linux-kernel - Re: [RFC PATCH v3 00/13] Clavis LSM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3e400185af56a899a9d93e792ea314292fb2adb9.camel@HansenPartnership.com>
Date: Fri, 21 Mar 2025 12:55:25 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Eric Snowberg <eric.snowberg@...cle.com>
Cc: Paul Moore <paul@...l-moore.com>, Mimi Zohar <zohar@...ux.ibm.com>, 
 David Howells <dhowells@...hat.com>, Jarkko Sakkinen <jarkko@...nel.org>,
 "open list:SECURITY SUBSYSTEM" <linux-security-module@...r.kernel.org>,
 David Woodhouse <dwmw2@...radead.org>,  "herbert@...dor.apana.org.au"
 <herbert@...dor.apana.org.au>, "davem@...emloft.net" <davem@...emloft.net>,
  Ard Biesheuvel <ardb@...nel.org>, James Morris <jmorris@...ei.org>, "Serge
 E. Hallyn" <serge@...lyn.com>, Roberto Sassu <roberto.sassu@...wei.com>,
 Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
 Mickaël Salaün <mic@...ikod.net>,
 "casey@...aufler-ca.com" <casey@...aufler-ca.com>, Stefan Berger
 <stefanb@...ux.ibm.com>, "ebiggers@...nel.org" <ebiggers@...nel.org>, Randy
 Dunlap <rdunlap@...radead.org>, open list <linux-kernel@...r.kernel.org>, 
 "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
 "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
 "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
 "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>
Subject: Re: [RFC PATCH v3 00/13] Clavis LSM

On Fri, 2025-03-21 at 16:40 +0000, Eric Snowberg wrote:
> > On Mar 20, 2025, at 4:40 PM, James Bottomley
> > <James.Bottomley@...senPartnership.com> wrote:
> > 
> > On Thu, 2025-03-20 at 16:24 +0000, Eric Snowberg wrote:
> > > Having lockdown enforcement has always been 
> > > a requirement to get a shim signed by Microsoft.
> > 
> > This is factually incorrect.  Microsoft transferred shim signing to
> > an independent process run by a group of open source maintainers a
> > while ago:
> 
> Yes, the shim-review process is understood.  I'm not sure how my
> sentence  is factually incorrect though.

You said people "get shim signed by Microsoft".  They don't, they get
it signed by the key held by the shim-review maintainers.

>  Unless you are saying Microsoft no longer  maintains the private
> key.

Well technically the private key is owned by UEFI (and referred to as
the UEFI CA) but there are multiple HSM based copies floating around
under the control of various operating system groups.  The Windows OS
group holds one and the shim-review group holds another ... there are
probably other copies I don't know about, though.

The point about this is that UEFI co-ordinates various discussions
between the private key holders about how to preserve security in the
UEFI boot environment (mostly at the UEFI Security Sub Team level) it's
no longer something Microsoft uniquely decides.

>   Hopefully that is not the case, since the public  key ships on just
> about every single PC built.

I don't understand why Microsoft no-longer owning the private key is a
problem?  Only the public key ships on PCs and that hasn't changed (at
least not yet, it might have to for NIST requirements since RSA2048 is
being deprecated).

Regards,

James