Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1166345

Re: kexec_load(2) bypasses signature verification

Show key headers only | View raw

Adding Vivek as he is the one who implemented kexec_file_load.
I was hoping he would respond to this thread, and it looks like he
simply has not ever been Cc'd.

Theodore Ts'o <tytso@mit.edu> writes:

> On Mon, Jun 15, 2015 at 09:37:05AM -0400, Josh Boyer wrote:
>> The bits that actually read Secure Boot state out of the UEFI
>> variables, and apply protections to the machine to avoid compromise
>> under the SB threat model.  Things like disabling the old kexec...
>
> I don't have any real interest in using Secure Boot, but I *am*
> interested in using CONFIG_KEXEC_VERIFY_SIG[1].  So perhaps we need to
> have something similar to what we have with signed modules in terms of
> CONFIG_MODULE_SIG_FORCE and module/sig_enforce, but for
> KEXEC_VERIFY_SIG.  This would mean creating a separate flag
> independent of the one Linus suggested for Secure Boot, but since we
> have one for signed modules, we do have precedent for this sort of
> thing.

My overall request with respect to kexec has been that we implement
things that make sense outside of the bizarre threat model of the Linux
folks who were talking about secure boot.

nI have not navigated the labyrinth of config options but having a way to
only boot signed things with kexec seems a completely sensible way to
operate in the context of signed images.

I don't know how much that will help given that actors with sufficient
resources have demonstrated the ability to steal private keys, but
assuming binary signing is an effective technique (or why else do it)
then having an option to limit kexec to only loading signed images seems
sensible.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

kexec_load(2) bypasses signature verification Theodore Ts'o <tytso@mit.edu> - 2015-06-15 06:00 +0200
  Re: kexec_load(2) bypasses signature verification Theodore Ts'o <tytso@mit.edu> - 2015-06-15 22:10 +0200
    Re: kexec_load(2) bypasses signature verification ebiederm@xmission.com (Eric W. Biederman) - 2015-06-16 21:50 +0200
      Re: kexec_load(2) bypasses signature verification Vivek Goyal <vgoyal@redhat.com> - 2015-06-16 22:30 +0200
        Re: kexec_load(2) bypasses signature verification Dave Young <dyoung@redhat.com> - 2015-06-18 03:20 +0200
          Re: kexec_load(2) bypasses signature verification Dave Young <dyoung@redhat.com> - 2015-06-18 04:10 +0200
            Re: kexec_load(2) bypasses signature verification Dave Young <dyoung@redhat.com> - 2015-06-19 08:30 +0200
              Re: kexec_load(2) bypasses signature verification Dave Young <dyoung@redhat.com> - 2015-06-19 10:20 +0200
                Re: kexec_load(2) bypasses signature verification Vivek Goyal <vgoyal@redhat.com> - 2015-06-19 15:10 +0200
        Re: kexec_load(2) bypasses signature verification Dave Young <dyoung@redhat.com> - 2015-06-19 09:10 +0200
          Re: kexec_load(2) bypasses signature verification Vivek Goyal <vgoyal@redhat.com> - 2015-06-19 15:10 +0200
    Re: kexec_load(2) bypasses signature verification Dave Young <dyoung@redhat.com> - 2015-06-18 03:30 +0200

csiph-web