4 ms·
How do I install a custom kernel module in your model
by mort96 3y ago
How do I install a custom kernel module in your model
- DEADMINCE 3y agoUsing something like sudo. Parent is not saying remove root entirely but that it should be super locked down and maybe broken up into different accounts.
- mort96 3y agoI think they are saying to remove root entirely? If the solution is just "use sudo" then what's the difference compared to today's model?
- DEADMINCE 3y agoInstead of sudoing to the root account, you would sudo to the network account that could only do network admin, or sudo to the software-install account that could only install packages, etc.
- charcircuit 3y agoYou should install it from the distro's package manager. If it's not cryptographically signed by the distro you have to fork the operating system to add another key to trust. A custom kernel module has immense security implications so it shouldn't be easy to do as an attacker shouldn't be able to trick someone into installing one for free vbucks.
- mort96 3y agoMy distro's repositories don't contain my newly written custom kernel module
- charcircuit 3y agoMost users aren't writing their own custom kernel modules and using them on their current install instead of qemu. This is a niche use case that the average user's security shouldn't be compromised for.
- mort96 3y agoIt's an important use case that the system shouldn't lock the user out of.
- josephcsible 3y agoHave you ever used anything that uses DKMS? Should you have had to make your own operating system kernel instead?
- charcircuit 3y agoDKMS already supports signed kernel modules.
- josephcsible 3y agoIt supports them by creating its own private key and signing them on your system. That's inherently incompatible with only trusting modules from your distro vendor.
- charcircuit 3y agoYou are right only the distro's build servers would be able to use DKMS as the distro couldn't ship the private key.
- josephcsible 3y agoThat's fundamentally not how DKMS works.