LWN: Comments on "Loading signed kernel modules"

Loading signed kernel modules

raven667 — Thu, 23 Feb 2012 00:45:09 +0000

The gplv2 and Linux definitely doesn't require that as Linux is used in locked down devices all the time. The gplv3 doesn't specifically require sharing of keys, afaik, but it does require there be a method to replace the shipping software with a modified version. That can be done by any method such as replaceable keys, disabling of signature checking, etc.

Loading signed kernel modules

Zizzle — Wed, 22 Feb 2012 21:20:25 +0000

Does the GPL mean that the secret keys have to be publicly available for the vendor kernels?

Loading signed kernel modules

jwboyer — Fri, 09 Dec 2011 19:29:32 +0000

Small nit. Fedora doesn't include or use the module signing patches. That is RHEL only.

Loading signed kernel modules

rusty — Fri, 09 Dec 2011 11:20:35 +0000

He'd have more chance of upstreaming if he CC'd the module maintainer. Well, maybe less in this case. But still, grr...

Loading signed kernel modules

epa — Thu, 08 Dec 2011 13:52:37 +0000

Or else the modules could be built into the kernel image, perhaps as a static read-only ramdisk. Then the kernel will only load modules from this ramdisk and nowhere else. Then there is no need for hash functions either.

Loading signed kernel modules

josh — Thu, 08 Dec 2011 07:39:27 +0000

That approach would work equally well, insofar as root can replace the set of hashes as easily as the set of public keys. It doesn't work well if the vendor wants to supply out-of-tree modules since the kernel won't have the hashes of those modules, compared to just signing those modules with the appropriate vendor key. But for the most part it would work fine, and remove a pile of more complex crypto code from the kernel.

Loading signed kernel modules

idupree — Thu, 08 Dec 2011 06:51:37 +0000

What if one just wanted to embed into a kernel binary a fixed list of modules that could be loaded? Hypothetically, one could build a kernel with some modules, embed all those modules' SHA-256 hashes in the kernel, and use no public-key cryptography. Has anyone contemplated this as a use-case? (I can see pros and cons of my naive thought, but I'm sure a kernel/crypto expert can see better!)