Currently root can dynamically update the blacklist keyring if the hash
being added is signed and vouched for by the builtin trusted keyring.
Currently keys in the secondary trusted keyring can not be used.
Keys within the secondary trusted keyring carry the same capabilities as
the builtin trusted keyring. Relax the current restriction for updating
the .blacklist keyring and allow the secondary to also be referenced as
a trust source. Since the machine keyring is linked to the secondary
trusted keyring, any key within it may also be used.
An example use case for this is IMA appraisal. Now that IMA both
references the blacklist keyring and allows the machine owner to add
custom IMA CA certs via the machine keyring, this adds the additional
capability for the machine owner to also do revocations on a running
system.
IMA appraisal usage example to add a revocation for /usr/foo:
sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
-signer machine-certificate.pem -noattr -binary -outform DER \
-out hash.p7s
keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
Signed-off-by: Eric Snowberg <[email protected]>
---
certs/Kconfig | 2 +-
certs/blacklist.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/certs/Kconfig b/certs/Kconfig
index 1f109b070877..23dc87c52aff 100644
--- a/certs/Kconfig
+++ b/certs/Kconfig
@@ -134,7 +134,7 @@ config SYSTEM_BLACKLIST_AUTH_UPDATE
depends on SYSTEM_DATA_VERIFICATION
help
If set, provide the ability to load new blacklist keys at run time if
- they are signed and vouched by a certificate from the builtin trusted
+ they are signed and vouched by a certificate from the secondary trusted
keyring. The PKCS#7 signature of the description is set in the key
payload. Blacklist keys cannot be removed.
diff --git a/certs/blacklist.c b/certs/blacklist.c
index 675dd7a8f07a..0b346048ae2d 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -102,12 +102,12 @@ static int blacklist_key_instantiate(struct key *key,
#ifdef CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE
/*
- * Verifies the description's PKCS#7 signature against the builtin
+ * Verifies the description's PKCS#7 signature against the secondary
* trusted keyring.
*/
err = verify_pkcs7_signature(key->description,
strlen(key->description), prep->data, prep->datalen,
- NULL, VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL);
+ VERIFY_USE_SECONDARY_KEYRING, VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL);
if (err)
return err;
#else
--
2.39.3
On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
>
> > On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
> >
> > On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
> >>
> >>> On Sep 11, 2023, at 10:51 AM, Micka?l Sala?n <[email protected]> wrote:
> >>>
> >>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
> >>>> Hi Eric,
> >>>>
> >>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
> >>>>> Currently root can dynamically update the blacklist keyring if the hash
> >>>>> being added is signed and vouched for by the builtin trusted keyring.
> >>>>> Currently keys in the secondary trusted keyring can not be used.
> >>>>>
> >>>>> Keys within the secondary trusted keyring carry the same capabilities as
> >>>>> the builtin trusted keyring. Relax the current restriction for updating
> >>>>> the .blacklist keyring and allow the secondary to also be referenced as
> >>>>> a trust source. Since the machine keyring is linked to the secondary
> >>>>> trusted keyring, any key within it may also be used.
> >>>>>
> >>>>> An example use case for this is IMA appraisal. Now that IMA both
> >>>>> references the blacklist keyring and allows the machine owner to add
> >>>>> custom IMA CA certs via the machine keyring, this adds the additional
> >>>>> capability for the machine owner to also do revocations on a running
> >>>>> system.
> >>>>>
> >>>>> IMA appraisal usage example to add a revocation for /usr/foo:
> >>>>>
> >>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
> >>>>>
> >>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
> >>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
> >>>>> -out hash.p7s
> >>>>>
> >>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
> >>>>>
> >>>>> Signed-off-by: Eric Snowberg <[email protected]>
> >>>>
> >>>> The secondary keyring may include both CA and code signing keys. With
> >>>> this change any key loaded onto the secondary keyring may blacklist a
> >>>> hash. Wouldn't it make more sense to limit blacklisting
> >>>> certificates/hashes to at least CA keys?
> >>>
> >>> Some operational constraints may limit what a CA can sign.
> >>
> >> Agreed.
> >>
> >> Is there precedents for requiring this S/MIME to be signed by a CA?
> >>
> >>> This change is critical and should be tied to a dedicated kernel config
> >>> (disabled by default), otherwise existing systems using this feature
> >>> will have their threat model automatically changed without notice.
> >>
> >> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
> >> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
> >> this be a suitable solution for what you are after?
> >
> > There needs to be some correlation between the file hashes being added
> > to the blacklist and the certificate that signed them. Without that
> > correlation, any key on the secondary trusted keyring could add any
> > file hashes it wants to the blacklist.
>
> Today any key in the secondary trusted keyring can be used to validate a
> signed kernel module. At a later time, if a new hash is added to the blacklist
> keyring to revoke loading a signed kernel module, the ability to do the
> revocation with this additional change would be more restrictive than loading
> the original module.
A public key on the secondary keyring is used to verify code that it
signed, but does not impact any other code. Allowing any public key on
the secondary keyring to blacklist any file hash is giving it more
privileges than it originally had.
This requirement isn't different than how Certificate Revocation List
(CRL) work. Not any CA can revoke a certificate.
>
> But, if you think it would be appropriate, I could add a new Kconfig (disabled
> by default) that validates the key being used to vouch the S/MIME encoded
> hash is a CA. That would certainly make this more complicated. With this
> addition, would the key usage field need to be referenced too?
>
> Another idea I had was changing this patch to reference only the builtin and
> the machine keyring (if configured), not the secondary keyring. Then with
> INTEGRITY_CA_MACHINE_KEYRING_MAX, only CA keys could be
> used. Let me know your thoughts on this approach. Thanks.
Better, but it doesn't address the underlying problem.
--
thanks,
Mimi
On Sat Sep 9, 2023 at 12:34 AM EEST, Eric Snowberg wrote:
> Currently root can dynamically update the blacklist keyring if the hash
> being added is signed and vouched for by the builtin trusted keyring.
> Currently keys in the secondary trusted keyring can not be used.
>
> Keys within the secondary trusted keyring carry the same capabilities as
> the builtin trusted keyring. Relax the current restriction for updating
> the .blacklist keyring and allow the secondary to also be referenced as
> a trust source. Since the machine keyring is linked to the secondary
> trusted keyring, any key within it may also be used.
>
> An example use case for this is IMA appraisal. Now that IMA both
> references the blacklist keyring and allows the machine owner to add
> custom IMA CA certs via the machine keyring, this adds the additional
> capability for the machine owner to also do revocations on a running
> system.
>
> IMA appraisal usage example to add a revocation for /usr/foo:
>
> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
>
> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
> -signer machine-certificate.pem -noattr -binary -outform DER \
> -out hash.p7s
>
> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
>
> Signed-off-by: Eric Snowberg <[email protected]>
> ---
> certs/Kconfig | 2 +-
> certs/blacklist.c | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/certs/Kconfig b/certs/Kconfig
> index 1f109b070877..23dc87c52aff 100644
> --- a/certs/Kconfig
> +++ b/certs/Kconfig
> @@ -134,7 +134,7 @@ config SYSTEM_BLACKLIST_AUTH_UPDATE
> depends on SYSTEM_DATA_VERIFICATION
> help
> If set, provide the ability to load new blacklist keys at run time if
> - they are signed and vouched by a certificate from the builtin trusted
> + they are signed and vouched by a certificate from the secondary trusted
> keyring. The PKCS#7 signature of the description is set in the key
> payload. Blacklist keys cannot be removed.
>
> diff --git a/certs/blacklist.c b/certs/blacklist.c
> index 675dd7a8f07a..0b346048ae2d 100644
> --- a/certs/blacklist.c
> +++ b/certs/blacklist.c
> @@ -102,12 +102,12 @@ static int blacklist_key_instantiate(struct key *key,
>
> #ifdef CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE
> /*
> - * Verifies the description's PKCS#7 signature against the builtin
> + * Verifies the description's PKCS#7 signature against the secondary
> * trusted keyring.
