linux-kernel - Re: [PATCH v2] certs: Add option to disallow non-CA certificates in secondary trusted keying

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <CVGEE9ODRR8I.1RIVO2MVE2UAX@suppilovahvero>
Date:   Tue, 12 Sep 2023 00:15:30 +0300
From:   "Jarkko Sakkinen" <jarkko@...nel.org>
To:     "Denis Glazkov" <d.glazkov@....ru>,
        "Sergey Shtylyov" <s.shtylyov@....ru>
Cc:     "dhowells@...hat.com" <dhowells@...hat.com>,
        "dwmw2@...radead.org" <dwmw2@...radead.org>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] certs: Add option to disallow non-CA certificates in
 secondary trusted keying

On Fri Sep 8, 2023 at 3:14 PM EEST, Denis Glazkov wrote:
> The Linux kernel has an IMA (Integrity Measurement Architecture)
> subsystem to check the integrity of the file system based on digital
> signatures. IMA uses certificates in `.ima` keying to check integrity.
>
> Only certificates issued by one of the trusted CA (Certificate Authority)
> certificates can be added to the `.ima` keying.
>
> The Linux kernel now has a secondary trusted keying to which trusted
> certificates from user space can be added if you have superuser
> privileges. Previously, all trusted certificates were in the built-in
> trusted keying, which could not be modified from user space.
> Trusted certificates were placed in the built-in trusted keying at
> kernel compile time.
>
> The secondary trusted keying is designed so that any certificates that
> are signed by one of the trusted CA certificates in the built-in or
> secondary trusted keyring can be added to it.
>
> Let's imagine that we have the following certificate trust chain:
>
>              ┌───────────────────────────┬─────────────────────┐
>              │                           │     ┌───────┐       │
>              │                           │     │       │       │
> ┌────────────▼────────┐    ┌─────────────▼─────▼────┐  │ ┌─────┴─────┐
> │.builtin_trusted_keys│◄───┤.secondary_trusted_keys ├──┘ │   .ima    │
> ├─────────────────────┤    ├────────────────────────┤    ├───────────┤
> │     Root CA Cert    │-----► Intermediate CA Cert  │-----► IMA Cert │
> └─────────────────────┘    └────────────────────────┘    └───────────┘
>
>                 Issues                  Restricted by
>             -------------►             ──────────────►
>
> Since the IMA certificate is signed by a CA certificate from a secondary
> trusted keying, an attacker with superuser privileges will be able to
> add the IMA certificate to the secondary trusted keying. That is, the IMA
> certificate will become trusted.
>
> Since, with `CONFIG_MODULE_SIG` option enabled, modules can only be
> loaded into kernel space if they are signed with one of the trusted
> certificates, an attacker could sign untrusted kernel modules with
> the private key corresponding to the IMA certificate and successfully
> load the untrusted modules into kernel space.
>
> This patch adds the configuration that once enabled, only
> certificates that meet the following requirements can be added
> to the secondary trusted keying:
>
> 1. The certificate is a CA (Certificate Authority)
> 2. The certificate must be used for verifying a CA's signatures
> 3. The certificate must not be used for digital signatures
>
> Signed-off-by: Denis Glazkov <d.glazkov@....ru>

s/keying/keyring/ (multiple)

Have you considered instead making mod_verify_sig() more robust?
Obviously this would mean making selection of keys in
verify_pkcs7_signature() more robust (see the documentation of
'trusted_keys').

The this would be also less niche feature to pick for distributors
if it was just concerning module loading, and have associated config
flag over there.

BR, Jarkko