linux-kernel - Re: [PATCH v4 0/3] ima: kernel build support for loading the kernel module signing key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b631513d0b5200577bb613ee23e2cdf7ad4bd175.camel@linux.ibm.com>
Date:   Fri, 09 Apr 2021 14:48:45 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Nayna Jain <nayna@...ux.ibm.com>, linux-integrity@...r.kernel.org,
        keyrings@...r.kernel.org
Cc:     linux-security-module@...r.kernel.org,
        David Howells <dhowells@...hat.com>,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        Stefan Berger <stefanb@...ux.ibm.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        David Woodhouse <dwmw2@...radead.org>
Subject: Re: [PATCH v4 0/3] ima: kernel build support for loading the kernel
 module signing key

On Fri, 2021-04-09 at 10:35 -0400, Nayna Jain wrote:
> Kernel modules are currently only signed when CONFIG_MODULE_SIG is enabled.
> The kernel module signing key is a self-signed CA only loaded onto the
> .builtin_trusted_key keyring.  On secure boot enabled systems with an arch
> specific IMA policy enabled, but without MODULE_SIG enabled, kernel modules
> are not signed, nor is the kernel module signing public key loaded onto the
> IMA keyring.
> 
> In order to load the the kernel module signing key onto the IMA trusted
> keyring ('.ima'), the certificate needs to be signed by a CA key either on
> the builtin or secondary keyrings. The original version of this patch set
> created and loaded a kernel-CA key onto the builtin keyring. The kernel-CA
> key signed the kernel module signing key, allowing it to be loaded onto the
> IMA trusted keyring.
> 
> However, missing from this version was support for the kernel-CA to sign the
> hardware token certificate. Adding that support would add additional
> complexity.
> 
> Since the kernel module signing key is embedded into the Linux kernel at
> build time, instead of creating and loading a kernel-CA onto the builtin
> trusted keyring, this version makes an exception and allows the 
> self-signed kernel module signing key to be loaded directly onto the 
> trusted IMA keyring.

Thanks,  Nayna.

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git 
next-integrity

Mimi