> */
> err = verify_pkcs7_signature(key->description,
> strlen(key->description), prep->data, prep->datalen,
> - NULL, VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL);
> + VERIFY_USE_SECONDARY_KEYRING, VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL);
> if (err)
> return err;
> #else
> --
> 2.39.3
What if a live system in the wild assumes the old policy? I feel that
this is "sort of" breaking backwards compatibility but please prove me
wrong.
BR, Jarkko
> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
>
> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
>>
>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
>>>
>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
>>>> Hi Eric,
>>>>
>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
>>>>> Currently root can dynamically update the blacklist keyring if the hash
>>>>> being added is signed and vouched for by the builtin trusted keyring.
>>>>> Currently keys in the secondary trusted keyring can not be used.
>>>>>
>>>>> Keys within the secondary trusted keyring carry the same capabilities as
>>>>> the builtin trusted keyring. Relax the current restriction for updating
>>>>> the .blacklist keyring and allow the secondary to also be referenced as
>>>>> a trust source. Since the machine keyring is linked to the secondary
>>>>> trusted keyring, any key within it may also be used.
>>>>>
>>>>> An example use case for this is IMA appraisal. Now that IMA both
>>>>> references the blacklist keyring and allows the machine owner to add
>>>>> custom IMA CA certs via the machine keyring, this adds the additional
>>>>> capability for the machine owner to also do revocations on a running
>>>>> system.
>>>>>
>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
>>>>>
>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
>>>>>
>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
>>>>> -out hash.p7s
>>>>>
>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
>>>>>
>>>>> Signed-off-by: Eric Snowberg <[email protected]>
>>>>
>>>> The secondary keyring may include both CA and code signing keys. With
>>>> this change any key loaded onto the secondary keyring may blacklist a
>>>> hash. Wouldn't it make more sense to limit blacklisting
>>>> certificates/hashes to at least CA keys?
>>>
>>> Some operational constraints may limit what a CA can sign.
>>
>> Agreed.
>>
>> Is there precedents for requiring this S/MIME to be signed by a CA?
>>
>>> This change is critical and should be tied to a dedicated kernel config
>>> (disabled by default), otherwise existing systems using this feature
>>> will have their threat model automatically changed without notice.
>>
>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
>> this be a suitable solution for what you are after?
>
> There needs to be some correlation between the file hashes being added
> to the blacklist and the certificate that signed them. Without that
> correlation, any key on the secondary trusted keyring could add any
> file hashes it wants to the blacklist.
Today any key in the secondary trusted keyring can be used to validate a
signed kernel module. At a later time, if a new hash is added to the blacklist
keyring to revoke loading a signed kernel module, the ability to do the
revocation with this additional change would be more restrictive than loading
the original module.
But, if you think it would be appropriate, I could add a new Kconfig (disabled
by default) that validates the key being used to vouch the S/MIME encoded
hash is a CA. That would certainly make this more complicated. With this
addition, would the key usage field need to be referenced too?
Another idea I had was changing this patch to reference only the builtin and
the machine keyring (if configured), not the secondary keyring. Then with
INTEGRITY_CA_MACHINE_KEYRING_MAX, only CA keys could be
used. Let me know your thoughts on this approach. Thanks.
On Mon Sep 11, 2023 at 4:29 PM EEST, Mimi Zohar wrote:
> Hi Eric,
>
> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
> > Currently root can dynamically update the blacklist keyring if the hash
> > being added is signed and vouched for by the builtin trusted keyring.
> > Currently keys in the secondary trusted keyring can not be used.
> >
> > Keys within the secondary trusted keyring carry the same capabilities as
> > the builtin trusted keyring. Relax the current restriction for updating
> > the .blacklist keyring and allow the secondary to also be referenced as
> > a trust source. Since the machine keyring is linked to the secondary
> > trusted keyring, any key within it may also be used.
> >
> > An example use case for this is IMA appraisal. Now that IMA both
> > references the blacklist keyring and allows the machine owner to add
> > custom IMA CA certs via the machine keyring, this adds the additional
> > capability for the machine owner to also do revocations on a running
> > system.
> >
> > IMA appraisal usage example to add a revocation for /usr/foo:
> >
> > sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
> >
> > openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
> > -signer machine-certificate.pem -noattr -binary -outform DER \
> > -out hash.p7s
> >
> > keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
> >
> > Signed-off-by: Eric Snowberg <[email protected]>
>
> The secondary keyring may include both CA and code signing keys. With
> this change any key loaded onto the secondary keyring may blacklist a
> hash. Wouldn't it make more sense to limit blacklisting
> certificates/hashes to at least CA keys?
I think a bigger issue is that if a kernel is updated with this patch
it will change the behavior. It is nothing to do whether the "old" or
"new" is better but more like kind of backwards compatibility issue.
BR, Jarkko
> On Sep 12, 2023, at 5:54 AM, Mimi Zohar <[email protected]> wrote:
>
> On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
>>
>>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
>>>
>>> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
>>>>
>>>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
>>>>>
>>>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
>>>>>> Hi Eric,
>>>>>>
>>>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
>>>>>>> Currently root can dynamically update the blacklist keyring if the hash
>>>>>>> being added is signed and vouched for by the builtin trusted keyring.
>>>>>>> Currently keys in the secondary trusted keyring can not be used.
>>>>>>>
>>>>>>> Keys within the secondary trusted keyring carry the same capabilities as
>>>>>>> the builtin trusted keyring. Relax the current restriction for updating
>>>>>>> the .blacklist keyring and allow the secondary to also be referenced as
>>>>>>> a trust source. Since the machine keyring is linked to the secondary
>>>>>>> trusted keyring, any key within it may also be used.
>>>>>>>
>>>>>>> An example use case for this is IMA appraisal. Now that IMA both
>>>>>>> references the blacklist keyring and allows the machine owner to add
>>>>>>> custom IMA CA certs via the machine keyring, this adds the additional
>>>>>>> capability for the machine owner to also do revocations on a running
>>>>>>> system.
>>>>>>>
>>>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
>>>>>>>
>>>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
>>>>>>>
>>>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
>>>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
>>>>>>> -out hash.p7s
>>>>>>>
>>>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
>>>>>>>
>>>>>>> Signed-off-by: Eric Snowberg <[email protected]>
>>>>>>
>>>>>> The secondary keyring may include both CA and code signing keys. With
>>>>>> this change any key loaded onto the secondary keyring may blacklist a
>>>>>> hash. Wouldn't it make more sense to limit blacklisting
>>>>>> certificates/hashes to at least CA keys?
>>>>>
>>>>> Some operational constraints may limit what a CA can sign.
>>>>
>>>> Agreed.
>>>>
>>>> Is there precedents for requiring this S/MIME to be signed by a CA?
>>>>
>>>>> This change is critical and should be tied to a dedicated kernel config
>>>>> (disabled by default), otherwise existing systems using this feature
>>>>> will have their threat model automatically changed without notice.
>>>>
>>>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
>>>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
>>>> this be a suitable solution for what you are after?
>>>
>>> There needs to be some correlation between the file hashes being added
>>> to the blacklist and the certificate that signed them. Without that
>>> correlation, any key on the secondary trusted keyring could add any
>>> file hashes it wants to the blacklist.
>>
>> Today any key in the secondary trusted keyring can be used to validate a
>> signed kernel module. At a later time, if a new hash is added to the blacklist
>> keyring to revoke loading a signed kernel module, the ability to do the
>> revocation with this additional change would be more restrictive than loading
>> the original module.
>
> A public key on the secondary keyring is used to verify code that it
> signed, but does not impact any other code. Allowing any public key on
> the secondary keyring to blacklist any file hash is giving it more
> privileges than it originally had.
>
> This requirement isn't different than how Certificate Revocation List
> (CRL) work. Not any CA can revoke a certificate.
