linux-kernel - Re: [PATCH v2 0/7] add platform/firmware keys support for kernel verification by IMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1544380796.3794.6.camel@linux.ibm.com>
Date:   Sun, 09 Dec 2018 13:39:56 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Nayna Jain <nayna@...ux.ibm.com>, linux-integrity@...r.kernel.org
Cc:     linux-security-module@...r.kernel.org, linux-efi@...r.kernel.org,
        linux-kernel@...r.kernel.org, dhowells@...hat.com,
        jforbes@...hat.com, seth.forshee@...onical.com,
        kexec@...ts.infradead.org, keyrings@...r.kernel.org,
        vgoyal@...hat.com, ebiederm@...ssion.com, mpe@...erman.id.au
Subject: Re: [PATCH v2 0/7] add platform/firmware keys support for kernel
 verification by IMA

Hi Nayna,

On Sun, 2018-12-09 at 01:56 +0530, Nayna Jain wrote:
> On secure boot enabled systems, a verified kernel may need to kexec
> additional kernels. For example, it may be used as a bootloader needing
> to kexec a target kernel or it may need to kexec a crashdump kernel.
> In such cases, it may want to verify the signature of the next kernel
> image.
> 
> It is possible that the new kernel image is signed with third party keys
> which are stored as platform or firmware keys in the 'db' variable. The
> kernel, however, can not directly verify these platform keys, and an
> administrator may therefore not want to trust them for arbitrary usage.
> In order to differentiate platform keys from other keys and provide the
> necessary separation of trust the kernel needs an additional keyring to
> store platform/firmware keys.
> 
> The secure boot key database is expected to store the keys as EFI
> Signature List(ESL). The patch set uses David Howells and Josh Boyer's
> patch to access and parse the ESL to extract the certificates and load
> them onto the platform keyring.
> 
> The last patch in this patch set adds support for IMA-appraisal to
> verify the kexec'ed kernel image based on keys stored in the platform
> keyring.

Thanks!  This patch set is now in the #next-integrity branch.

https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/

Mimi