From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf1-f196.google.com ([209.85.210.196]:33628 "EHLO mail-pf1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726078AbeHEFZS (ORCPT ); Sun, 5 Aug 2018 01:25:18 -0400 From: "Lee, Chun-Yi" To: linux-kernel@vger.kernel.org Cc: linux-efi@vger.kernel.org, x86@kernel.org, keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, "Lee, Chun-Yi" , Kees Cook , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , "Rafael J. Wysocki" , Pavel Machek , Chen Yu , Oliver Neukum , Ryan Chen , Ard Biesheuvel , David Howells , Mimi Zohar Subject: [PATCH 0/6][RFC] Add EFI secure key to key retention service Date: Sun, 5 Aug 2018 11:21:13 +0800 Message-Id: <20180805032119.20485-1-jlee@suse.com> Sender: linux-integrity-owner@vger.kernel.org List-ID: When secure boot is enabled, only signed EFI binary can access EFI boot service variable before ExitBootService. Which means that the EFI boot service variable is secure. This patch set add functions to EFI boot stub to generate a 512-bit random number that it can be used as a root key for encryption and authentication. This root key will be kept in EFI boot service variable. EFI boot stub will read and transfer ERK (efi root key) to kernel. At runtime, the ERK can be used to encrypted/authentication other random number to generate EFI secure key. The EFI secure key can be a new master key type for encrypted key. It's useful for hibernation or evm. Here is the proof of concept for using EFI secure key in hibernation: https://github.com/joeyli/linux-s4sign/commit/6311e97038974bc5de8121769fb4d34470009566 Cc: Kees Cook Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: "Rafael J. Wysocki" Cc: Pavel Machek Cc: Chen Yu Cc: Oliver Neukum Cc: Ryan Chen Cc: Ard Biesheuvel Cc: David Howells Cc: Mimi Zohar Signed-off-by: "Lee, Chun-Yi" Lee, Chun-Yi (6): x86/KASLR: make getting random long number function public efi: the function transfers status to string efi: generate efi root key in EFI boot stub key: add EFI secure key type key: add EFI secure key as a master key type key: enforce the secure boot checking when loading efi root key Documentation/admin-guide/kernel-parameters.txt | 6 + arch/x86/boot/compressed/Makefile | 1 + arch/x86/boot/compressed/cpuflags.c | 2 +- arch/x86/boot/compressed/eboot.c | 2 + arch/x86/boot/compressed/efi_root_key.c | 212 +++++++ arch/x86/boot/compressed/kaslr.c | 21 - arch/x86/boot/compressed/misc.c | 17 + arch/x86/boot/compressed/misc.h | 12 +- arch/x86/include/asm/efi.h | 13 + arch/x86/include/uapi/asm/bootparam.h | 1 + arch/x86/kernel/setup.c | 3 + arch/x86/lib/kaslr.c | 61 +- arch/x86/lib/random.c | 68 +++ drivers/firmware/efi/Kconfig | 31 + drivers/firmware/efi/Makefile | 1 + drivers/firmware/efi/efi-secure-key.c | 748 ++++++++++++++++++++++++ include/keys/efi-type.h | 57 ++ include/linux/efi.h | 40 ++ include/linux/kernel.h | 3 +- kernel/panic.c | 1 + security/keys/encrypted-keys/encrypted.c | 10 + 21 files changed, 1226 insertions(+), 84 deletions(-) create mode 100644 arch/x86/boot/compressed/efi_root_key.c create mode 100644 arch/x86/lib/random.c create mode 100644 drivers/firmware/efi/efi-secure-key.c create mode 100644 include/keys/efi-type.h -- 2.13.6