In UEFI Secure Boot we have the Forbidden Signature Database (DBX).
Root can update the DBX on a host. The requirement placed on updating
it is the new DBX entry must be signed by any key contained within the
KEK. Following a reboot, all DBX entries load into the .blacklist keyring.
There is not a requirement similar to how CRL’s work here, any KEK key
can be used.
With architectures booted through a shim there is the MOKX. Similar to
DBX, MOKX have the same capabilities, however they do not need to be
signed by any key, the machine owner must show they have physical
presence (and potentially a MOK password) for inclusion. Again there
is not a requirement similar to how CRL’s work here either. The machine
owner can decide what is included.
Today when a kernel is built, any number of keys may be included within
the builtin trusted keyring. The keys included in the kernel may not have
a single usage field set or the CA bit set. There are no requirements on
how these keys get used later on. Any key in the builtin trusted keyring
can be used to sign a revocation that can be added to the blacklist keyring.
Additionally, any key in the MOK can be used to sign this kernel and it will
boot. Before booting the kernel, MOK keys have more privileges than
after the kernel is booted in some instances.
Today MOK keys can be loaded into the machine keyring. These keys get
linked to the secondary trusted keyring. Currently key usage enforcement
is being applied to these keys behind some Kconfig options. By default
anything in the secondary has the same capabilities as the builtin trusted
keyring. What is challenging here with this request is the inconsistency
between how everything else currently works.
Root can not arbitrarily add things to the secondary trusted keyring. These
keys must be signed by something in either the machine or the builtin. In
this thread [1], Jarkko is saying CA based infrastructure should be a policy
decision not to be enforced by the kernel. Wouldn’t this apply here as well?
1. https://lore.kernel.org/lkml/CVGUFUEQVCHS.37OA20PNG9EVB@suppilovahvero/
On Tue, 2023-09-12 at 17:11 +0000, Eric Snowberg wrote:
>
> > On Sep 12, 2023, at 5:54 AM, Mimi Zohar <[email protected]> wrote:
> >
> > On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
> >>
> >>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
> >>>
> >>> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
> >>>>
> >>>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
> >>>>>
> >>>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
> >>>>>> Hi Eric,
> >>>>>>
> >>>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
> >>>>>>> Currently root can dynamically update the blacklist keyring if the hash
> >>>>>>> being added is signed and vouched for by the builtin trusted keyring.
> >>>>>>> Currently keys in the secondary trusted keyring can not be used.
> >>>>>>>
> >>>>>>> Keys within the secondary trusted keyring carry the same capabilities as
> >>>>>>> the builtin trusted keyring. Relax the current restriction for updating
> >>>>>>> the .blacklist keyring and allow the secondary to also be referenced as
> >>>>>>> a trust source. Since the machine keyring is linked to the secondary
> >>>>>>> trusted keyring, any key within it may also be used.
> >>>>>>>
> >>>>>>> An example use case for this is IMA appraisal. Now that IMA both
> >>>>>>> references the blacklist keyring and allows the machine owner to add
> >>>>>>> custom IMA CA certs via the machine keyring, this adds the additional
> >>>>>>> capability for the machine owner to also do revocations on a running
> >>>>>>> system.
> >>>>>>>
> >>>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
> >>>>>>>
> >>>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
> >>>>>>>
> >>>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
> >>>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
> >>>>>>> -out hash.p7s
> >>>>>>>
> >>>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
> >>>>>>>
> >>>>>>> Signed-off-by: Eric Snowberg <[email protected]>
> >>>>>>
> >>>>>> The secondary keyring may include both CA and code signing keys. With
> >>>>>> this change any key loaded onto the secondary keyring may blacklist a
> >>>>>> hash. Wouldn't it make more sense to limit blacklisting
> >>>>>> certificates/hashes to at least CA keys?
> >>>>>
> >>>>> Some operational constraints may limit what a CA can sign.
> >>>>
> >>>> Agreed.
> >>>>
> >>>> Is there precedents for requiring this S/MIME to be signed by a CA?
> >>>>
> >>>>> This change is critical and should be tied to a dedicated kernel config
> >>>>> (disabled by default), otherwise existing systems using this feature
> >>>>> will have their threat model automatically changed without notice.
> >>>>
> >>>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
> >>>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
> >>>> this be a suitable solution for what you are after?
> >>>
> >>> There needs to be some correlation between the file hashes being added
> >>> to the blacklist and the certificate that signed them. Without that
> >>> correlation, any key on the secondary trusted keyring could add any
> >>> file hashes it wants to the blacklist.
> >>
> >> Today any key in the secondary trusted keyring can be used to validate a
> >> signed kernel module. At a later time, if a new hash is added to the blacklist
> >> keyring to revoke loading a signed kernel module, the ability to do the
> >> revocation with this additional change would be more restrictive than loading
> >> the original module.
> >
> > A public key on the secondary keyring is used to verify code that it
> > signed, but does not impact any other code. Allowing any public key on
> > the secondary keyring to blacklist any file hash is giving it more
> > privileges than it originally had.
> >
> > This requirement isn't different than how Certificate Revocation List
> > (CRL) work. Not any CA can revoke a certificate.
>
> In UEFI Secure Boot we have the Forbidden Signature Database (DBX).
> Root can update the DBX on a host. The requirement placed on updating
> it is the new DBX entry must be signed by any key contained within the
> KEK. Following a reboot, all DBX entries load into the .blacklist keyring.
> There is not a requirement similar to how CRL’s work here, any KEK key
> can be used.
>
> With architectures booted through a shim there is the MOKX. Similar to
> DBX, MOKX have the same capabilities, however they do not need to be
> signed by any key, the machine owner must show they have physical
> presence (and potentially a MOK password) for inclusion. Again there
> is not a requirement similar to how CRL’s work here either. The machine
> owner can decide what is included.
>
> Today when a kernel is built, any number of keys may be included within
> the builtin trusted keyring. The keys included in the kernel may not have
> a single usage field set or the CA bit set. There are no requirements on
> how these keys get used later on. Any key in the builtin trusted keyring
> can be used to sign a revocation that can be added to the blacklist keyring.
> Additionally, any key in the MOK can be used to sign this kernel and it will
> boot. Before booting the kernel, MOK keys have more privileges than
> after the kernel is booted in some instances.
>
> Today MOK keys can be loaded into the machine keyring. These keys get
> linked to the secondary trusted keyring. Currently key usage enforcement
> is being applied to these keys behind some Kconfig options. By default
> anything in the secondary has the same capabilities as the builtin trusted
> keyring. What is challenging here with this request is the inconsistency
> between how everything else currently works.
>
> Root can not arbitrarily add things to the secondary trusted keyring. These
> keys must be signed by something in either the machine or the builtin. In
> this thread [1], Jarkko is saying CA based infrastructure should be a policy
> decision not to be enforced by the kernel. Wouldn’t this apply here as well?
>
> 1. https://lore.kernel.org/lkml/CVGUFUEQVCHS.37OA20PNG9EVB@suppilovahvero/
Mickaël said, "This change is critical and should be tied to a
dedicated kernel config
(disabled by default), otherwise existing systems using this feature
will have their threat model automatically changed without notice."
As a possible alternative I suggested limiting which file hashes the
certs on the secondary (or machine) keyring could blacklist.
--
thanks,
Mimi
> On Sep 12, 2023, at 4:47 PM, Mimi Zohar <[email protected]> wrote:
>
> On Tue, 2023-09-12 at 17:11 +0000, Eric Snowberg wrote:
>>
>>> On Sep 12, 2023, at 5:54 AM, Mimi Zohar <[email protected]> wrote:
>>>
>>> On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
>>>>
>>>>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
>>>>>
>>>>> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
>>>>>>
>>>>>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
>>>>>>>
>>>>>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
>>>>>>>> Hi Eric,
>>>>>>>>
>>>>>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
>>>>>>>>> Currently root can dynamically update the blacklist keyring if the hash
>>>>>>>>> being added is signed and vouched for by the builtin trusted keyring.
