linux-kernel - Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel enforces module loading restrictions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 8 Sep 2013 17:25:31 +0000
From:	Matthew Garrett <matthew.garrett@...ula.com>
To:	Greg KH <gregkh@...uxfoundation.org>
CC:	Kees Cook <keescook@...omium.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
	"hpa@...or.com" <hpa@...or.com>
Subject: Re: [PATCH V3 08/11] kexec: Disable at runtime if the kernel
 enforces module loading restrictions

On Sun, 2013-09-08 at 10:22 -0700, Greg KH wrote:
> On Sun, Sep 08, 2013 at 04:59:40PM +0000, Matthew Garrett wrote:
> > On Sun, 2013-09-08 at 09:39 -0700, Greg KH wrote:
> > 
> > > But I want, for other reasons (i.e. safety in layers), signed kernel
> > > modules.  I also might actually want some debugfs files in some random
> > > driver (like this series removes).
> > 
> > You want a configuration that makes no sense. There's no reason that the
> > kernel should make that easy.
> 
> It makes sense to me in that it is something I can do today, why stop
> that?

You used to be able to modify MSRs without CAP_SYS_ADMIN. Why stop that?

> > > Heck, look at Red Hat.  They have been shipping signed kernel modules
> > > for _years_ and yet they do not disable kexec.  Have they been "doing it
> > > wrong" all of this time?   Perhaps people want signed modules just for
> > > support reasons, not "security" reasons.
> > 
> > Then they do what Red Hat does and don't set CONFIG_SIG_ENFORCE.
> 
> But what if I only want signed modules to be loaded?  Isn't that a valid
> thing to want, yet still be able to also do other things with my system?

If you only want signed modules to be loaded then you can't permit the
kexec of untrusted objects, because that would allow unsigned modules to
be loaded.

> > Where's the option to let me let unprivileged users set random MSRs?
> 
> Can that happen today?

No. We took it away.

> > Where's the option to let root disable STRICT_DEVMEM at runtime?
> 
> Again, can that happen today?

No, because it makes no sense - the entire point of STRICT_DEVMEM is to
restrict what root can do.

> > We don't offer these options because *they make no sense*. Locking
> > your door while leaving your window open may make you feel better, but
> > it doesn't improve the security of your house.
> 
> Yes it does, it keeps the people who only try the front door from coming
> in, a very common threat model.  It isn't "perfect" security, but I'm
> not saying that it is, and no one else is either.

Why would someone only try the front door when there's an obviously open
window next to it?

> Security is a series of "levels", all of which depend on different
> threat models and scenarios.  Provide the ability to achieve different
> levels of security, but don't force your idea of system-wide security on
> others who may not agree with it.

Providing a security feature that can be trivially circumvented isn't
security, it's security theatre.
-- 
Matthew Garrett <matthew.garrett@...ula.com>