lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 9 May 2016 12:20:21 +0300 From: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com> To: Thomas Gleixner <tglx@...utronix.de> Cc: "Dr. Greg Wettstein" <greg@...ellic.com>, "Austin S. Hemmelgarn" <ahferroin7@...il.com>, Pavel Machek <pavel@....cz>, gregkh@...uxfoundation.org, Andy Lutomirski <luto@...nel.org>, Borislav Petkov <bp@...e.de>, Boris Ostrovsky <boris.ostrovsky@...cle.com>, "open list:STAGING SUBSYSTEM" <devel@...verdev.osuosl.org>, Ingo Molnar <mingo@...nel.org>, Kristen Carlson Accardi <kristen@...ux.intel.com>, "open list:DOCUMENTATION" <linux-doc@...r.kernel.org>, open list <linux-kernel@...r.kernel.org>, Mathias Krause <minipli@...glemail.com>, Wan Zongshun <Vincent.Wan@....com> Subject: Re: [PATCH 0/6] Intel Secure Guard Extensions On Mon, May 09, 2016 at 08:27:04AM +0200, Thomas Gleixner wrote: > On Mon, 9 May 2016, Jarkko Sakkinen wrote: > > On Fri, May 06, 2016 at 01:54:14PM +0200, Thomas Gleixner wrote: > > > On Fri, 6 May 2016, Jarkko Sakkinen wrote: > > > > > > > On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote: > > > > > It would be helpful and instructive for anyone involved in this debate > > > > > to review the following URL which details Intel's SGX licening > > > > > program: > > > > > > > > > > https://software.intel.com/en-us/articles/intel-sgx-product-licensing > > > > > > > > I think it would be good to note that the licensing process is available > > > > only for Windows. For Linux you can only use debug enclaves at the > > > > moment. The default LE has "allow-all" policy for debug enclaves. > > > > > > Which makes the feature pretty useless. > > > > > > > > I think the only way forward to make all of this palatable is to > > > > > embrace something similar to what has been done with Secure Boot. The > > > > > Root Enclave Key will need to be something which can be reconfigured > > > > > by the Platform Owner through BIOS/EFI. That model would take Intel > > > > > off the hook from a security perspective and establish the notion of > > > > > platform trust to be a bilateral relationship between a service > > > > > provider and client. > > > > > > > > This concern has been raised many times now. Sadly this did not make > > > > into Skyle but in future we will have one shot MSRs (can be set only > > > > once per boot cycle) for defining your own root of trust. > > > > > > We'll wait for that to happen. > > > > I fully understand if you (and others) want to keep this standpoint but > > what if we could get it to staging after I've revised it with suggested > > This should not go to staging at all. Either this is going to be a real useful > driver or we just keep it out of tree. > > > changes and internal changes in my TODO? Then it would not pollute the > > mainline kernel but still would be easily available for experimentation. > > How are we supposed to experiment with that if there is no launch enclave for > Linux available? Understood. I appreciate all the feedback that I've received and come back later when the time is better with a refined patch set (especially Andys feedback showed that the documentation needs alot of rework). > Thanks, > > tglx /Jarkko
Powered by blists - more mailing lists