diff -u WHAT’S NEW IN KERNEL DEVELOPMENT

摘要

Mimi Zohar recently submitted a patch to provide greater protections for cryptographically signed modules. When signing modules without Mimi’s patch, users generate a public and private key, and then use their private key to sign all the kernel modules they intend to use on their system. The kernel is built with the public key, so it can verify the signature. Users keep the private key hidden and can use it to build additional modules in the future. Attackers are stymied because they are unable to load their hostile, unsigned modules into the system.