vyos/vyos-kernel — pull request #9 by alainlamar (2014-08-11 10:26:29+00:00)
Title: Enable kernel module signing and hardware support for the crypto api

This pull request proposes:
- the use of kernel module signing using one-time keys generated at build time. Today, this is the de-facto standard with all major distributions. The kernel may load modules having a valid signature only. This mitigates the use of 3rd party kernel modules (binary packages) and rootkits that come as kernel modules or infect genuine modules.
- enabling hardware acceleration for crypto algorithms. This allows routers to offload cryptographic calculations to their integrated processor features (SSE*, AVX*, AES-NI, ...).

Please note: Module signing along with the enforced signature validity check will effectively inhibit the use of third party modules on a running image. New drivers for additional hardware cannot be added by "sudo dpkg -i some-backport-package.deb" anymore, but must be integrated using the VyOS build system. It is assumed that users who manage to build backport packages for their router kernels would also be able to use the VyOS build system instead. Less tech-savvy users might need to place a bug ticket / feature request instead.

Best regards!