>>>>>>>>> Currently keys in the secondary trusted keyring can not be used.
>>>>>>>>>
>>>>>>>>> Keys within the secondary trusted keyring carry the same capabilities as
>>>>>>>>> the builtin trusted keyring. Relax the current restriction for updating
>>>>>>>>> the .blacklist keyring and allow the secondary to also be referenced as
>>>>>>>>> a trust source. Since the machine keyring is linked to the secondary
>>>>>>>>> trusted keyring, any key within it may also be used.
>>>>>>>>>
>>>>>>>>> An example use case for this is IMA appraisal. Now that IMA both
>>>>>>>>> references the blacklist keyring and allows the machine owner to add
>>>>>>>>> custom IMA CA certs via the machine keyring, this adds the additional
>>>>>>>>> capability for the machine owner to also do revocations on a running
>>>>>>>>> system.
>>>>>>>>>
>>>>>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
>>>>>>>>>
>>>>>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
>>>>>>>>>
>>>>>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
>>>>>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
>>>>>>>>> -out hash.p7s
>>>>>>>>>
>>>>>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
>>>>>>>>>
>>>>>>>>> Signed-off-by: Eric Snowberg <[email protected]>
>>>>>>>>
>>>>>>>> The secondary keyring may include both CA and code signing keys. With
>>>>>>>> this change any key loaded onto the secondary keyring may blacklist a
>>>>>>>> hash. Wouldn't it make more sense to limit blacklisting
>>>>>>>> certificates/hashes to at least CA keys?
>>>>>>>
>>>>>>> Some operational constraints may limit what a CA can sign.
>>>>>>
>>>>>> Agreed.
>>>>>>
>>>>>> Is there precedents for requiring this S/MIME to be signed by a CA?
>>>>>>
>>>>>>> This change is critical and should be tied to a dedicated kernel config
>>>>>>> (disabled by default), otherwise existing systems using this feature
>>>>>>> will have their threat model automatically changed without notice.
>>>>>>
>>>>>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
>>>>>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
>>>>>> this be a suitable solution for what you are after?
>>>>>
>>>>> There needs to be some correlation between the file hashes being added
>>>>> to the blacklist and the certificate that signed them. Without that
>>>>> correlation, any key on the secondary trusted keyring could add any
>>>>> file hashes it wants to the blacklist.
>>>>
>>>> Today any key in the secondary trusted keyring can be used to validate a
>>>> signed kernel module. At a later time, if a new hash is added to the blacklist
>>>> keyring to revoke loading a signed kernel module, the ability to do the
>>>> revocation with this additional change would be more restrictive than loading
>>>> the original module.
>>>
>>> A public key on the secondary keyring is used to verify code that it
>>> signed, but does not impact any other code. Allowing any public key on
>>> the secondary keyring to blacklist any file hash is giving it more
>>> privileges than it originally had.
>>>
>>> This requirement isn't different than how Certificate Revocation List
>>> (CRL) work. Not any CA can revoke a certificate.
>>
>> In UEFI Secure Boot we have the Forbidden Signature Database (DBX).
>> Root can update the DBX on a host. The requirement placed on updating
>> it is the new DBX entry must be signed by any key contained within the
>> KEK. Following a reboot, all DBX entries load into the .blacklist keyring.
>> There is not a requirement similar to how CRL’s work here, any KEK key
>> can be used.
>>
>> With architectures booted through a shim there is the MOKX. Similar to
>> DBX, MOKX have the same capabilities, however they do not need to be
>> signed by any key, the machine owner must show they have physical
>> presence (and potentially a MOK password) for inclusion. Again there
>> is not a requirement similar to how CRL’s work here either. The machine
>> owner can decide what is included.
>>
>> Today when a kernel is built, any number of keys may be included within
>> the builtin trusted keyring. The keys included in the kernel may not have
>> a single usage field set or the CA bit set. There are no requirements on
>> how these keys get used later on. Any key in the builtin trusted keyring
>> can be used to sign a revocation that can be added to the blacklist keyring.
>> Additionally, any key in the MOK can be used to sign this kernel and it will
>> boot. Before booting the kernel, MOK keys have more privileges than
>> after the kernel is booted in some instances.
>>
>> Today MOK keys can be loaded into the machine keyring. These keys get
>> linked to the secondary trusted keyring. Currently key usage enforcement
>> is being applied to these keys behind some Kconfig options. By default
>> anything in the secondary has the same capabilities as the builtin trusted
>> keyring. What is challenging here with this request is the inconsistency
>> between how everything else currently works.
>>
>> Root can not arbitrarily add things to the secondary trusted keyring. These
>> keys must be signed by something in either the machine or the builtin. In
>> this thread [1], Jarkko is saying CA based infrastructure should be a policy
>> decision not to be enforced by the kernel. Wouldn’t this apply here as well?
>>
>> 1. https://lore.kernel.org/lkml/CVGUFUEQVCHS.37OA20PNG9EVB@suppilovahvero/
>
> Mickaël said, "This change is critical and should be tied to a
> dedicated kernel config
> (disabled by default), otherwise existing systems using this feature
> will have their threat model automatically changed without notice."
I was thinking he meant it is critical not to change the current behavior
by limiting blacklisting to only CA keys. Not that it was critical to add
CA enforcement. Maybe Mickaël can comment?
> As a possible alternative I suggested limiting which file hashes the
> certs on the secondary (or machine) keyring could blacklist.
I’m not sure I completely understand your suggestion here.
Do you mean, verify the CA bit is set for secondary keys, but
ignore the bit for builtin? And then only use those keys to add
hashes to the blacklist keyring? If I have that right, what would
be the justification for the change based on how things currently
get included in the blacklist keyring? Thanks.
On Wed, Sep 13, 2023 at 02:40:17AM +0000, Eric Snowberg wrote:
>
>
> > On Sep 12, 2023, at 4:47 PM, Mimi Zohar <[email protected]> wrote:
> >
> > On Tue, 2023-09-12 at 17:11 +0000, Eric Snowberg wrote:
> >>
> >>> On Sep 12, 2023, at 5:54 AM, Mimi Zohar <[email protected]> wrote:
> >>>
> >>> On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
> >>>>
> >>>>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
> >>>>>
> >>>>> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
> >>>>>>
> >>>>>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
> >>>>>>>
> >>>>>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
> >>>>>>>> Hi Eric,
> >>>>>>>>
> >>>>>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
> >>>>>>>>> Currently root can dynamically update the blacklist keyring if the hash
> >>>>>>>>> being added is signed and vouched for by the builtin trusted keyring.
> >>>>>>>>> Currently keys in the secondary trusted keyring can not be used.
> >>>>>>>>>
> >>>>>>>>> Keys within the secondary trusted keyring carry the same capabilities as
> >>>>>>>>> the builtin trusted keyring. Relax the current restriction for updating
> >>>>>>>>> the .blacklist keyring and allow the secondary to also be referenced as
> >>>>>>>>> a trust source. Since the machine keyring is linked to the secondary
> >>>>>>>>> trusted keyring, any key within it may also be used.
> >>>>>>>>>
> >>>>>>>>> An example use case for this is IMA appraisal. Now that IMA both
> >>>>>>>>> references the blacklist keyring and allows the machine owner to add
> >>>>>>>>> custom IMA CA certs via the machine keyring, this adds the additional
> >>>>>>>>> capability for the machine owner to also do revocations on a running
> >>>>>>>>> system.
