From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: Re: [PATCH 08/30] kexec_file: Restrict at runtime if the kernel is locked down Date: Wed, 17 Jan 2018 16:16:56 +0000 Message-ID: <24245.1516205816@warthog.procyon.org.uk> References: <20180111154445.duootisvanetnr24@dwarf.suse.cz> <12880.1515674600@warthog.procyon.org.uk> <20180111115915.dejachty3l7fwpmf@dwarf.suse.cz> <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024869793.28329.4817577607302613028.stgit@warthog.procyon.org.uk> <13005.1515674877@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT Return-path: In-Reply-To: <20180111154445.duootisvanetnr24-Q+Z4OdfSLAKN3ZZ/Hiejyg@public.gmane.org> Content-ID: <24244.1516205816.1-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Jiri Bohac Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, gnomes-qBU/x9rampVanCEyBjwyrvXRex20P6io@public.gmane.org, linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, jforbes-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, Chun-Yi Lee List-Id: linux-efi@vger.kernel.org Jiri Bohac wrote: > > Having said that, I do see your point, I think. We should still let through > > validly signed images, even if signatures aren't mandatory in lockdown mode. > > yes, to be clear, the problem I'm trying to fix is: > - without CONFIG_KEXEC_VERIFY_SIG kexec in a locked down kernel > will not work at all -> every distro that wants to support > secureboot will need to enable CONFIG_KEXEC_VERIFY_SIG; > > - once CONFIG_KEXEC_VERIFY_SIG is enabled, kexec images need to > be signed even if secureboot is not used > > The problem is that CONFIG_KEXEC_VERIFY_SIG enables both the > implementation and the enforcement of the signature checking. Yep. I understand that. > What I'm proposing are new config options that allow a kernel to > be compiled in such a way that: > - kexec works even without signatures if secureboot is off > - kexec works with secureboot but requires signed images Agreed to both of those. I also agree with making it possible to configurationally require signatures, which your first patch does. > The semantics should be the same as with signed modules, because > requiring kexec signatures when you can load unsigned modules is > futile. But with your original patchset, that's exactly what > distro kernels will be doing when booted with secureboot off, > MODULE_SIG_FORCE=n and KEXEC_VERIFY_SIG=y. I should fix that. David From mboxrd@z Thu Jan 1 00:00:00 1970 From: dhowells@redhat.com (David Howells) Date: Wed, 17 Jan 2018 16:16:56 +0000 Subject: [PATCH 08/30] kexec_file: Restrict at runtime if the kernel is locked down In-Reply-To: <20180111154445.duootisvanetnr24@dwarf.suse.cz> References: <20180111154445.duootisvanetnr24@dwarf.suse.cz> <12880.1515674600@warthog.procyon.org.uk> <20180111115915.dejachty3l7fwpmf@dwarf.suse.cz> <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024869793.28329.4817577607302613028.stgit@warthog.procyon.org.uk> <13005.1515674877@warthog.procyon.org.uk> Message-ID: <24245.1516205816@warthog.procyon.org.uk> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org Jiri Bohac wrote: > > Having said that, I do see your point, I think. We should still let through > > validly signed images, even if signatures aren't mandatory in lockdown mode. > > yes, to be clear, the problem I'm trying to fix is: > - without CONFIG_KEXEC_VERIFY_SIG kexec in a locked down kernel > will not work at all -> every distro that wants to support > secureboot will need to enable CONFIG_KEXEC_VERIFY_SIG; > > - once CONFIG_KEXEC_VERIFY_SIG is enabled, kexec images need to > be signed even if secureboot is not used > > The problem is that CONFIG_KEXEC_VERIFY_SIG enables both the > implementation and the enforcement of the signature checking. Yep. I understand that. > What I'm proposing are new config options that allow a kernel to > be compiled in such a way that: > - kexec works even without signatures if secureboot is off > - kexec works with secureboot but requires signed images Agreed to both of those. I also agree with making it possible to configurationally require signatures, which your first patch does. > The semantics should be the same as with signed modules, because > requiring kexec signatures when you can load unsigned modules is > futile. But with your original patchset, that's exactly what > distro kernels will be doing when booted with secureboot off, > MODULE_SIG_FORCE=n and KEXEC_VERIFY_SIG=y. I should fix that. David -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754302AbeAQQRk convert rfc822-to-8bit (ORCPT ); Wed, 17 Jan 2018 11:17:40 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35001 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754211AbeAQQRW (ORCPT ); Wed, 17 Jan 2018 11:17:22 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20180111154445.duootisvanetnr24@dwarf.suse.cz> References: <20180111154445.duootisvanetnr24@dwarf.suse.cz> <12880.1515674600@warthog.procyon.org.uk> <20180111115915.dejachty3l7fwpmf@dwarf.suse.cz> <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024869793.28329.4817577607302613028.stgit@warthog.procyon.org.uk> <13005.1515674877@warthog.procyon.org.uk> To: Jiri Bohac Cc: dhowells@redhat.com, linux-security-module@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, jforbes@redhat.com, Chun-Yi Lee Subject: Re: [PATCH 08/30] kexec_file: Restrict at runtime if the kernel is locked down MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <24244.1516205816.1@warthog.procyon.org.uk> Content-Transfer-Encoding: 8BIT Date: Wed, 17 Jan 2018 16:16:56 +0000 Message-ID: <24245.1516205816@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Jiri Bohac wrote: > > Having said that, I do see your point, I think. We should still let through > > validly signed images, even if signatures aren't mandatory in lockdown mode. > > yes, to be clear, the problem I'm trying to fix is: > - without CONFIG_KEXEC_VERIFY_SIG kexec in a locked down kernel > will not work at all -> every distro that wants to support > secureboot will need to enable CONFIG_KEXEC_VERIFY_SIG; > > - once CONFIG_KEXEC_VERIFY_SIG is enabled, kexec images need to > be signed even if secureboot is not used > > The problem is that CONFIG_KEXEC_VERIFY_SIG enables both the > implementation and the enforcement of the signature checking. Yep. I understand that. > What I'm proposing are new config options that allow a kernel to > be compiled in such a way that: > - kexec works even without signatures if secureboot is off > - kexec works with secureboot but requires signed images Agreed to both of those. I also agree with making it possible to configurationally require signatures, which your first patch does. > The semantics should be the same as with signed modules, because > requiring kexec signatures when you can load unsigned modules is > futile. But with your original patchset, that's exactly what > distro kernels will be doing when booted with secureboot off, > MODULE_SIG_FORCE=n and KEXEC_VERIFY_SIG=y. I should fix that. David