RE: Linux Firmware Signing

From	"Roberts, William C" <william.c.roberts@intel.com>
Newsgroups	linux.kernel
Subject	RE: Linux Firmware Signing
Date	2015-09-01 22:10 +0200
Message-ID	<q402u-8on-5@gated-at.bofh.it> (permalink)
References	(8 earlier) <q2q14-1OR-13@gated-at.bofh.it> <q2AjM-89a-11@gated-at.bofh.it> <q2DKF-4Gv-7@gated-at.bofh.it> <q3JXJ-21j-7@gated-at.bofh.it> <q3UzM-w6-19@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw


> -----Original Message-----
> From: owner-linux-security-module@vger.kernel.org [mailto:owner-linux-
> security-module@vger.kernel.org] On Behalf Of Joshua Brindle
> Sent: Tuesday, September 1, 2015 7:13 AM
> To: Paul Moore
> Cc: Luis R. Rodriguez; Takashi Iwai; Ming Lei; David Howells; Peter Jones;
> selinux@tycho.nsa.gov; Schaufler, Casey; Stephen Smalley; Matthew Garrett;
> Kees Cook; Vojtech Pavlík; Seth Forshee; james.l.morris@oracle.com; Dmitry
> Kasatkin; Johannes Berg; Joey Lee; Kyle McMartin; linux-
> wireless@vger.kernel.org; linux-kernel@vger.kernel.org; Andy Lutomirski; linux-
> security-module@vger.kernel.org; Greg Kroah-Hartman; Vitaly Kuznetsov; David
> Woodhouse
> Subject: Re: Linux Firmware Signing
> 
> Paul Moore wrote:
> <snip>
> >
> > Yes, there are lots of way we could solve the signed policy format
> > issue, I just don't have one in mind at this moment.  Also, to be
> > honest, there are enough limitations to signing SELinux policies that
> > this isn't very high onmy personal SELinux priority list.

Yes I would say this is low on my end. Especially if we can kill off
Reloadable policy support on Android, my need for this goes away 100%.

> >
> 
> The fact that there are so many userspace specific parts of the policy that never
> make it into the kernel precludes any meaningful verification anyway.

Yes and no. On Android, if I was able to load a policy I could grant myself capabilities that
We're not possible via the userspace portions, i.e. relabeling, etc. Granted, not checking the
userspace portions Is not great. In an ideal world, everything is checked. However, the main
reason to doing it in the kernel is where you want your trust to be. For instance, If I trust that
userspace Loader, then I need to trust that + the kernel. In the case of verifying the policy signature
In the kernel, I need to trust only the kernel.

As far as the desktop environment, I claim ignorance and have no input there.

> 
> And SELinux already has a mechanism for raising the integrity of a process to do
> things like signature checking in userspace, the domain transition. If someone
> wants validation of the SELinux policy they just need to eliminate every domains
> ability to load policy except for a trusted policy loader that does signature
> checking.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org More majordomo info at
> http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 01:30 +0200
  Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-27 04:40 +0200
    Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 21:40 +0200
      Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-28 01:50 +0200
  Re: Linux Firmware Signing David Howells <dhowells@redhat.com> - 2015-08-27 12:40 +0200
    Re: Linux Firmware Signing "David Woodhouse" <dwmw2@infradead.org> - 2015-08-27 14:10 +0200
      Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 23:30 +0200
        Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-28 02:00 +0200
          RE: Linux Firmware Signing "Roberts, William C" <william.c.roberts@intel.com> - 2015-08-28 13:30 +0200
            Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-29 00:30 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:10 +0200
                Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-09-01 05:00 +0200
                Re: Linux Firmware Signing Joshua Brindle <brindle@quarksecurity.com> - 2015-09-01 16:20 +0200
                RE: Linux Firmware Signing "Roberts, William C" <william.c.roberts@intel.com> - 2015-09-01 22:10 +0200
                Re: Linux Firmware Signing Joshua Brindle <brindle@quarksecurity.com> - 2015-09-01 22:50 +0200
                Re: Linux Firmware Signing Eric Paris <eparis@redhat.com> - 2015-09-02 00:30 +0200
            Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:00 +0200
        Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-28 02:00 +0200
          Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:20 +0200
            Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-31 16:30 +0200
              Re: Linux Firmware Signing David Woodhouse <dwmw2@infradead.org> - 2015-08-31 18:10 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-31 18:50 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 02:10 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 01:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 05:10 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 05:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 17:30 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 18:50 +0200
                Re: Linux Firmware Signing Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-02 19:40 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 02:00 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-03 02:20 +0200
        Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-01 22:30 +0200
          Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 02:10 +0200
            Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 05:40 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 20:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 23:00 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 23:40 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-03 23:20 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 02:10 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-03 02:30 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 05:10 +0200
    Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 21:40 +0200

csiph-web