From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755736AbdKBWKw (ORCPT ); Thu, 2 Nov 2017 18:10:52 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:55090 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755528AbdKBWKu (ORCPT ); Thu, 2 Nov 2017 18:10:50 -0400 Subject: Re: Firmware signing -- Re: [PATCH 00/27] security, efi: Add kernel lockdown From: Mimi Zohar To: David Howells , mcgrof@kernel.org Cc: linux-security-module@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, linux-efi , gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, Matthew Garrett Date: Thu, 02 Nov 2017 18:10:41 -0400 In-Reply-To: <14219.1509660259@warthog.procyon.org.uk> References: <1509660086.3416.15.camel@linux.vnet.ibm.com> <150842463163.7923.11081723749106843698.stgit@warthog.procyon.org.uk> <14219.1509660259@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 17110222-0016-0000-0000-000004FCED5C X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17110222-0017-0000-0000-000028387F94 Message-Id: <1509660641.3416.24.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-11-02_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1711020270 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2017-11-02 at 22:04 +0000, David Howells wrote: > Mimi Zohar wrote: > > > > Only validly signed device firmware may be loaded. > > > > fw_get_filesystem_firmware() calls kernel_read_file_from_path() to > > read the firmware, which calls into the security hooks. Is there > > another place that validates the firmware signatures.  I'm not seeing > > which patch requires firmware to be signed? > > Luis has a set of patches for this. However, I'm not sure if that's going > anywhere at the moment. Possibly I should remove this from the manpage for > the moment. Or reflect that IMA-appraisal, if enabled, will enforce firmware being validly signed. Mimi