lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 27 Sep 2021 17:31:09 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Andreas Rammhold <andreas@...mhold.de>
Cc:     Ahmad Fatoum <a.fatoum@...gutronix.de>,
        James Bottomley <jejb@...ux.ibm.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        David Howells <dhowells@...hat.com>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Sumit Garg <sumit.garg@...aro.org>,
        linux-integrity@...r.kernel.org, keyrings@...r.kernel.org,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] KEYS: trusted: Fix trusted key backends when
 building as module

On Mon, 2021-09-27 at 22:55 +0200, Andreas Rammhold wrote:
> On 16:33 27.09.21, Mimi Zohar wrote:
> > On Mon, 2021-09-27 at 22:08 +0200, Andreas Rammhold wrote:
> > > On 07:27 27.09.21, Mimi Zohar wrote:
> > > > On Mon, 2021-09-27 at 10:51 +0200, Andreas Rammhold wrote:
> > > > > On 09:47 13.09.21, Ahmad Fatoum wrote:
> > > > > > Dear trusted key maintainers,
> > > > > > 
> > > > > > On 30.07.21 03:28, Andreas Rammhold wrote:
> > > > > > > Before this commit the kernel could end up with no trusted key sources
> > > > > > > even though both of the currently supported backends (TPM and TEE) were
> > > > > > > compiled as modules. This manifested in the trusted key type not being
> > > > > > > registered at all.
> > > > > > > 
> > > > > > > When checking if a CONFIG_… preprocessor variable is defined we only
> > > > > > > test for the builtin (=y) case and not the module (=m) case. By using
> > > > > > > the IS_REACHABLE() macro we do test for both cases.
> > > > > > > 
> > > > > > > Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework")
> > > > > > > Signed-off-by: Andreas Rammhold <andreas@...mhold.de>
> > > > > > > Reviewed-by: Jarkko Sakkinen <jarkko@...nel.org>
> > > > > > Does anyone intend to pick this up?
> > > > > 
> > > > > Did this end up in any tree by now? I am wondering if I should resend
> > > > > the patch instead. Perhaps it was just overlooked?
> > > > 
> > > > For EVM environments only using trusted and encrypted keys, not file
> > > > signatures, the trusted key is needed to decrypt the "master" key in
> > > > order to verify kernel modules.
> > > 
> > > So what you are saying is that right now (before this patch & after this
> > > patch) you could compile a kernel that wouldn't be able to load any
> > > modules when the trusted keychain part is built as module?
> > 
> > Before this patch, trusted and encrypted keys are builtin, so verifying
> > kernel modules with security.evm containing an EVM hmac would succeed. 
> > Afterwards it would fail, as there's a dependency on the trusted key to
> > verify the integrity of the trusted key module.
> 
> But building with =m was a valid configuration which is the original
> reason for me submitting the patch. So perhaps this should not be
> allowed to be a module then?

My mistake.  Trusted and encrypted key types have always been defined
as tristate.  Only when EVM selects encrypted keys, and by extension
trusted keys, are they builtin.

Mimi

Powered by blists - more mailing lists