Re: Linux Firmware Signing

From	"Luis R. Rodriguez" <mcgrof@suse.com>
Newsgroups	linux.kernel
Subject	Re: Linux Firmware Signing
Date	2015-08-29 04:10 +0200
Message-ID	<q2DKF-4Gv-7@gated-at.bofh.it> (permalink)
References	(5 earlier) <q24ae-3Zi-21@gated-at.bofh.it> <q2cUb-83v-19@gated-at.bofh.it> <q2ffk-2SO-5@gated-at.bofh.it> <q2q14-1OR-13@gated-at.bofh.it> <q2AjM-89a-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Aug 28, 2015 at 06:26:05PM -0400, Paul Moore wrote:
> On Fri, Aug 28, 2015 at 7:20 AM, Roberts, William C
> <william.c.roberts@intel.com> wrote:
> > Even triggered updates make sense, since you can at least have some form of trust
> > of where that binary policy came from.
> 
> It isn't always that simple, see my earlier comments about
> customization and manipulation by the policy loading tools.

If the customization of the data is done in kernel then the kernel
can *first* verify the file's signature prior to doing any data
modification. If userspace does the modification then the signature
stuff won't work unless the tool will have access to the MOK and can
sign it pre-flight to the kernel selinuxfs.

> > Huh, not following? Perhaps, I am not following what your laying down here.
> >
> >  Right now there is no signing on the selinux policy file. We should be able
> > to just use the firmware signing api's as is (I have not looked on linux-next yet)
> > to unpack the blob.
> 
> I haven't looked at the existing fw signing hook in any detail to be
> able to comment on its use as a policy verification hook.  As long as
> we preserve backwards compatibility and don't introduce a new
> mechanism/API for loading SELinux policy I doubt I would have any
> objections.

You'd just have to implement a permissive model as we are with the
fw signing. No radical customizations, except one thing to note is
that on the fw signing side of things we're going to have the signature
of the file *detached* in separate file. I think what you're alluding
to is the issue of where that signature would be stuff in the SELinux
policy file and its correct that you'd need to address that. You could
just borrow the kernel's model and reader / sucker that strips out the
signature. Another possibility would be two files but then I guess
you'd need a trigger to annotate both are in place.

  Luis
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 01:30 +0200
  Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-27 04:40 +0200
    Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 21:40 +0200
      Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-28 01:50 +0200
  Re: Linux Firmware Signing David Howells <dhowells@redhat.com> - 2015-08-27 12:40 +0200
    Re: Linux Firmware Signing "David Woodhouse" <dwmw2@infradead.org> - 2015-08-27 14:10 +0200
      Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 23:30 +0200
        Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-28 02:00 +0200
          RE: Linux Firmware Signing "Roberts, William C" <william.c.roberts@intel.com> - 2015-08-28 13:30 +0200
            Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-29 00:30 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:10 +0200
                Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-09-01 05:00 +0200
                Re: Linux Firmware Signing Joshua Brindle <brindle@quarksecurity.com> - 2015-09-01 16:20 +0200
                RE: Linux Firmware Signing "Roberts, William C" <william.c.roberts@intel.com> - 2015-09-01 22:10 +0200
                Re: Linux Firmware Signing Joshua Brindle <brindle@quarksecurity.com> - 2015-09-01 22:50 +0200
                Re: Linux Firmware Signing Eric Paris <eparis@redhat.com> - 2015-09-02 00:30 +0200
            Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:00 +0200
        Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-28 02:00 +0200
          Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:20 +0200
            Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-31 16:30 +0200
              Re: Linux Firmware Signing David Woodhouse <dwmw2@infradead.org> - 2015-08-31 18:10 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-31 18:50 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 02:10 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 01:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 05:10 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 05:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 17:30 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 18:50 +0200
                Re: Linux Firmware Signing Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-02 19:40 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 02:00 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-03 02:20 +0200
        Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-01 22:30 +0200
          Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 02:10 +0200
            Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 05:40 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 20:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 23:00 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 23:40 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-03 23:20 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 02:10 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-03 02:30 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 05:10 +0200
    Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 21:40 +0200

csiph-web