linux-kernel - [RFC 1/5] initramfs: Add initramfs signature checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241015222235.71040-2-jeremy.linton@arm.com>
Date: Tue, 15 Oct 2024 17:22:31 -0500
From: Jeremy Linton <jeremy.linton@....com>
To: linux-kernel@...r.kernel.org
Cc: akpm@...ux-foundation.org,
	hch@....de,
	gregkh@...uxfoundation.org,
	graf@...zon.com,
	lukas@...ner.de,
	wufan@...ux.microsoft.com,
	brauner@...nel.org,
	jsperbeck@...gle.com,
	ardb@...nel.org,
	linux-crypto@...r.kernel.org,
	linux-kbuild@...r.kernel.org,
	keyrings@...r.kernel.org,
	Jeremy Linton <jeremy.linton@....com>
Subject: [RFC 1/5] initramfs: Add initramfs signature checking

Various root-level processes, configurations, and the like can exist
in the initramfs provided by the boot loader. The kernel does a
reasonable job of signature checking and blocking unsigned code from
running in the kernel, but this is only one aspect of system
security. The remaining init and early startup code running in
userspace are just as critical to system security.

This option provides a basic initramfs signature check, which reuses
the module signature checking infrastructure to validate the boot
loader provided initramfs. Later, a system policy can allow or deny
images that fail the signature check.

Signed-off-by: Jeremy Linton <jeremy.linton@....com>
---
 usr/Kconfig | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/usr/Kconfig b/usr/Kconfig
index 9279a2893ab0..a9c0dc0112eb 100644
--- a/usr/Kconfig
+++ b/usr/Kconfig
@@ -32,6 +32,15 @@ config INITRAMFS_FORCE
 	  and is useful if you cannot or don't want to change the image
 	  your bootloader passes to the kernel.

+config INITRAMFS_SIG
+	bool "Validate signed initramfs images"
+	depends on SYSTEM_DATA_VERIFICATION
+	help
+	  This option validates that image provided by the
+	  bootloader is signed. The decision to accept or
+	  reject the image is then left to the kernel lockdown
+	  logic.
+
 config INITRAMFS_ROOT_UID
 	int "User ID to map to 0 (user root)"
 	depends on INITRAMFS_SOURCE!=""
-- 
2.46.0