linux-kernel - Re: [GIT PULL] TPM DEVICE DRIVER changes for v5.14

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 28 Jun 2021 12:11:37 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Stefan Berger <stefanb@...ux.ibm.com>
Cc:     Jarkko Sakkinen <jarkko@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-integrity <linux-integrity@...r.kernel.org>,
        James Morris James Morris <jmorris@...ei.org>,
        David Howells <dhowells@...hat.com>,
        Peter Huewe <peterhuewe@....de>
Subject: Re: [GIT PULL] TPM DEVICE DRIVER changes for v5.14

On Mon, Jun 28, 2021 at 11:33 AM Stefan Berger <stefanb@...ux.ibm.com> wrote:
>
> The removal is triggered by the user changing the type of key from what
> is in the keyfile.

I understand.

But if I earlier pointed the kernel config to one my RSA keys, and
then I change some key type config option to something else, I sure as
hell don't want to perhaps lose my key as a result.

Yes, one common situation is that the key is some automatically
generated one. That's what I use personally - I want a temporary key
that is thrown away and never exists except for validating that "yup,
I built these modules for this kernel". Removing that temporary key is
fine.

But if I pointed MODULE_SIG_KEY to something outside the kernel build,
I sure as hell don't want the kernel build deleting it. Ever. In fact,
it should never write to it. It should extract the key information
from it, and nothing else.

So no. No backups either. Because there is not a single valid
situation where you'd want a backup - because the kernel build should
never EVER modify the original.

Maybe I misunderstand what is going on, but I think the whole thing is
completely wrongly designed. The _only_ key that the kernel build
should touchn is the auto-generated throw-away one (ie
"certs/signing_key.pem"), not CONFIG_MODULE_SIG_KEY in general.

                 Linus