linux-kernel - Re: Linux Firmware Signing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 01 Sep 2015 16:46:36 -0400
From:	Joshua Brindle <brindle@...rksecurity.com>
To:	"Roberts, William C" <william.c.roberts@...el.com>
CC:	Paul Moore <paul@...l-moore.com>,
	"Luis R. Rodriguez" <mcgrof@...e.com>,
	Takashi Iwai <tiwai@...e.de>,
	Ming Lei <ming.lei@...onical.com>,
	David Howells <dhowells@...hat.com>,
	Peter Jones <pjones@...hat.com>,
	"selinux@...ho.nsa.gov" <selinux@...ho.nsa.gov>,
	"Schaufler, Casey" <casey.schaufler@...el.com>,
	Stephen Smalley <sds@...ho.nsa.gov>,
	Matthew Garrett <mjg59@...f.ucam.org>,
	Kees Cook <keescook@...omium.org>,
	Vojtech Pavlík <vojtech@...e.com>,
	Seth Forshee <seth.forshee@...onical.com>,
	"james.l.morris@...cle.com" <james.l.morris@...cle.com>,
	Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
	Johannes Berg <johannes@...solutions.net>,
	Joey Lee <jlee@...e.de>, Kyle McMartin <kyle@...nel.org>,
	"linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Andy Lutomirski <luto@...capital.net>,
	"linux-security-module@...r.kernel.org" 
	<linux-security-module@...r.kernel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Vitaly Kuznetsov <vkuznets@...hat.com>,
	David Woodhouse <dwmw2@...radead.org>
Subject: Re: Linux Firmware Signing

Roberts, William C wrote:
>> From: owner-linux-security-module@...r.kernel.org [mailto:owner-linux-
>> security-module@...r.kernel.org] On Behalf Of Joshua Brindle
>> Sent: Tuesday, September 1, 2015 7:13 AM
>> To: Paul Moore
>> Cc: Luis R. Rodriguez; Takashi Iwai; Ming Lei; David Howells; Peter Jones;
>> selinux@...ho.nsa.gov; Schaufler, Casey; Stephen Smalley; Matthew Garrett;
>> Kees Cook; Vojtech Pavlík; Seth Forshee; james.l.morris@...cle.com; Dmitry
>> Kasatkin; Johannes Berg; Joey Lee; Kyle McMartin; linux-
>> wireless@...r.kernel.org; linux-kernel@...r.kernel.org; Andy Lutomirski; linux-
>> security-module@...r.kernel.org; Greg Kroah-Hartman; Vitaly Kuznetsov; David
>> Woodhouse
>> Subject: Re: Linux Firmware Signing
>>
>> Paul Moore wrote:
>> <snip>
>>> Yes, there are lots of way we could solve the signed policy format
>>> issue, I just don't have one in mind at this moment.  Also, to be
>>> honest, there are enough limitations to signing SELinux policies that
>>> this isn't very high onmy personal SELinux priority list.
>
> Yes I would say this is low on my end. Especially if we can kill off
> Reloadable policy support on Android, my need for this goes away 100%.
>

I'm not sure who "we" is as you are the only person I've heard 
advocating for removing that support.

>> The fact that there are so many userspace specific parts of the policy that never
>> make it into the kernel precludes any meaningful verification anyway.
>
> Yes and no. On Android, if I was able to load a policy I could grant myself capabilities that
> We're not possible via the userspace portions, i.e. relabeling, etc. Granted, not checking the
> userspace portions Is not great. In an ideal world, everything is checked. However, the main
> reason to doing it in the kernel is where you want your trust to be. For instance, If I trust that
> userspace Loader, then I need to trust that + the kernel. In the case of verifying the policy signature
> In the kernel, I need to trust only the kernel.

Especially on Android, userspace files are very important. Changing 
seapp_contexts or property_contexts can easily get you a privilege 
escalation to let you do whatever. Checking only the kernel binary is a 
half-solution and should not even be considered.

>
> As far as the desktop environment, I claim ignorance and have no input there.
>
>> And SELinux already has a mechanism for raising the integrity of a process to do
>> things like signature checking in userspace, the domain transition. If someone
>> wants validation of the SELinux policy they just need to eliminate every domains
>> ability to load policy except for a trusted policy loader that does signature
>> checking.
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
>> the body of a message to majordomo@...r.kernel.org More majordomo info at
>> http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/