> >>>>>>>>>
> >>>>>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
> >>>>>>>>>
> >>>>>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
> >>>>>>>>>
> >>>>>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
> >>>>>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
> >>>>>>>>> -out hash.p7s
> >>>>>>>>>
> >>>>>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
> >>>>>>>>>
> >>>>>>>>> Signed-off-by: Eric Snowberg <[email protected]>
> >>>>>>>>
> >>>>>>>> The secondary keyring may include both CA and code signing keys. With
> >>>>>>>> this change any key loaded onto the secondary keyring may blacklist a
> >>>>>>>> hash. Wouldn't it make more sense to limit blacklisting
> >>>>>>>> certificates/hashes to at least CA keys?
> >>>>>>>
> >>>>>>> Some operational constraints may limit what a CA can sign.
> >>>>>>
> >>>>>> Agreed.
> >>>>>>
> >>>>>> Is there precedents for requiring this S/MIME to be signed by a CA?
> >>>>>>
> >>>>>>> This change is critical and should be tied to a dedicated kernel config
> >>>>>>> (disabled by default), otherwise existing systems using this feature
> >>>>>>> will have their threat model automatically changed without notice.
> >>>>>>
> >>>>>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
> >>>>>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
> >>>>>> this be a suitable solution for what you are after?
> >>>>>
> >>>>> There needs to be some correlation between the file hashes being added
> >>>>> to the blacklist and the certificate that signed them. Without that
> >>>>> correlation, any key on the secondary trusted keyring could add any
> >>>>> file hashes it wants to the blacklist.
> >>>>
> >>>> Today any key in the secondary trusted keyring can be used to validate a
> >>>> signed kernel module. At a later time, if a new hash is added to the blacklist
> >>>> keyring to revoke loading a signed kernel module, the ability to do the
> >>>> revocation with this additional change would be more restrictive than loading
> >>>> the original module.
> >>>
> >>> A public key on the secondary keyring is used to verify code that it
> >>> signed, but does not impact any other code. Allowing any public key on
> >>> the secondary keyring to blacklist any file hash is giving it more
> >>> privileges than it originally had.
> >>>
> >>> This requirement isn't different than how Certificate Revocation List
> >>> (CRL) work. Not any CA can revoke a certificate.
> >>
> >> In UEFI Secure Boot we have the Forbidden Signature Database (DBX).
> >> Root can update the DBX on a host. The requirement placed on updating
> >> it is the new DBX entry must be signed by any key contained within the
> >> KEK. Following a reboot, all DBX entries load into the .blacklist keyring.
> >> There is not a requirement similar to how CRL’s work here, any KEK key
> >> can be used.
> >>
> >> With architectures booted through a shim there is the MOKX. Similar to
> >> DBX, MOKX have the same capabilities, however they do not need to be
> >> signed by any key, the machine owner must show they have physical
> >> presence (and potentially a MOK password) for inclusion. Again there
> >> is not a requirement similar to how CRL’s work here either. The machine
> >> owner can decide what is included.
> >>
> >> Today when a kernel is built, any number of keys may be included within
> >> the builtin trusted keyring. The keys included in the kernel may not have
> >> a single usage field set or the CA bit set. There are no requirements on
> >> how these keys get used later on. Any key in the builtin trusted keyring
> >> can be used to sign a revocation that can be added to the blacklist keyring.
> >> Additionally, any key in the MOK can be used to sign this kernel and it will
> >> boot. Before booting the kernel, MOK keys have more privileges than
> >> after the kernel is booted in some instances.
> >>
> >> Today MOK keys can be loaded into the machine keyring. These keys get
> >> linked to the secondary trusted keyring. Currently key usage enforcement
> >> is being applied to these keys behind some Kconfig options. By default
> >> anything in the secondary has the same capabilities as the builtin trusted
> >> keyring. What is challenging here with this request is the inconsistency
> >> between how everything else currently works.
> >>
> >> Root can not arbitrarily add things to the secondary trusted keyring. These
> >> keys must be signed by something in either the machine or the builtin. In
> >> this thread [1], Jarkko is saying CA based infrastructure should be a policy
> >> decision not to be enforced by the kernel. Wouldn’t this apply here as well?
> >>
> >> 1. https://lore.kernel.org/lkml/CVGUFUEQVCHS.37OA20PNG9EVB@suppilovahvero/
> >
> > Mickaël said, "This change is critical and should be tied to a
> > dedicated kernel config
> > (disabled by default), otherwise existing systems using this feature
> > will have their threat model automatically changed without notice."
>
> I was thinking he meant it is critical not to change the current behavior
> by limiting blacklisting to only CA keys. Not that it was critical to add
> CA enforcement. Maybe Mickaël can comment?
I meant that applying this patch as-is may change the threat model used
by some users. Currently, only signed hashes vouched by the builtin
trusted keyring are valid. If we extend this mechanism to the secondary
trusted keyring without notice, this means that more certificates could
vouch blacklisted hashes, which may include some certificates with an
initial different usage.
See commit 4da8f8c8a1e0 ("dm verity: Add support for signature
verification with 2nd keyring") that adds
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING:
https://lore.kernel.org/all/[email protected]/
>
> > As a possible alternative I suggested limiting which file hashes the
> > certs on the secondary (or machine) keyring could blacklist.
>
> I’m not sure I completely understand your suggestion here.
> Do you mean, verify the CA bit is set for secondary keys, but
> ignore the bit for builtin? And then only use those keys to add
> hashes to the blacklist keyring? If I have that right, what would
> be the justification for the change based on how things currently
> get included in the blacklist keyring? Thanks.
I'd like to be able to specify which kind of certificate can vouch for
blacklisting hashes, and for other usages, but AFAIK this is not the
path Linux has followed (e.g. unlike Windows). We only have the keyring
to identify an usage, which is unfortunate. On the other side, this
approach lets users manage their certificates without constraint, which
is quite (too?) flexible. A complementary approach would be to create an
LSM (or a dedicated interface) to tie certificate properties to a set of
kernel usages, while still letting users configure these constraints.
> On Sep 13, 2023, at 4:21 AM, Mickaël Salaün <[email protected]> wrote:
>
> On Wed, Sep 13, 2023 at 02:40:17AM +0000, Eric Snowberg wrote:
>>
>>
>>> On Sep 12, 2023, at 4:47 PM, Mimi Zohar <[email protected]> wrote:
>>>
>>> On Tue, 2023-09-12 at 17:11 +0000, Eric Snowberg wrote:
>>>>
>>>>> On Sep 12, 2023, at 5:54 AM, Mimi Zohar <[email protected]> wrote:
>>>>>
>>>>> On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
>>>>>>
>>>>>>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
>>>>>>>
>>>>>>> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
>>>>>>>>
>>>>>>>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
>>>>>>>>>
>>>>>>>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
>>>>>>>>>> Hi Eric,
>>>>>>>>>>
>>>>>>>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
>>>>>>>>>>> Currently root can dynamically update the blacklist keyring if the hash
>>>>>>>>>>> being added is signed and vouched for by the builtin trusted keyring.
>>>>>>>>>>> Currently keys in the secondary trusted keyring can not be used.
>>>>>>>>>>>
>>>>>>>>>>> Keys within the secondary trusted keyring carry the same capabilities as
>>>>>>>>>>> the builtin trusted keyring. Relax the current restriction for updating
>>>>>>>>>>> the .blacklist keyring and allow the secondary to also be referenced as
>>>>>>>>>>> a trust source. Since the machine keyring is linked to the secondary
>>>>>>>>>>> trusted keyring, any key within it may also be used.
>>>>>>>>>>>
>>>>>>>>>>> An example use case for this is IMA appraisal. Now that IMA both
>>>>>>>>>>> references the blacklist keyring and allows the machine owner to add
>>>>>>>>>>> custom IMA CA certs via the machine keyring, this adds the additional
>>>>>>>>>>> capability for the machine owner to also do revocations on a running
>>>>>>>>>>> system.
