Re: Should we automatically generate a module signing key at all?

[David Howells]

Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote:

> Alternatively, we could eventually support some way of verifying a
> hash or signature on each tuple (path, mode, contents)

Since the initramfs is composed on the system being installed according to the
hardware on that machine, you have to expose this list to meddling during
composition whether you sign it (you need a private key) or hash it (what do
you do with the hash once you've produced it?).

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/