linux-kernel - Re: RFC: sign the modules at install time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a9vko0z7.fsf@rustcorp.com.au>
Date:	Thu, 18 Oct 2012 15:01:08 +1030
From:	Rusty Russell <rusty@...tcorp.com.au>
To:	Linus Torvalds <torvalds@...ux-foundation.org>,
	David Howells <dhowells@...hat.com>
Cc:	David Miller <davem@...emloft.net>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	jwboyer@...hat.com, pjones@...hat.com
Subject: Re: RFC: sign the modules at install time

Linus Torvalds <torvalds@...ux-foundation.org> writes:
> On Wed, Oct 17, 2012 at 3:19 PM, David Howells <dhowells@...hat.com> wrote:
>>
>> It's probably even better to just get rid of all the automatic module signing
>> stuff completely and leave the sign-file script for the builder to use
>> manually.  The module verification code will still be present.
>
> That's just disgusting crazy talk.
>
> Christ, David, get a grip on yourself. You seem to dismiss the "people
> want to build their own kernel" people entirely.
>
> One of the main sane use-cases for module signing is:
>
>  - CONFIG_CHECK_SIGNATURE=y
>  - randomly generated one-time key
>  - "make modules_install; make install"
>  - "make clean" to get rid of the keys.
>  - reboot.
>
> and now you have a custom kernel that has the convenience of modules,
> yet is basically as safe as a non-modular build. The above makes it
> much harder for any kind of root-kit module to be loaded, and
> basically entirely avoids one fundamental security scare of modules.

If you only want this, we could SHA all the built modules, put that in
the kernel, and verify the module being loaded matches one of them.

Sure, it means a bit of trickery to get the module sums into the
bzImage, but the rest is trivial.

Cheers,
Rusty.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/