>>>>>>>>>>>
>>>>>>>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
>>>>>>>>>>>
>>>>>>>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
>>>>>>>>>>>
>>>>>>>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
>>>>>>>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
>>>>>>>>>>> -out hash.p7s
>>>>>>>>>>>
>>>>>>>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
>>>>>>>>>>>
>>>>>>>>>>> Signed-off-by: Eric Snowberg <[email protected]>
>>>>>>>>>>
>>>>>>>>>> The secondary keyring may include both CA and code signing keys. With
>>>>>>>>>> this change any key loaded onto the secondary keyring may blacklist a
>>>>>>>>>> hash. Wouldn't it make more sense to limit blacklisting
>>>>>>>>>> certificates/hashes to at least CA keys?
>>>>>>>>>
>>>>>>>>> Some operational constraints may limit what a CA can sign.
>>>>>>>>
>>>>>>>> Agreed.
>>>>>>>>
>>>>>>>> Is there precedents for requiring this S/MIME to be signed by a CA?
>>>>>>>>
>>>>>>>>> This change is critical and should be tied to a dedicated kernel config
>>>>>>>>> (disabled by default), otherwise existing systems using this feature
>>>>>>>>> will have their threat model automatically changed without notice.
>>>>>>>>
>>>>>>>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
>>>>>>>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
>>>>>>>> this be a suitable solution for what you are after?
>>>>>>>
>>>>>>> There needs to be some correlation between the file hashes being added
>>>>>>> to the blacklist and the certificate that signed them. Without that
>>>>>>> correlation, any key on the secondary trusted keyring could add any
>>>>>>> file hashes it wants to the blacklist.
>>>>>>
>>>>>> Today any key in the secondary trusted keyring can be used to validate a
>>>>>> signed kernel module. At a later time, if a new hash is added to the blacklist
>>>>>> keyring to revoke loading a signed kernel module, the ability to do the
>>>>>> revocation with this additional change would be more restrictive than loading
>>>>>> the original module.
>>>>>
>>>>> A public key on the secondary keyring is used to verify code that it
>>>>> signed, but does not impact any other code. Allowing any public key on
>>>>> the secondary keyring to blacklist any file hash is giving it more
>>>>> privileges than it originally had.
>>>>>
>>>>> This requirement isn't different than how Certificate Revocation List
>>>>> (CRL) work. Not any CA can revoke a certificate.
>>>>
>>>> In UEFI Secure Boot we have the Forbidden Signature Database (DBX).
>>>> Root can update the DBX on a host. The requirement placed on updating
>>>> it is the new DBX entry must be signed by any key contained within the
>>>> KEK. Following a reboot, all DBX entries load into the .blacklist keyring.
>>>> There is not a requirement similar to how CRL’s work here, any KEK key
>>>> can be used.
>>>>
>>>> With architectures booted through a shim there is the MOKX. Similar to
>>>> DBX, MOKX have the same capabilities, however they do not need to be
>>>> signed by any key, the machine owner must show they have physical
>>>> presence (and potentially a MOK password) for inclusion. Again there
>>>> is not a requirement similar to how CRL’s work here either. The machine
>>>> owner can decide what is included.
>>>>
>>>> Today when a kernel is built, any number of keys may be included within
>>>> the builtin trusted keyring. The keys included in the kernel may not have
>>>> a single usage field set or the CA bit set. There are no requirements on
>>>> how these keys get used later on. Any key in the builtin trusted keyring
>>>> can be used to sign a revocation that can be added to the blacklist keyring.
>>>> Additionally, any key in the MOK can be used to sign this kernel and it will
>>>> boot. Before booting the kernel, MOK keys have more privileges than
>>>> after the kernel is booted in some instances.
>>>>
>>>> Today MOK keys can be loaded into the machine keyring. These keys get
>>>> linked to the secondary trusted keyring. Currently key usage enforcement
>>>> is being applied to these keys behind some Kconfig options. By default
>>>> anything in the secondary has the same capabilities as the builtin trusted
>>>> keyring. What is challenging here with this request is the inconsistency
>>>> between how everything else currently works.
>>>>
>>>> Root can not arbitrarily add things to the secondary trusted keyring. These
>>>> keys must be signed by something in either the machine or the builtin. In
>>>> this thread [1], Jarkko is saying CA based infrastructure should be a policy
>>>> decision not to be enforced by the kernel. Wouldn’t this apply here as well?
>>>>
>>>> 1. https://lore.kernel.org/lkml/CVGUFUEQVCHS.37OA20PNG9EVB@suppilovahvero/
>>>
>>> Mickaël said, "This change is critical and should be tied to a
>>> dedicated kernel config
>>> (disabled by default), otherwise existing systems using this feature
>>> will have their threat model automatically changed without notice."
>>
>> I was thinking he meant it is critical not to change the current behavior
>> by limiting blacklisting to only CA keys. Not that it was critical to add
>> CA enforcement. Maybe Mickaël can comment?
>
> I meant that applying this patch as-is may change the threat model used
> by some users. Currently, only signed hashes vouched by the builtin
> trusted keyring are valid. If we extend this mechanism to the secondary
> trusted keyring without notice, this means that more certificates could
> vouch blacklisted hashes, which may include some certificates with an
> initial different usage.
>
> See commit 4da8f8c8a1e0 ("dm verity: Add support for signature
> verification with 2nd keyring") that adds
> CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING:
> https://lore.kernel.org/all/[email protected]/
Thanks for clarifying. I’ll add something similar in v2.
>>
>>> As a possible alternative I suggested limiting which file hashes the
>>> certs on the secondary (or machine) keyring could blacklist.
>>
>> I’m not sure I completely understand your suggestion here.
>> Do you mean, verify the CA bit is set for secondary keys, but
>> ignore the bit for builtin? And then only use those keys to add
>> hashes to the blacklist keyring? If I have that right, what would
>> be the justification for the change based on how things currently
>> get included in the blacklist keyring? Thanks.
>
> I'd like to be able to specify which kind of certificate can vouch for
> blacklisting hashes, and for other usages, but AFAIK this is not the
> path Linux has followed (e.g. unlike Windows). We only have the keyring
> to identify an usage, which is unfortunate. On the other side, this
> approach lets users manage their certificates without constraint, which
> is quite (too?) flexible.
Yes, it is very flexible. What I believe Mimi is after is having a way to
track what cert actually vouched for each specific binary hash. But this
information is not tracked, plus entries within it can come from various
sources that are not signed (dbx, mokx, compiled in). Also key usage is
being ignored.
> A complementary approach would be to create an
> LSM (or a dedicated interface) to tie certificate properties to a set of
> kernel usages, while still letting users configure these constraints.
That is an interesting idea. Would the other security maintainers be in
support of such an approach? Would a LSM be the correct interface?
Some of the recent work I have done with introducing key usage and CA
enforcement is difficult for a distro to pick up, since these changes can be
viewed as a regression. Each end-user has different signing procedures
and policies, so making something work for everyone is difficult. Letting the
user configure these constraints would solve this problem.
CCing the LSM mailing list for this potential new LSM proposal:
On Wed, Sep 13, 2023 at 10:29:58PM +0000, Eric Snowberg wrote:
>
>
> > On Sep 13, 2023, at 4:21 AM, Mickaël Salaün <[email protected]> wrote:
> >
> > On Wed, Sep 13, 2023 at 02:40:17AM +0000, Eric Snowberg wrote:
> >>
> >>
> >>> On Sep 12, 2023, at 4:47 PM, Mimi Zohar <[email protected]> wrote:
> >>>
> >>> On Tue, 2023-09-12 at 17:11 +0000, Eric Snowberg wrote:
> >>>>
> >>>>> On Sep 12, 2023, at 5:54 AM, Mimi Zohar <[email protected]> wrote:
> >>>>>
> >>>>> On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
> >>>>>>
> >>>>>>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
> >>>>>>>
> >>>>>>> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
> >>>>>>>>
> >>>>>>>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
> >>>>>>>>>
> >>>>>>>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
> >>>>>>>>>> Hi Eric,
> >>>>>>>>>>
> >>>>>>>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
> >>>>>>>>>>> Currently root can dynamically update the blacklist keyring if the hash
> >>>>>>>>>>> being added is signed and vouched for by the builtin trusted keyring.
