linux-kernel - Re: [PATCH v8 0/3] integrity: support including firmware ".platform" keys at build time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0a87bb3b-574c-6e8e-2f8f-49e42d71ab8c@linux.vnet.ibm.com>
Date:   Mon, 21 Feb 2022 08:33:55 -0500
From:   Nayna <nayna@...ux.vnet.ibm.com>
To:     Jarkko Sakkinen <jarkko@...nel.org>
Cc:     linux-integrity@...r.kernel.org, keyrings@...r.kernel.org,
        dhowells@...hat.com, zohar@...ux.ibm.com,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, dimitri.ledkov@...onical.com,
        seth@...shee.me, Nayna Jain <nayna@...ux.ibm.com>
Subject: Re: [PATCH v8 0/3] integrity: support including firmware ".platform"
 keys at build time


On 2/20/22 18:02, Jarkko Sakkinen wrote:
> On Tue, Jan 11, 2022 at 01:36:44PM -0500, Nayna Jain wrote:
>> Some firmware support secure boot by embedding static keys to verify the
>> Linux kernel during boot. However, these firmware do not expose an
>> interface for the kernel to load firmware keys onto the ".platform"
>> keyring, preventing the kernel from verifying the kexec kernel image
>> signature.
>>
>> This patchset exports load_certificate_list() and defines a new function
>> load_builtin_platform_cert() to load compiled in certificates onto the
>> ".platform" keyring.
>>
>> Changelog:
>>
>> v8:
>> * Includes Jarkko's feedback on patch description and removed Reported-by
>> for Patch 1.
>>
>> v7:
>> * Incldues Jarkko's feedback on patch description for Patch 1 and 3.
>>
>> v6:
>> * Includes Jarkko's feedback:
>>   * Split Patch 2 into two.
>>   * Update Patch description.
>>
>> v5:
>> * Renamed load_builtin_platform_cert() to load_platform_certificate_list()
>> and config INTEGRITY_PLATFORM_BUILTIN_KEYS to INTEGRITY_PLATFORM_KEYS, as
>> suggested by Mimi Zohar.
>>
>> v4:
>> * Split into two patches as per Mimi Zohar and Dimitri John Ledkov
>> recommendation.
>>
>> v3:
>> * Included Jarkko's feedback
>>   ** updated patch description to include approach.
>>   ** removed extern for function declaration in the .h file.
>> * Included load_certificate_list() within #ifdef CONFIG_KEYS condition.
>>
>> v2:
>> * Fixed the error reported by kernel test robot
>> * Updated patch description based on Jarkko's feedback.
>>
>> Nayna Jain (3):
>>    certs: export load_certificate_list() to be used outside certs/
>>    integrity: make integrity_keyring_from_id() non-static
>>    integrity: support including firmware ".platform" keys at build time
>>
>>   certs/Makefile                                |  5 ++--
>>   certs/blacklist.c                             |  1 -
>>   certs/common.c                                |  2 +-
>>   certs/common.h                                |  9 -------
>>   certs/system_keyring.c                        |  1 -
>>   include/keys/system_keyring.h                 |  6 +++++
>>   security/integrity/Kconfig                    | 10 +++++++
>>   security/integrity/Makefile                   | 17 +++++++++++-
>>   security/integrity/digsig.c                   |  2 +-
>>   security/integrity/integrity.h                |  6 +++++
>>   .../integrity/platform_certs/platform_cert.S  | 23 ++++++++++++++++
>>   .../platform_certs/platform_keyring.c         | 26 +++++++++++++++++++
>>   12 files changed, 92 insertions(+), 16 deletions(-)
>>   delete mode 100644 certs/common.h
>>   create mode 100644 security/integrity/platform_certs/platform_cert.S
>>
>> -- 
>> 2.27.0
> To sort out tree conflicts: what if I pick these patches? They look fine
> to me now. I can try to fix the possible merge conflicts and you can check
> them before I make a PR.

Sounds good. Thanks !!

Thanks & Regards,

      - Nayna