linux-kernel - Re: [PATCH 5/9] security: keys: trusted: Allow storage of PCR values in creation data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Feb 2021 07:41:10 +0000
From:   Matthew Garrett <mjg59@...f.ucam.org>
To:     Jarkko Sakkinen <jarkko@...nel.org>
Cc:     Matthew Garrett <matthewgarrett@...gle.com>,
        linux-kernel@...r.kernel.org, linux-integrity@...r.kernel.org,
        linux-pm@...r.kernel.org, keyrings@...r.kernel.org,
        zohar@...ux.ibm.com, jejb@...ux.ibm.com, corbet@....net,
        rjw@...ysocki.net, Matthew Garrett <mjg59@...gle.com>
Subject: Re: [PATCH 5/9] security: keys: trusted: Allow storage of PCR values
 in creation data

On Sat, Feb 20, 2021 at 05:09:07AM +0200, Jarkko Sakkinen wrote:

> Something popped into mind: could we make PCR 23 reservation dynamic
> instead of a config option.
>
> E.g. if the user space uses it, then it's dirty and hibernate will
> fail. I really dislike the static compilation time firewall on it.

We can fail hibernation if userland hasn't flagged things, but the
concern is that if you hibernate with PCR 23 blocking enabled and then
reboot with the blocking disabled, userland can obtain the blob from the
hibernation image, extend PCR 23, modify the image and use the key
they've recovered to make it look legitimate, enable PCR 23 blocking
again and then resume into their own code.