From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: Re: [PATCH 08a/30] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE Date: Tue, 16 Jan 2018 16:31:51 +0000 Message-ID: <4582.1516120311@warthog.procyon.org.uk> References: <20180111120157.23qceywzi6omvvkb@dwarf.suse.cz> <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024869793.28329.4817577607302613028.stgit@warthog.procyon.org.uk> <20180111115915.dejachty3l7fwpmf@dwarf.suse.cz> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Return-path: In-Reply-To: <20180111120157.23qceywzi6omvvkb-Q+Z4OdfSLAKN3ZZ/Hiejyg@public.gmane.org> Content-ID: <4581.1516120311.1-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Jiri Bohac Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, gnomes-qBU/x9rampVanCEyBjwyrvXRex20P6io@public.gmane.org, linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, jforbes-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, Chun-Yi Lee List-Id: linux-efi@vger.kernel.org I think that your code isn't quite right. Looking at the patched code: #ifdef CONFIG_KEXEC_SIG sig_err = arch_kexec_kernel_verify_sig(image, image->kernel_buf, image->kernel_buf_len); if (sig_err) pr_debug("kernel signature verification failed.\n"); else pr_debug("kernel signature verification successful.\n"); #endif if (sig_err && IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) { ret = sig_err; goto out; } If the signature check fails because the signature is bad, but CONFIG_KEXEC_SIG_FORCE=n then it now won't fail when it should. If sig_err is -EKEYREJECTED, -EKEYEXPIRED or -EKEYREVOKED then it must fail, even if the signature check isn't forced. David From mboxrd@z Thu Jan 1 00:00:00 1970 From: dhowells@redhat.com (David Howells) Date: Tue, 16 Jan 2018 16:31:51 +0000 Subject: [PATCH 08a/30] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE In-Reply-To: <20180111120157.23qceywzi6omvvkb@dwarf.suse.cz> References: <20180111120157.23qceywzi6omvvkb@dwarf.suse.cz> <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024869793.28329.4817577607302613028.stgit@warthog.procyon.org.uk> <20180111115915.dejachty3l7fwpmf@dwarf.suse.cz> Message-ID: <4582.1516120311@warthog.procyon.org.uk> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org I think that your code isn't quite right. Looking at the patched code: #ifdef CONFIG_KEXEC_SIG sig_err = arch_kexec_kernel_verify_sig(image, image->kernel_buf, image->kernel_buf_len); if (sig_err) pr_debug("kernel signature verification failed.\n"); else pr_debug("kernel signature verification successful.\n"); #endif if (sig_err && IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) { ret = sig_err; goto out; } If the signature check fails because the signature is bad, but CONFIG_KEXEC_SIG_FORCE=n then it now won't fail when it should. If sig_err is -EKEYREJECTED, -EKEYEXPIRED or -EKEYREVOKED then it must fail, even if the signature check isn't forced. David -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751446AbeAPQcI (ORCPT + 1 other); Tue, 16 Jan 2018 11:32:08 -0500 Received: from mx1.redhat.com ([209.132.183.28]:49926 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751145AbeAPQcG (ORCPT ); Tue, 16 Jan 2018 11:32:06 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20180111120157.23qceywzi6omvvkb@dwarf.suse.cz> References: <20180111120157.23qceywzi6omvvkb@dwarf.suse.cz> <151024863544.28329.2436580122759221600.stgit@warthog.procyon.org.uk> <151024869793.28329.4817577607302613028.stgit@warthog.procyon.org.uk> <20180111115915.dejachty3l7fwpmf@dwarf.suse.cz> To: Jiri Bohac Cc: dhowells@redhat.com, linux-security-module@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, jforbes@redhat.com, Chun-Yi Lee Subject: Re: [PATCH 08a/30] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <4581.1516120311.1@warthog.procyon.org.uk> Date: Tue, 16 Jan 2018 16:31:51 +0000 Message-ID: <4582.1516120311@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Tue, 16 Jan 2018 16:32:06 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: I think that your code isn't quite right. Looking at the patched code: #ifdef CONFIG_KEXEC_SIG sig_err = arch_kexec_kernel_verify_sig(image, image->kernel_buf, image->kernel_buf_len); if (sig_err) pr_debug("kernel signature verification failed.\n"); else pr_debug("kernel signature verification successful.\n"); #endif if (sig_err && IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) { ret = sig_err; goto out; } If the signature check fails because the signature is bad, but CONFIG_KEXEC_SIG_FORCE=n then it now won't fail when it should. If sig_err is -EKEYREJECTED, -EKEYEXPIRED or -EKEYREVOKED then it must fail, even if the signature check isn't forced. David