Re: Linux Firmware Signing

From	Kees Cook <keescook@chromium.org>
Newsgroups	linux.kernel
Subject	Re: Linux Firmware Signing
Date	2015-09-02 17:30 +0200
Message-ID	<q4i96-yB-57@gated-at.bofh.it> (permalink)
References	(8 earlier) <q2DUl-4XT-1@gated-at.bofh.it> <q3yfV-1QK-41@gated-at.bofh.it> <q43to-4H0-13@gated-at.bofh.it> <q46AV-Yh-3@gated-at.bofh.it> <q47dD-1GL-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Sep 1, 2015 at 8:44 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> On Tue, 2015-09-01 at 20:08 -0700, Kees Cook wrote:
>> On Tue, Sep 1, 2015 at 4:43 PM, Luis R. Rodriguez <mcgrof@suse.com> wrote:
>> > On Mon, Aug 31, 2015 at 10:18:55AM -0400, Mimi Zohar wrote:
>> >> > > eBPF/seccomp
>> >
>> > OK I knew nothing about this but I just looked into it, here are my notes:
>> >
>> >   * old BPF - how far do we want to go? This goes so far as to parsing
>> >     user passed void __user *arg data through ioctls which typically
>> >     gets copy_from_user()'d and eventually gets BPF_PROG_RUN().
>> >
>> >   * eBPF:
>> >                              seccomp() & prctl_set_seccomp()
>> >                                         |
>> >                                         V
>> >                              do_seccomp()
>> >                                         |
>> >                                         V
>> >                              seccomp_set_mode_filter()
>> >                                         |
>> >                                         V
>> >                              seccomp_prepare_user_filter()
>> >                                         |
>> >                                         V
>> >         bpf_prog_create_from_user() (seccomp) \
>> >         bpf_prog_create()                      > bpf_prepare_filter()
>> >         sk_attach_filter()                    /
>> >
>> >     All approaches come from user passed data, nothing fd based.
>> >
>> >     For both old BPF and eBPF then:
>> >
>> >     If we wanted to be paranoid I suppose the Machine Owner Key (MOK)
>> >     Paul had mentioned up could be used to vet for passed filters, or
>> >     a new interface to enable fd based filters. This really would limit
>> >     the dynamic nature of these features though.
>> >
>> >     eBPF / secccomp would not be the only place in the kernel that would have
>> >     issues with user passed data, we have tons of places the same applies so
>> >     implicating the old BPF / eBPF / seccomp approaches can easily implicate
>> >     many other areas of the kernel, that's pretty huge but from the looks of
>> >     it below you seem to enable that to be a possibility for us to consider.
>>
>> At the time (LSS 2014?) I argued that seccomp policies come from
>> binaries, which are already being measured. And that policies only
>> further restrict a process, so there seems to be to be little risk in
>> continuing to leave them unmeasured.
>
> What do you mean by "measured"?  Who is doing the measurement?  Could
> someone detect a change in measurement?

I meant from the perspective of IMA. The binary would have already
been evaluated when it executed, and it's what's installing the
seccomp filter. And since seccomp filters can only reduce privilege,
it seems like they're not worth getting processed by IMA. But I might
not understand the requirements! :)

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 01:30 +0200
  Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-27 04:40 +0200
    Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 21:40 +0200
      Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-28 01:50 +0200
  Re: Linux Firmware Signing David Howells <dhowells@redhat.com> - 2015-08-27 12:40 +0200
    Re: Linux Firmware Signing "David Woodhouse" <dwmw2@infradead.org> - 2015-08-27 14:10 +0200
      Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 23:30 +0200
        Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-28 02:00 +0200
          RE: Linux Firmware Signing "Roberts, William C" <william.c.roberts@intel.com> - 2015-08-28 13:30 +0200
            Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-08-29 00:30 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:10 +0200
                Re: Linux Firmware Signing Paul Moore <paul@paul-moore.com> - 2015-09-01 05:00 +0200
                Re: Linux Firmware Signing Joshua Brindle <brindle@quarksecurity.com> - 2015-09-01 16:20 +0200
                RE: Linux Firmware Signing "Roberts, William C" <william.c.roberts@intel.com> - 2015-09-01 22:10 +0200
                Re: Linux Firmware Signing Joshua Brindle <brindle@quarksecurity.com> - 2015-09-01 22:50 +0200
                Re: Linux Firmware Signing Eric Paris <eparis@redhat.com> - 2015-09-02 00:30 +0200
            Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:00 +0200
        Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-28 02:00 +0200
          Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-29 04:20 +0200
            Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-31 16:30 +0200
              Re: Linux Firmware Signing David Woodhouse <dwmw2@infradead.org> - 2015-08-31 18:10 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-31 18:50 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 02:10 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 01:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 05:10 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 05:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 17:30 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 18:50 +0200
                Re: Linux Firmware Signing Austin S Hemmelgarn <ahferroin7@gmail.com> - 2015-09-02 19:40 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 02:00 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-03 02:20 +0200
        Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-01 22:30 +0200
          Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 02:10 +0200
            Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-02 05:40 +0200
              Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 20:50 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-02 23:00 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-02 23:40 +0200
                Re: Linux Firmware Signing Kees Cook <keescook@chromium.org> - 2015-09-03 23:20 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 02:10 +0200
                Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-09-03 02:30 +0200
                Re: Linux Firmware Signing Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-09-03 05:10 +0200
    Re: Linux Firmware Signing "Luis R. Rodriguez" <mcgrof@suse.com> - 2015-08-27 21:40 +0200

csiph-web