Re: [GIT PULL] Asymmetric keys and module signing

[David Howells]

Rusty Russell <rusty@xxxxxxxxxxxxxxx> wrote:

> We do a very simple search for a particular string appended to the module
> (which is cache-hot and about to be SHA'd anyway).  There's both a config
> option and a boot parameter which control whether we accept (and taint) or
> fail with unsigned modules.

I've adjusted your patch description to this:

    We do a very simple search for a particular string appended to the module
    (which is cache-hot and about to be SHA'd anyway).  There's both a config
    option and a boot parameter which control whether we accept or fail with
    unsigned modules and modules that are signed with an unknown key.

    If module signing is enabled, the kernel will be tainted if a module is
    accepted that is unsigned or has a signature for which we don't have the
    key.

I think it's worth mentioning the policy for unknown keys and worth making
clear under what circumstances we mean the kernel to be tainted.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/