linux-kernel - Re: [PATCH v8 0/3] integrity: support including firmware ".platform" keys at build time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Yh7wst/WbOzI82s/@iki.fi>
Date:   Wed, 2 Mar 2022 05:21:06 +0100
From:   Jarkko Sakkinen <jarkko@...nel.org>
To:     Nayna <nayna@...ux.vnet.ibm.com>
Cc:     linux-integrity@...r.kernel.org, keyrings@...r.kernel.org,
        dhowells@...hat.com, zohar@...ux.ibm.com,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, dimitri.ledkov@...onical.com,
        seth@...shee.me, Nayna Jain <nayna@...ux.ibm.com>
Subject: Re: [PATCH v8 0/3] integrity: support including firmware ".platform"
 keys at build time

On Mon, Feb 21, 2022 at 08:33:55AM -0500, Nayna wrote:
> 
> On 2/20/22 18:02, Jarkko Sakkinen wrote:
> > On Tue, Jan 11, 2022 at 01:36:44PM -0500, Nayna Jain wrote:
> > > Some firmware support secure boot by embedding static keys to verify the
> > > Linux kernel during boot. However, these firmware do not expose an
> > > interface for the kernel to load firmware keys onto the ".platform"
> > > keyring, preventing the kernel from verifying the kexec kernel image
> > > signature.
> > > 
> > > This patchset exports load_certificate_list() and defines a new function
> > > load_builtin_platform_cert() to load compiled in certificates onto the
> > > ".platform" keyring.
> > > 
> > > Changelog:
> > > 
> > > v8:
> > > * Includes Jarkko's feedback on patch description and removed Reported-by
> > > for Patch 1.
> > > 
> > > v7:
> > > * Incldues Jarkko's feedback on patch description for Patch 1 and 3.
> > > 
> > > v6:
> > > * Includes Jarkko's feedback:
> > >   * Split Patch 2 into two.
> > >   * Update Patch description.
> > > 
> > > v5:
> > > * Renamed load_builtin_platform_cert() to load_platform_certificate_list()
> > > and config INTEGRITY_PLATFORM_BUILTIN_KEYS to INTEGRITY_PLATFORM_KEYS, as
> > > suggested by Mimi Zohar.
> > > 
> > > v4:
> > > * Split into two patches as per Mimi Zohar and Dimitri John Ledkov
> > > recommendation.
> > > 
> > > v3:
> > > * Included Jarkko's feedback
> > >   ** updated patch description to include approach.
> > >   ** removed extern for function declaration in the .h file.
> > > * Included load_certificate_list() within #ifdef CONFIG_KEYS condition.
> > > 
> > > v2:
> > > * Fixed the error reported by kernel test robot
> > > * Updated patch description based on Jarkko's feedback.
> > > 
> > > Nayna Jain (3):
> > >    certs: export load_certificate_list() to be used outside certs/
> > >    integrity: make integrity_keyring_from_id() non-static
> > >    integrity: support including firmware ".platform" keys at build time
> > > 
> > >   certs/Makefile                                |  5 ++--
> > >   certs/blacklist.c                             |  1 -
> > >   certs/common.c                                |  2 +-
> > >   certs/common.h                                |  9 -------
> > >   certs/system_keyring.c                        |  1 -
> > >   include/keys/system_keyring.h                 |  6 +++++
> > >   security/integrity/Kconfig                    | 10 +++++++
> > >   security/integrity/Makefile                   | 17 +++++++++++-
> > >   security/integrity/digsig.c                   |  2 +-
> > >   security/integrity/integrity.h                |  6 +++++
> > >   .../integrity/platform_certs/platform_cert.S  | 23 ++++++++++++++++
> > >   .../platform_certs/platform_keyring.c         | 26 +++++++++++++++++++
> > >   12 files changed, 92 insertions(+), 16 deletions(-)
> > >   delete mode 100644 certs/common.h
> > >   create mode 100644 security/integrity/platform_certs/platform_cert.S
> > > 
> > > -- 
> > > 2.27.0
> > To sort out tree conflicts: what if I pick these patches? They look fine
> > to me now. I can try to fix the possible merge conflicts and you can check
> > them before I make a PR.
> 
> Sounds good. Thanks !!
> 
> Thanks & Regards,
> 
>      - Nayna
> 

Sorry that this comes so later but would it possible for you to fix this
conflict against my tree and send v10 with just that change:

$ git diff
diff --cc include/keys/system_keyring.h
index 91e080efb918,d3f914d9a632..000000000000
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@@ -10,12 -10,11 +10,20 @@@
  
  #include <linux/key.h>
  
++<<<<<<< HEAD
 +enum blacklist_hash_type {
 +      /* TBSCertificate hash */
 +      BLACKLIST_HASH_X509_TBS = 1,
 +      /* Raw data hash */
 +      BLACKLIST_HASH_BINARY = 2,
 +};
++=======
+ #ifdef CONFIG_KEYS
+ int load_certificate_list(const u8 cert_list[],
+                         const unsigned long list_size,
+                         const struct key *keyring);
+ #endif
++>>>>>>> certs: export load_certificate_list() to be used outside certs/
  
I somehow lost your response to the jungle and found it only now :-(

I'm still happy to include this to the PR.

BR, Jarkko