linux-kernel - Re: [PATCH 4/5] keys: define build time generated ephemeral kernel CA key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <31d434e0861a02b214e3189f958921384aa75362.camel@linux.ibm.com>
Date:   Thu, 11 Feb 2021 18:25:05 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Stefan Berger <stefanb@...ux.ibm.com>,
        Nayna Jain <nayna@...ux.ibm.com>,
        linux-integrity@...r.kernel.org, keyrings@...r.kernel.org
Cc:     linux-security-module@...r.kernel.org,
        David Howells <dhowells@...hat.com>,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 4/5] keys: define build time generated ephemeral kernel
 CA key

On Thu, 2021-02-11 at 17:13 -0500, Stefan Berger wrote:
> On 2/11/21 2:54 PM, Nayna Jain wrote:
> > Certificates being loaded onto the IMA trusted keyring must be signed by
> > a key on either the builtin and secondary trusted keyring.
> >
> > This patch creates and includes in the kernel image an ephemeral CA
> > key, at build time when IMA_APPRAISE_MODSIG is enabled.
> >
> > Signed-off-by: Nayna Jain <nayna@...ux.ibm.com>
> > ---

<snip>

> > diff --git a/certs/Makefile b/certs/Makefile
> 
> > @@ -60,14 +78,23 @@ $(obj)/signing_key.pem: $(obj)/x509.genkey
> >   	@$(kecho) "### needs to be run as root, and uses a hardware random"
> >   	@$(kecho) "### number generator if one is available."
> >   	@$(kecho) "###"
> > +ifeq ($(CONFIG_IMA_APPRAISE_MODSIG),y)
> > +	# Generate kernel build time CA Certificate.
> > +	@$(Q)openssl req -new -nodes -utf8 \
> > +		-$(CONFIG_MODULE_SIG_HASH) -days 36500 \
> > +		-subj "/CN=Build time autogenerated kernel CA key" \
> > +		-batch -x509 -config $(obj)/x509.genkey \
> > +		-outform PEM -out $(CA_KEY) \
> > +		-keyout $(CA_KEY) -extensions ca_ext \
> > +		$($(quiet)redirect_openssl)
> > +endif # CONFIG_IMA_APPRAISE_MODSIG
> >   	$(Q)openssl req -new -nodes -utf8 \
> >   		-batch -config $(obj)/x509.genkey \
> >   		-outform PEM -out $(obj)/signing_key.csr \
> >   		-keyout $(obj)/signing_key.key -extensions myexts \
> >   		$($(quiet)redirect_openssl)
> >   	$(Q)openssl x509 -req -days 36500 -in $(obj)/signing_key.csr \
> > -		-outform PEM -out $(obj)/signing_key.crt \
> > -		-signkey $(obj)/signing_key.key \
> > +		-outform PEM -out $(obj)/signing_key.crt $(SIGNER) \
> >   		-$(CONFIG_MODULE_SIG_HASH) -extensions myexts \
> >   		-extfile $(obj)/x509.genkey \
> >   		$($(quiet)redirect_openssl)
> 
> It may make things easier (also below) if the CA was always created and 
> the kernel signing key was always signed by that CA rather than doing 
> this only in the IMA_APPRAISE_MODSIG case. Maybe someone else has an 
> opinion on that?

Thanks, Stefan.  It would definitely simplify the code.  We wanted to
minimize the code change and solicit feedback, before making such a
change.

Mimi