linux-kernel - Re: kexec_load(2) bypasses signature verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150617032607.GC4076@thunk.org>
Date:	Tue, 16 Jun 2015 23:26:07 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	Vivek Goyal <vgoyal@...hat.com>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Josh Boyer <jwboyer@...oraproject.org>,
	David Howells <dhowells@...hat.com>,
	kexec <kexec@...ts.infradead.org>,
	"Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
	Dave Young <dyoung@...hat.com>, Petr Tesarik <ptesarik@...e.cz>
Subject: Re: kexec_load(2) bypasses signature verification

On Tue, Jun 16, 2015 at 04:27:57PM -0400, Vivek Goyal wrote:
> 
> So looks like you are looking for a system/option where you just want to
> always make use of kexec_file_load() and disable kexec_load(). This sounds
> like you want a kernel where kexec_load() is compiled out and you want
> only kexec_file_load() in.

Either compiled out or disabled via some flag (similar to how signed
moduled verification can be required via a flag that can be set, but
not unset once it is set), yes.

> Right now one can't do that becase kexec_file_load() depends on
> CONFIG_KEXEC option.
> 
> I am wondering that how about making CONFIG_KEXEC_FILE_LOAD independent
> of CONFIG_KEXEC. That way one can set CONFIG_KEXEC_VERIFY_SIG=y, and
> only signed kernel can be kexeced on that system.

That would certianly also be a workable strategy.

> This should gel well with long term strategy of deprecating kexec_load()
> at some point of time when kexec_file_load() is ready to completely
> replace it.

Well, note that Debian and Ubuntu are still using kexec-tools 2.0.7
(even in their latest development/unstable releases), which doesn't
have support for kexec_file_load().  So we need to get Debian to
upgrade its kexec-tools as part of this.  I'll try to file a
nag-o-gram to the Debian BTS.

						- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/