[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20221123005251.h4t2t2lv6tqb5nrp@Rk>
Date: Wed, 23 Nov 2022 08:52:51 +0800
From: Coiby Xu <coxu@...hat.com>
To: Vasily Gorbik <gor@...ux.ibm.com>
Cc: kexec@...ts.infradead.org, Matthew Garrett <mjg59@...f.ucam.org>,
Jiri Bohac <jbohac@...e.cz>,
David Howells <dhowells@...hat.com>,
Philipp Rudo <prudo@...hat.com>, linux-s390@...r.kernel.org,
Heiko Carstens <hca@...ux.ibm.com>,
Alexander Gordeev <agordeev@...ux.ibm.com>,
Christian Borntraeger <borntraeger@...ux.ibm.com>,
Sven Schnelle <svens@...ux.ibm.com>,
James Morris <jmorris@...ei.org>,
Matthew Garrett <mjg59@...gle.com>,
open list <linux-kernel@...r.kernel.org>,
Peter Oberparleiter <oberpar@...ux.ibm.com>
Subject: Re: [PATCH] lockdown: s390: kexec_file: don't skip signature
verification when not secure IPLed
On Tue, Nov 22, 2022 at 04:15:04PM +0100, Vasily Gorbik wrote:
>On Mon, Nov 21, 2022 at 03:27:15PM +0800, Coiby Xu wrote:
>> --- a/arch/s390/kernel/machine_kexec_file.c
>> +++ b/arch/s390/kernel/machine_kexec_file.c
>> @@ -33,10 +33,6 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
>> unsigned long sig_len;
>> int ret;
>>
>> - /* Skip signature verification when not secure IPLed. */
>> - if (!ipl_secure_flag)
>> - return 0;
>
>Looking at s390_verify_sig() especially before commit 0828c4a39be5
>("kexec, KEYS, s390: Make use of built-in and secondary keyring for
>signature verification") I think this condition actually expresses
>2 things:
>1. the firmware is secure IPL capable and secure IPL keys are
> provided and present in platform keyring.
>2. secure IPL is enabled.
>
>Wouldn't this change have implications for machines with older firmware
>which doesn't support secure IPL? In this case platform keyring won't
>have any secure IPL keys (since firmware doesn't provide them)
>and any properly signed kernels will be rejected for kexec in this
>function. Unless secure IPL keys are also present in built-in or secondary
>keyring (which is possible after commit 0828c4a39be5) - is that what
>distributions normally do?
Thanks for pointing me to the above commit and reminding me older
firmware doesn't support secure IPL! But I don't think this change will
break machines with older firmwares which doesn't support secure IPL.
Distributions like Fedora/RHEL have downstream-only patch that enable
lockdown automatically when secure boot is enabled. Since there is no
secure IPL, lockdown won't be enabled which means
kimage_validate_signature (kernel/kexec_file.c) doesn't enforce
signature verification (sorry I should change the commit subject which
is misleading). For the case where users manually enables lockdown, I
assume they know what lockdown means and expect signature verification
to be enforced instead to be silently bypassed.
--
Best regards,
Coiby
Powered by blists - more mailing lists