linux-kernel - [RFC PATCH v2 0/2] let kexec_file_load use platform keyring to verify the kernel image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 15 Jan 2019 17:45:40 +0800
From:   Kairui Song <kasong@...hat.com>
To:     linux-kernel@...r.kernel.org
Cc:     dhowells@...hat.com, dwmw2@...radead.org,
        jwboyer@...oraproject.org, keyrings@...r.kernel.org,
        jmorris@...ei.org, serge@...lyn.com, zohar@...ux.ibm.com,
        bauerman@...ux.ibm.com, ebiggers@...gle.com, nayna@...ux.ibm.com,
        dyoung@...hat.com, linux-integrity@...r.kernel.org,
        kexec@...ts.infradead.org, Kairui Song <kasong@...hat.com>
Subject: [RFC PATCH v2 0/2] let kexec_file_load use platform keyring to verify the kernel image

Hi,

This patch series adds a .platform_trusted_keys in system_keyring as the
reference to .platform keyring in integrity subsystem, when platform
keyring is being initialized it will be updated. So other component could
use this keyring as well.

This patch series also let kexec_file_load use platform keyring as fall
back if it failed to verify the image against secondary keyring, make it
possible to load kernel signed by third part key if third party key is
imported in the firmware.

After this patch kexec_file_load will be able to verify a signed PE
bzImage using keys in platform keyring.

Tested in a VM with locally signed kernel with pesign and imported the
cert to EFI's MokList variable.

Kairui Song (2):
  integrity, KEYS: add a reference to platform keyring
  kexec, KEYS: Make use of platform keyring for signature verify

Update from V1:
  - Make platform_trusted_keys static, and update commit message as suggested
    by Mimi Zohar
  - Always check if platform keyring is initialized before use it

 arch/x86/kernel/kexec-bzimage64.c | 15 ++++++++++++---
 certs/system_keyring.c            | 20 +++++++++++++++++++-
 include/keys/system_keyring.h     |  5 +++++
 include/linux/verification.h      |  3 +++
 security/integrity/digsig.c       |  6 ++++++
 5 files changed, 45 insertions(+), 4 deletions(-)

-- 
2.20.1