Re: Fw: signed kernel modules?

[Roman Zippel]

Hi,

On Fri, 15 Oct 2004, David Woodhouse wrote:

> > Can someone please put this patch into some context, where it's not 
> > completely pointless? As is it does not make anything more secure.
> > Why is the kernel more trustable than a kernel module?
> 
> Because it's not that hard to put the kernel onto read-only media or in
> a flash chip to which you physically cut the Vpen line.

So put the modules there as well or put a ramdisk there that does module 
verifying and loading (and disable module loading after that).
Again, why is this patch necessary? I have to repeat my main point from 
the last mail: If someone could show me how I can trust the running 
kernel, it should be rather easy to extend the same measures to modules 
without the need for this patch.
Show me a way that this is not possible and I'll agree with you that this 
patch is needed.

bye, Roman
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/