Linus Torvalds <torva...@linux-foundation.org> wrote: > I forget the exact details of the signature ..., but for the modules > themselves, it's just appended to the module contents.
Yes. > And because the size of the certificate list is variable, you can't just > zero it out or anything like that to make things compare equal. Since it's discarded at the end of boot, it could be padded significantly. Also the kernel image gets compressed and a prologue attached before being placed in the binary RPMs or whatever, so you can't zero out the keys in those very easily. > But we might also simply decide to pack the keys differently. I'd > personally be ok with it being in the initrd, for example, although > for all I know that might screw up the people who actually want to use > the BIOS secure booting thing We wouldn't be able to trust any key loaded from the initrd unless the initrd was itself verifiable. Further, the initrd, at least in Fedora, gets composed on the running system upon kernel installation so that it holds just the modules you need to keep the size down. > (I don't know how much that verifies). The BIOS secure booting thing verifies the shim, grub and the kernel, as I understand it. The kernel then verifies modules and kexec images. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
