linux-kernel - Re: Should we automatically generate a module signing key at all?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3253.1432052599@warthog.procyon.org.uk>
Date:	Tue, 19 May 2015 17:23:19 +0100
From:	David Howells <dhowells@...hat.com>
To:	"Theodore Ts'o" <tytso@....edu>
Cc:	dhowells@...hat.com, Andy Lutomirski <luto@...capital.net>,
	Andy Lutomirski <luto@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Michal Marek <mmarek@...e.cz>,
	David Woodhouse <dwmw2@...radead.org>,
	Abelardo Ricart III <aricart@...nix.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Sedat Dilek <sedat.dilek@...il.com>, keyrings@...ux-nfs.org,
	Rusty Russell <rusty@...tcorp.com.au>,
	LSM List <linux-security-module@...r.kernel.org>,
	Borislav Petkov <bp@...en8.de>, Jiri Kosina <jkosina@...e.cz>
Subject: Re: Should we automatically generate a module signing key at all?

Theodore Ts'o <tytso@....edu> wrote:

> Is module signing really meant for distro kernels, or would anyone
> besides people creating distro kernels care about this?

I think this is mainly for distro kernels where we need to provide certainty
and security.

Fedora and RHEL make good use of this for their kernel modules and are now
making use of it for kexec too.  Kernel images are EFI objects - ie. signed PE
files using Microsoft's spec.

Firmware validation isn't a consideration yet, but UEFI interaction is (UEFI
keys, blacklists).

For my own purposes when running kernels on my test machines, I build kernels
with all the necessary drivers built in and boot them directly out of the
build tree by PXE.  Then I copy any modules I'm testing by scp and use them.
I don't generally use signed modules anymore because the modules aren't signed
during the build phase but rather during the module installation phase (which
isn't of any use to me).   I'm not too worried about being attacked on those
machines though as they're rebooted (or powered off) regularly and are crashed
a lot.

> If not, maybe it's simpler just make things easy for people who will be
> storing the key in some external hardware device, and just be done with it.

Did you mean make it possible to only use external hardware for storing the
key?  That wouldn't very convenient for building our kernels in our build farm
- we have a lot of machines and all of them would have to be equiped with the
key.  Besides, we *want* to discard the private key where possible as soon as
possible because then we can't leak it and we can't be forced to disclose it.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/