> >>>>>>>>>>> Currently keys in the secondary trusted keyring can not be used.
> >>>>>>>>>>>
> >>>>>>>>>>> Keys within the secondary trusted keyring carry the same capabilities as
> >>>>>>>>>>> the builtin trusted keyring. Relax the current restriction for updating
> >>>>>>>>>>> the .blacklist keyring and allow the secondary to also be referenced as
> >>>>>>>>>>> a trust source. Since the machine keyring is linked to the secondary
> >>>>>>>>>>> trusted keyring, any key within it may also be used.
> >>>>>>>>>>>
> >>>>>>>>>>> An example use case for this is IMA appraisal. Now that IMA both
> >>>>>>>>>>> references the blacklist keyring and allows the machine owner to add
> >>>>>>>>>>> custom IMA CA certs via the machine keyring, this adds the additional
> >>>>>>>>>>> capability for the machine owner to also do revocations on a running
> >>>>>>>>>>> system.
> >>>>>>>>>>>
> >>>>>>>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
> >>>>>>>>>>>
> >>>>>>>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
> >>>>>>>>>>>
> >>>>>>>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
> >>>>>>>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
> >>>>>>>>>>> -out hash.p7s
> >>>>>>>>>>>
> >>>>>>>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
> >>>>>>>>>>>
> >>>>>>>>>>> Signed-off-by: Eric Snowberg <[email protected]>
> >>>>>>>>>>
> >>>>>>>>>> The secondary keyring may include both CA and code signing keys. With
> >>>>>>>>>> this change any key loaded onto the secondary keyring may blacklist a
> >>>>>>>>>> hash. Wouldn't it make more sense to limit blacklisting
> >>>>>>>>>> certificates/hashes to at least CA keys?
> >>>>>>>>>
> >>>>>>>>> Some operational constraints may limit what a CA can sign.
> >>>>>>>>
> >>>>>>>> Agreed.
> >>>>>>>>
> >>>>>>>> Is there precedents for requiring this S/MIME to be signed by a CA?
> >>>>>>>>
> >>>>>>>>> This change is critical and should be tied to a dedicated kernel config
> >>>>>>>>> (disabled by default), otherwise existing systems using this feature
> >>>>>>>>> will have their threat model automatically changed without notice.
> >>>>>>>>
> >>>>>>>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
> >>>>>>>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
> >>>>>>>> this be a suitable solution for what you are after?
> >>>>>>>
> >>>>>>> There needs to be some correlation between the file hashes being added
> >>>>>>> to the blacklist and the certificate that signed them. Without that
> >>>>>>> correlation, any key on the secondary trusted keyring could add any
> >>>>>>> file hashes it wants to the blacklist.
> >>>>>>
> >>>>>> Today any key in the secondary trusted keyring can be used to validate a
> >>>>>> signed kernel module. At a later time, if a new hash is added to the blacklist
> >>>>>> keyring to revoke loading a signed kernel module, the ability to do the
> >>>>>> revocation with this additional change would be more restrictive than loading
> >>>>>> the original module.
> >>>>>
> >>>>> A public key on the secondary keyring is used to verify code that it
> >>>>> signed, but does not impact any other code. Allowing any public key on
> >>>>> the secondary keyring to blacklist any file hash is giving it more
> >>>>> privileges than it originally had.
> >>>>>
> >>>>> This requirement isn't different than how Certificate Revocation List
> >>>>> (CRL) work. Not any CA can revoke a certificate.
> >>>>
> >>>> In UEFI Secure Boot we have the Forbidden Signature Database (DBX).
> >>>> Root can update the DBX on a host. The requirement placed on updating
> >>>> it is the new DBX entry must be signed by any key contained within the
> >>>> KEK. Following a reboot, all DBX entries load into the .blacklist keyring.
> >>>> There is not a requirement similar to how CRL’s work here, any KEK key
> >>>> can be used.
> >>>>
> >>>> With architectures booted through a shim there is the MOKX. Similar to
> >>>> DBX, MOKX have the same capabilities, however they do not need to be
> >>>> signed by any key, the machine owner must show they have physical
> >>>> presence (and potentially a MOK password) for inclusion. Again there
> >>>> is not a requirement similar to how CRL’s work here either. The machine
> >>>> owner can decide what is included.
> >>>>
> >>>> Today when a kernel is built, any number of keys may be included within
> >>>> the builtin trusted keyring. The keys included in the kernel may not have
> >>>> a single usage field set or the CA bit set. There are no requirements on
> >>>> how these keys get used later on. Any key in the builtin trusted keyring
> >>>> can be used to sign a revocation that can be added to the blacklist keyring.
> >>>> Additionally, any key in the MOK can be used to sign this kernel and it will
> >>>> boot. Before booting the kernel, MOK keys have more privileges than
> >>>> after the kernel is booted in some instances.
> >>>>
> >>>> Today MOK keys can be loaded into the machine keyring. These keys get
> >>>> linked to the secondary trusted keyring. Currently key usage enforcement
> >>>> is being applied to these keys behind some Kconfig options. By default
> >>>> anything in the secondary has the same capabilities as the builtin trusted
> >>>> keyring. What is challenging here with this request is the inconsistency
> >>>> between how everything else currently works.
> >>>>
> >>>> Root can not arbitrarily add things to the secondary trusted keyring. These
> >>>> keys must be signed by something in either the machine or the builtin. In
> >>>> this thread [1], Jarkko is saying CA based infrastructure should be a policy
> >>>> decision not to be enforced by the kernel. Wouldn’t this apply here as well?
> >>>>
> >>>> 1. https://lore.kernel.org/lkml/CVGUFUEQVCHS.37OA20PNG9EVB@suppilovahvero/
> >>>
> >>> Mickaël said, "This change is critical and should be tied to a
> >>> dedicated kernel config
> >>> (disabled by default), otherwise existing systems using this feature
> >>> will have their threat model automatically changed without notice."
> >>
> >> I was thinking he meant it is critical not to change the current behavior
> >> by limiting blacklisting to only CA keys. Not that it was critical to add
> >> CA enforcement. Maybe Mickaël can comment?
> >
> > I meant that applying this patch as-is may change the threat model used
> > by some users. Currently, only signed hashes vouched by the builtin
> > trusted keyring are valid. If we extend this mechanism to the secondary
> > trusted keyring without notice, this means that more certificates could
> > vouch blacklisted hashes, which may include some certificates with an
> > initial different usage.
> >
> > See commit 4da8f8c8a1e0 ("dm verity: Add support for signature
> > verification with 2nd keyring") that adds
> > CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING:
> > https://lore.kernel.org/all/[email protected]/
>
> Thanks for clarifying. I’ll add something similar in v2.
>
> >>
> >>> As a possible alternative I suggested limiting which file hashes the
> >>> certs on the secondary (or machine) keyring could blacklist.
> >>
> >> I’m not sure I completely understand your suggestion here.
> >> Do you mean, verify the CA bit is set for secondary keys, but
> >> ignore the bit for builtin? And then only use those keys to add
> >> hashes to the blacklist keyring? If I have that right, what would
> >> be the justification for the change based on how things currently
> >> get included in the blacklist keyring? Thanks.
> >
> > I'd like to be able to specify which kind of certificate can vouch for
> > blacklisting hashes, and for other usages, but AFAIK this is not the
> > path Linux has followed (e.g. unlike Windows). We only have the keyring
> > to identify an usage, which is unfortunate. On the other side, this
> > approach lets users manage their certificates without constraint, which
> > is quite (too?) flexible.
>
> Yes, it is very flexible. What I believe Mimi is after is having a way to
> track what cert actually vouched for each specific binary hash. But this
> information is not tracked, plus entries within it can come from various
> sources that are not signed (dbx, mokx, compiled in). Also key usage is
> being ignored.
