linux-kernel - Re: Should we automatically generate a module signing key at all?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <24757.1432332934@warthog.procyon.org.uk>
Date:	Fri, 22 May 2015 23:15:34 +0100
From:	David Howells <dhowells@...hat.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	dhowells@...hat.com, George Spelvin <linux@...izon.com>,
	David Woodhouse <dwmw2@...radead.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	LSM List <linux-security-module@...r.kernel.org>,
	Andy Lutomirski <luto@...capital.net>, petkan@...-labs.com,
	"Theodore Ts'o" <tytso@....edu>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Subject: Re: Should we automatically generate a module signing key at all?

Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> I forget the exact details of the signature ..., but for the modules
> themselves, it's just appended to the module contents.

Yes.

> And because the size of the certificate list is variable, you can't just
> zero it out or anything like that to make things compare equal.

Since it's discarded at the end of boot, it could be padded significantly.

Also the kernel image gets compressed and a prologue attached before being
placed in the binary RPMs or whatever, so you can't zero out the keys in those
very easily.

> But we might also simply decide to pack the keys differently. I'd
> personally be ok with it being in the initrd, for example, although
> for all I know that might screw up the people who actually want to use
> the BIOS secure booting thing

We wouldn't be able to trust any key loaded from the initrd unless the initrd
was itself verifiable.  Further, the initrd, at least in Fedora, gets composed
on the running system upon kernel installation so that it holds just the
modules you need to keep the size down.

> (I don't know how much that verifies).

The BIOS secure booting thing verifies the shim, grub and the kernel, as I
understand it.  The kernel then verifies modules and kexec images.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/