linux-kernel - Re: [PATCH v12 0/4] integrity: support including firmware ".platform" keys at build time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e59f2006-6af2-5f3a-eb34-cc8ccc99d75f@linux.ibm.com>
Date:   Sat, 12 Mar 2022 08:12:50 +0530
From:   Nageswara Sastry <rnsastry@...ux.ibm.com>
To:     Nayna Jain <nayna@...ux.ibm.com>, linux-integrity@...r.kernel.org,
        keyrings@...r.kernel.org
Cc:     dhowells@...hat.com, zohar@...ux.ibm.com, jarkko@...nel.org,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, dimitri.ledkov@...onical.com,
        seth@...shee.me, masahiroy@...nel.org
Subject: Re: [PATCH v12 0/4] integrity: support including firmware ".platform"
 keys at build time



On 12/03/22 2:33 am, Nayna Jain wrote:
> Some firmware support secure boot by embedding static keys to verify the
> Linux kernel during boot. However, these firmware do not expose an
> interface for the kernel to load firmware keys onto the ".platform"
> keyring, preventing the kernel from verifying the kexec kernel image
> signature.
> 
> This patchset exports load_certificate_list() and defines a new function
> load_builtin_platform_cert() to load compiled in certificates onto the
> ".platform" keyring.
> 
> Changelog:
> v12:
> * Replace Patch 3/4 with reverting of the commit as suggested by
> Masahiro Yamada.
> 

Tested the following four patches ov v12 with and with out setting 
CONFIG_INTEGRITY_PLATFORM_KEYS

Tested-by: Nageswara R Sastry <rnsastry@...ux.ibm.com>


1. With CONFIG_INTEGRITY_PLATFORM_KEYS set to a key

# grep pem .config
CONFIG_INTEGRITY_PLATFORM_KEYS="certs/kernel.pem"
CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"

# grep 
"CONFIG_INTEGRITY_PLATFORM_KEYS\|INTEGRITY_PLATFORM_KEYRING\|SYSTEM_REVOCATION_LIST" 
.config
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYS="certs/kernel.pem"
# CONFIG_SYSTEM_REVOCATION_LIST is not set

# cat /proc/keys | grep platform
0a7a11a9 I------     1 perm 1f0b0000     0     0 keyring   .platform: 1

# keyctl show %keyring:.platform
Keyring
  175772073 ---lswrv      0     0  keyring: .platform
  519271447 ---lswrv      0     0   \_ asymmetric: IBM Corporation: 
Guest Secure Boot Imprint Kernel Signing Key: 
a0cf9069c30875320cb10a77325d4fa7012f8d12


2. With out CONFIG_INTEGRITY_PLATFORM_KEYS set, leaving empty

# grep pem .config
CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"

# grep 
"CONFIG_INTEGRITY_PLATFORM_KEYS\|INTEGRITY_PLATFORM_KEYRING\|SYSTEM_REVOCATION_LIST" 
.config
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYS=""
# CONFIG_SYSTEM_REVOCATION_LIST is not set

# cat /proc/keys | grep platform
39c749b9 I------     1 perm 1f0b0000     0     0 keyring   .platform: empty

# keyctl show %keyring:.platform
Keyring
  969361849 ---lswrv      0     0  keyring: .platform



> 
> base-commit: fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9

-- 
Thanks and Regards
R.Nageswara Sastry