Re: [RFD] linux-firmware key arrangement for firmware signing

[Petko Manolov]

On 15-05-21 16:51:49, David Howells wrote:
> 
> I do have patches to parse PGP key data and add the public keys found therein
> onto the kernel keyring, but that would mean adding an extra key data parser.

PGP is widely used so i would gladly have one more parser in the kernel.

> You could probably do this with the integrity functions - but turning them on 
> has a performance cost and you have to load things in the right order as I 
> understand it.

The performance hit is negligible, especially on modern hardware.  The problem 
is that Joe user must wrap his head around IMA as a concept and go through the 
pains of doing everything right.  Failing to do so will result in a lot of 
frustration, and i speak from experience.

Once you make it run properly it mostly stays out of your way.  To put it 
another way: IMA is not for sissies... :)


		Petko
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/