Re: Should we automatically generate a module signing key at all?

[David Woodhouse]

On Tue, 2015-05-19 at 11:12 -0700, Andy Lutomirski wrote:
> With your proposal, I need to trust that whoever built the actual
> running kernel image really did throw away the key. 

Ah right, that makes sense.

So it might make sense to use the LSM hook for checking hashes then.
It's kind of orthogonal to the *signing* discussion though.

-- 
dwmw2


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/