Linux kernel lockdown, integrity, and confidentiality

Re:Linux kernel lockdown, integrity, and confidentiality by freedomben on Wednesday April 22, 2020 @01:40PM (#22948122)

This lockdown made it a huge PITA to run Wireguard in Fedora[1]. It broke existing installs when the kernel upgraded and then became very difficult to insmod or modprobe the wireguard kernel modules unless you blacklisted all new kernels (not safe). I hope this matures in a way that doesn't destroy some of the reasons I love Linux (that I can hack on my system and do cool stuff).

[1] https://unix.stackexchange.com/q/543576/34855

[ Parent | on HN ]

Re:Linux kernel lockdown, integrity, and confidentiality by jamielinux on Wednesday April 22, 2020 @04:35PM (#22949905)

You can sign modules using these instructions: https://docs.fedoraproject.org/en-US/fedora/f31/system-admin...

Though it's definitely a faff, and it's required every time there's kernel upgrade.

[ Parent | on HN ]

Re:Linux kernel lockdown, integrity, and confidentiality by htfy96 on Wednesday April 22, 2020 @02:22PM (#22948589)

Wireguard is merged into the mainline and would possibly appear in Fedora 32 on 5.6. Fedora 32 will be released several weeks later.

The underlying problem is that many distro just use a throwaway pubkey which makes users impossible to sign their modules. Maybe a better security model is needed.

[ Parent | on HN ]

Re:Linux kernel lockdown, integrity, and confidentiality by freedomben on Wednesday April 22, 2020 @02:58PM (#22948959)

yeah for this reason I've been super excited for kernel 5.6 (I don't usually get excited for new kernel releases cause it means work for me, but this one is different :party: )

[ Parent | on HN ]