Re: [PATCH v5 00/21] EVM

David Safford
2011-05-27T17:46:19Z

On Thu, 2011-05-26 at 22:17 +0200, Pavel Machek wrote:

> I suggest you explain the patchset in the emails, then? Everyone here
> seems to be confused... Attack it protects against, and what kind of
> hardware is needed for the protection to be effective?

The white paper is over 15 pages, and it barely scratches the surface.
Every customer has different security threat models and requirements.
Discussing this in general on the mailing list is really hard.

So let's try to simplify this just down to digital signatures in
the cellphone environment, as you state:

> Because AFAICT, file signatures, as proposed, are only useful for
> locking down my cellphone against myself. (That's -- evil).

The proposed digital signatures can enforce authenticity of a file's
data (IMA-Appraisal with Digital Signature), and of a file's metadata
(EVM with Digital Signature). For most users, enforcing authenticity
of files is a good thing - a user knows that they are running authentic
software signed by their phone manufacturer, and not malicious files
that they, or someone else installed. In this threat model, EVM is
mainly authenticating the meta-data of a file (owner, mode, LSM label...).
IMA-Appraisal and EVM are policy driven, so that the owner is free to
tailor them or turn them off. There are clearly many other use cases for
digitally signed data and metadata - authenticity is an important
kernel feature, one which should be done once, done correctly, and
upstreamed.

You argue that EVM can be abused to lock down your phone against
rooting, but

1. EVM has no control over rooting through the loader, or rooting
through vulnerabilities in the kernel, or rooting through
vulnerabilities in signed applications, or rooting through
the adb shell, or rooting in any way I have seen.

2. The real issue with phones is manufacturers who try to prevent you
from running the kernel and software of your choice. Locked
bootloaders are not a technical problem - they are a market
problem that can only be addressed with market or regulatory
forces. In some countries, manufacturers are simply not allowed
to do such locking.

Blocking signature verification would serve only to punish Linux
users who care about the authenticity of their files, while doing
_nothing_ to stop manufacturers from locking their bootloaders.

dave
>
> Pavel