Re: [gentoo-dev] [RFC] patch linux-mod.eclass to add support for module signing

[Carlos Silva <r3pek@r3pek.org>]

[-- Attachment #1: Type: text/plain, Size: 1310 bytes --]

On Wed, Mar 6, 2013 at 9:14 PM, Peter Stuge <peter@stuge.se> wrote:

> Carlos Silva wrote:
> > > > If one wants to create a key himself, it's also possible to use this
> > > > key, he just has to name it signing_key.priv and siging_key.x509 and
> > > > put it under /usr/src/linux.
> > >
> > > Do you know if this is a sane default?
> > >
> > > Where do most users of signed modules store keys so far?
> >
> > It's where the kernel build system picks them.
>
> Are you sure? I find that hard to believe? Even if I tell an external
> module to build against a source tree in ~/linux/ the Makefiles will
> go to look for the keys in /usr/src/linux/ ?
>

OK, my bad here. The kernel build system looks for them on the root of the
kernel source.
To build modules, they can be anywhere as long as you have the correct path
set on make.conf:
KERNEL_MODSECKEY="/path/to/privkey"
KERNEL_MODPUBKEY="/path/to/pubkey"

This only works for modules.


> They only have to be there to build the kernel, nothing else.
>
> I'm not talking about end users, by users I mean those who use the
> key files to build kernels and modules.
>

See above. I even read online that a best practice would be to generate a
new set of keys on every kernel build actually deleting the keys after the
kernel and external modules are compiled.

[-- Attachment #2: Type: text/html, Size: 2222 bytes --]