Re: Linux Firmware Signing

[Joshua Brindle <brindle@quarksecurity.com>]

Roberts, William C wrote:
>> From: owner-linux-security-module@vger.kernel.org [mailto:owner-linux-
>> security-module@vger.kernel.org] On Behalf Of Joshua Brindle
>> Sent: Tuesday, September 1, 2015 7:13 AM
>> To: Paul Moore
>> Cc: Luis R. Rodriguez; Takashi Iwai; Ming Lei; David Howells; Peter Jones;
>> selinux@tycho.nsa.gov; Schaufler, Casey; Stephen Smalley; Matthew Garrett;
>> Kees Cook; Vojtech Pavlík; Seth Forshee; james.l.morris@oracle.com; Dmitry
>> Kasatkin; Johannes Berg; Joey Lee; Kyle McMartin; linux-
>> wireless@vger.kernel.org; linux-kernel@vger.kernel.org; Andy Lutomirski; linux-
>> security-module@vger.kernel.org; Greg Kroah-Hartman; Vitaly Kuznetsov; David
>> Woodhouse
>> Subject: Re: Linux Firmware Signing
>>
>> Paul Moore wrote:
>> <snip>
>>> Yes, there are lots of way we could solve the signed policy format
>>> issue, I just don't have one in mind at this moment.  Also, to be
>>> honest, there are enough limitations to signing SELinux policies that
>>> this isn't very high onmy personal SELinux priority list.
>
> Yes I would say this is low on my end. Especially if we can kill off
> Reloadable policy support on Android, my need for this goes away 100%.
>

I'm not sure who "we" is as you are the only person I've heard 
advocating for removing that support.

>> The fact that there are so many userspace specific parts of the policy that never
>> make it into the kernel precludes any meaningful verification anyway.
>
> Yes and no. On Android, if I was able to load a policy I could grant myself capabilities that
> We're not possible via the userspace portions, i.e. relabeling, etc. Granted, not checking the
> userspace portions Is not great. In an ideal world, everything is checked. However, the main
> reason to doing it in the kernel is where you want your trust to be. For instance, If I trust that
> userspace Loader, then I need to trust that + the kernel. In the case of verifying the policy signature
> In the kernel, I need to trust only the kernel.

Especially on Android, userspace files are very important. Changing 
seapp_contexts or property_contexts can easily get you a privilege 
escalation to let you do whatever. Checking only the kernel binary is a 
half-solution and should not even be considered.

>
> As far as the desktop environment, I claim ignorance and have no input there.
>
>> And SELinux already has a mechanism for raising the integrity of a process to do
>> things like signature checking in userspace, the domain transition. If someone
>> wants validation of the SELinux policy they just need to eliminate every domains
>> ability to load policy except for a trusted policy loader that does signature
>> checking.
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
>> the body of a message to majordomo@vger.kernel.org More majordomo info at
>> http://vger.kernel.org/majordomo-info.html