From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: Re: [PATCH 26/30] Lock down ftrace Date: Fri, 10 Nov 2017 10:07:12 +0000 Message-ID: <27323.1510308432@warthog.procyon.org.uk> References: <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024883613.28329.14808632296386937974.stgit@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Return-path: In-Reply-To: Content-ID: <27322.1510308432.1-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Alexei Starovoitov , Jiri Kosina Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, gnomes-qBU/x9rampVanCEyBjwyrvXRex20P6io@public.gmane.org, linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, jforbes-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org List-Id: linux-efi@vger.kernel.org Jiri Kosina wrote: > > This prevents crypto data theft by analysis of execution patterns, and, if > > in future ftrace also logs the register contents at the time, will prevent > > data theft by that mechanism also. > > I fail to see how this fits into the secure boot security model, could you > please explain? The idea is to prevent cryptographic data for filesystems and other things from being read out of the kernel memory as well as to prevent unauthorised modification of kernel memory. > Secure boot is about having a constant proof / verification that the code > you're running in ring0 can be trusted (IOW is the one that has been > signed and verified by the whole boot chain). > > Checking execution patterns doesn't seem to fit at all. I'll defer this question to Alexei since he suggested I needed to deal with this too. David From mboxrd@z Thu Jan 1 00:00:00 1970 From: dhowells@redhat.com (David Howells) Date: Fri, 10 Nov 2017 10:07:12 +0000 Subject: [PATCH 26/30] Lock down ftrace In-Reply-To: References: <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024883613.28329.14808632296386937974.stgit@warthog.procyon.org.uk> Message-ID: <27323.1510308432@warthog.procyon.org.uk> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org Jiri Kosina wrote: > > This prevents crypto data theft by analysis of execution patterns, and, if > > in future ftrace also logs the register contents at the time, will prevent > > data theft by that mechanism also. > > I fail to see how this fits into the secure boot security model, could you > please explain? The idea is to prevent cryptographic data for filesystems and other things from being read out of the kernel memory as well as to prevent unauthorised modification of kernel memory. > Secure boot is about having a constant proof / verification that the code > you're running in ring0 can be trusted (IOW is the one that has been > signed and verified by the whole boot chain). > > Checking execution patterns doesn't seem to fit at all. I'll defer this question to Alexei since he suggested I needed to deal with this too. David -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752546AbdKJKHS (ORCPT ); Fri, 10 Nov 2017 05:07:18 -0500 Received: from mx1.redhat.com ([209.132.183.28]:43646 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752182AbdKJKHP (ORCPT ); Fri, 10 Nov 2017 05:07:15 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: References: <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024883613.28329.14808632296386937974.stgit@warthog.procyon.org.uk> To: Alexei Starovoitov , Jiri Kosina Cc: dhowells@redhat.com, linux-security-module@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, jforbes@redhat.com Subject: Re: [PATCH 26/30] Lock down ftrace MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <27322.1510308432.1@warthog.procyon.org.uk> Date: Fri, 10 Nov 2017 10:07:12 +0000 Message-ID: <27323.1510308432@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Fri, 10 Nov 2017 10:07:15 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Jiri Kosina wrote: > > This prevents crypto data theft by analysis of execution patterns, and, if > > in future ftrace also logs the register contents at the time, will prevent > > data theft by that mechanism also. > > I fail to see how this fits into the secure boot security model, could you > please explain? The idea is to prevent cryptographic data for filesystems and other things from being read out of the kernel memory as well as to prevent unauthorised modification of kernel memory. > Secure boot is about having a constant proof / verification that the code > you're running in ring0 can be trusted (IOW is the one that has been > signed and verified by the whole boot chain). > > Checking execution patterns doesn't seem to fit at all. I'll defer this question to Alexei since he suggested I needed to deal with this too. David