Re: Should we automatically generate a module signing key at all?

[David Howells]

Theodore Ts'o <tytso@xxxxxxx> wrote:

> Oh, so you are generating a one-time key for each kernel build,

Yes.

> and then dropping the public key into a cert which is then signed by some
> trusted CA system?

No.  We compile the public key into the vmlinux binary and leave it at that.
Trying to automatically sign the key would expose the signing key through the
buildfarm.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/