linux-kernel - Re: [dm-devel] [PATCH v4 1/3] dm: Add verity helpers for LoadPin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19149028-ec94-8f64-aed4-1e58f29942a8@gmail.com>
Date:   Wed, 18 May 2022 09:57:43 +0200
From:   Milan Broz <gmazyland@...il.com>
To:     Matthias Kaehlcke <mka@...omium.org>,
        Alasdair Kergon <agk@...hat.com>,
        Mike Snitzer <snitzer@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        James Morris <jmorris@...ei.org>,
        "Serge E . Hallyn" <serge@...lyn.com>
Cc:     dm-devel@...hat.com, Douglas Anderson <dianders@...omium.org>,
        linux-kernel@...r.kernel.org, linux-raid@...r.kernel.org,
        Song Liu <song@...nel.org>,
        linux-security-module@...r.kernel.org
Subject: Re: [dm-devel] [PATCH v4 1/3] dm: Add verity helpers for LoadPin

On 18/05/2022 01:34, Matthias Kaehlcke wrote:
> LoadPin limits loading of kernel modules, firmware and certain
> other files to a 'pinned' file system (typically a read-only
> rootfs). To provide more flexibility LoadPin is being extended
> to also allow loading these files from trusted dm-verity
> devices. For that purpose LoadPin can be provided with a list
> of verity root digests that it should consider as trusted.
> 
> Add a bunch of helpers to allow LoadPin to check whether a DM
> device is a trusted verity device. The new functions broadly
> fall in two categories: those that need access to verity
> internals (like the root digest), and the 'glue' between
> LoadPin and verity. The new file dm-verity-loadpin.c contains
> the glue functions.
> 
> Signed-off-by: Matthias Kaehlcke <mka@...omium.org>

...

> +
> +	if (dm_verity_get_root_digest(ti, &root_digest, &digest_size))
> +		return false;

Almost unrelated note, but as there are more and more situations
that checks verity root digest, shouldn't we export this as read-only
sysfs attribute for DM verity devices?

Attacker can always calculate (but not change) Merkle tree, so this
is not something that need to be hidden.

It would allow userspace to easily enumerate trusted DM devices without
calling kernel ioctls...

...

> +
> +	table = dm_get_live_table(md, &srcu_idx);
> +
> +	if (dm_table_get_num_targets(table) != 1)
> +		goto out;
> +
> +	ti = dm_table_get_target(table, 0);
> +
> +	if (is_trusted_verity_target(ti))
> +		trusted = true;

What happens is someone reloads verity table later with
a different content (or even different target type)?
Does LoadPin even care here?

...

>   static struct target_type verity_target = {
>   	.name		= "verity",
>   	.version	= {1, 8, 0},

Please increase the minor version, it is very useful to detect (in logs)
that the target driver has compatible extensions.


I guess this change does not affect userspace veristysetup
(as it is used handled by different tooling), right?

Thanks,
Milan