.)  No kernel changes
needed, distro support is already there for this.

I too don't understand this need to sign something that you don't really
know what it is from some other company, just to send it to a separate
device that is going to do whatever it wants with it if it is signed or
not.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html