>
> > A complementary approach would be to create an
> > LSM (or a dedicated interface) to tie certificate properties to a set of
> > kernel usages, while still letting users configure these constraints.
>
> That is an interesting idea. Would the other security maintainers be in
> support of such an approach? Would a LSM be the correct interface?
> Some of the recent work I have done with introducing key usage and CA
> enforcement is difficult for a distro to pick up, since these changes can be
> viewed as a regression. Each end-user has different signing procedures
> and policies, so making something work for everyone is difficult. Letting the
> user configure these constraints would solve this problem.
>
The initial subject was "Re: [PATCH] certs: Restrict blacklist updates
to the secondary trusted keyring":
https://lore.kernel.org/all/[email protected]/
On Thu, Sep 14, 2023 at 10:34:44AM +0200, Mickaël Salaün wrote:
> CCing the LSM mailing list for this potential new LSM proposal:
>
> On Wed, Sep 13, 2023 at 10:29:58PM +0000, Eric Snowberg wrote:
> >
> >
> > > On Sep 13, 2023, at 4:21 AM, Mickaël Salaün <[email protected]> wrote:
> > >
> > > On Wed, Sep 13, 2023 at 02:40:17AM +0000, Eric Snowberg wrote:
> > >>
> > >>
> > >>> On Sep 12, 2023, at 4:47 PM, Mimi Zohar <[email protected]> wrote:
> > >>>
> > >>> On Tue, 2023-09-12 at 17:11 +0000, Eric Snowberg wrote:
> > >>>>
> > >>>>> On Sep 12, 2023, at 5:54 AM, Mimi Zohar <[email protected]> wrote:
> > >>>>>
> > >>>>> On Tue, 2023-09-12 at 02:00 +0000, Eric Snowberg wrote:
> > >>>>>>
> > >>>>>>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar <[email protected]> wrote:
> > >>>>>>>
> > >>>>>>> On Mon, 2023-09-11 at 22:17 +0000, Eric Snowberg wrote:
> > >>>>>>>>
> > >>>>>>>>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün <[email protected]> wrote:
> > >>>>>>>>>
> > >>>>>>>>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote:
> > >>>>>>>>>> Hi Eric,
> > >>>>>>>>>>
> > >>>>>>>>>> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote:
> > >>>>>>>>>>> Currently root can dynamically update the blacklist keyring if the hash
> > >>>>>>>>>>> being added is signed and vouched for by the builtin trusted keyring.
> > >>>>>>>>>>> Currently keys in the secondary trusted keyring can not be used.
> > >>>>>>>>>>>
> > >>>>>>>>>>> Keys within the secondary trusted keyring carry the same capabilities as
> > >>>>>>>>>>> the builtin trusted keyring. Relax the current restriction for updating
> > >>>>>>>>>>> the .blacklist keyring and allow the secondary to also be referenced as
> > >>>>>>>>>>> a trust source. Since the machine keyring is linked to the secondary
> > >>>>>>>>>>> trusted keyring, any key within it may also be used.
> > >>>>>>>>>>>
> > >>>>>>>>>>> An example use case for this is IMA appraisal. Now that IMA both
> > >>>>>>>>>>> references the blacklist keyring and allows the machine owner to add
> > >>>>>>>>>>> custom IMA CA certs via the machine keyring, this adds the additional
> > >>>>>>>>>>> capability for the machine owner to also do revocations on a running
> > >>>>>>>>>>> system.
> > >>>>>>>>>>>
> > >>>>>>>>>>> IMA appraisal usage example to add a revocation for /usr/foo:
> > >>>>>>>>>>>
> > >>>>>>>>>>> sha256sum /bin/foo | awk '{printf "bin:" $1}' > hash.txt
> > >>>>>>>>>>>
> > >>>>>>>>>>> openssl smime -sign -in hash.txt -inkey machine-private-key.pem \
> > >>>>>>>>>>> -signer machine-certificate.pem -noattr -binary -outform DER \
> > >>>>>>>>>>> -out hash.p7s
> > >>>>>>>>>>>
> > >>>>>>>>>>> keyctl padd blacklist "$(< hash.txt)" %:.blacklist < hash.p7s
> > >>>>>>>>>>>
> > >>>>>>>>>>> Signed-off-by: Eric Snowberg <[email protected]>
> > >>>>>>>>>>
> > >>>>>>>>>> The secondary keyring may include both CA and code signing keys. With
> > >>>>>>>>>> this change any key loaded onto the secondary keyring may blacklist a
> > >>>>>>>>>> hash. Wouldn't it make more sense to limit blacklisting
> > >>>>>>>>>> certificates/hashes to at least CA keys?
> > >>>>>>>>>
> > >>>>>>>>> Some operational constraints may limit what a CA can sign.
> > >>>>>>>>
> > >>>>>>>> Agreed.
> > >>>>>>>>
> > >>>>>>>> Is there precedents for requiring this S/MIME to be signed by a CA?
> > >>>>>>>>
> > >>>>>>>>> This change is critical and should be tied to a dedicated kernel config
> > >>>>>>>>> (disabled by default), otherwise existing systems using this feature
> > >>>>>>>>> will have their threat model automatically changed without notice.
> > >>>>>>>>
> > >>>>>>>> Today we have INTEGRITY_CA_MACHINE_KEYRING_MAX. This can
> > >>>>>>>> be enabled to enforce CA restrictions on the machine keyring. Mimi, would
> > >>>>>>>> this be a suitable solution for what you are after?
> > >>>>>>>
> > >>>>>>> There needs to be some correlation between the file hashes being added
> > >>>>>>> to the blacklist and the certificate that signed them. Without that
> > >>>>>>> correlation, any key on the secondary trusted keyring could add any
> > >>>>>>> file hashes it wants to the blacklist.
> > >>>>>>
> > >>>>>> Today any key in the secondary trusted keyring can be used to validate a
> > >>>>>> signed kernel module. At a later time, if a new hash is added to the blacklist
> > >>>>>> keyring to revoke loading a signed kernel module, the ability to do the
> > >>>>>> revocation with this additional change would be more restrictive than loading
> > >>>>>> the original module.
> > >>>>>
> > >>>>> A public key on the secondary keyring is used to verify code that it
> > >>>>> signed, but does not impact any other code. Allowing any public key on
> > >>>>> the secondary keyring to blacklist any file hash is giving it more
> > >>>>> privileges than it originally had.
> > >>>>>
> > >>>>> This requirement isn't different than how Certificate Revocation List
> > >>>>> (CRL) work. Not any CA can revoke a certificate.
> > >>>>
> > >>>> In UEFI Secure Boot we have the Forbidden Signature Database (DBX).
> > >>>> Root can update the DBX on a host. The requirement placed on updating
> > >>>> it is the new DBX entry must be signed by any key contained within the
> > >>>> KEK. Following a reboot, all DBX entries load into the .blacklist keyring.
> > >>>> There is not a requirement similar to how CRL’s work here, any KEK key
> > >>>> can be used.
> > >>>>
> > >>>> With architectures booted through a shim there is the MOKX. Similar to
> > >>>> DBX, MOKX have the same capabilities, however they do not need to be
> > >>>> signed by any key, the machine owner must show they have physical
> > >>>> presence (and potentially a MOK password) for inclusion. Again there
> > >>>> is not a requirement similar to how CRL’s work here either. The machine
> > >>>> owner can decide what is included.
> > >>>>
> > >>>> Today when a kernel is built, any number of keys may be included within
> > >>>> the builtin trusted keyring. The keys included in the kernel may not have
> > >>>> a single usage field set or the CA bit set. There are no requirements on
> > >>>> how these keys get used later on. Any key in the builtin trusted keyring
> > >>>> can be used to sign a revocation that can be added to the blacklist keyring.
> > >>>> Additionally, any key in the MOK can be used to sign this kernel and it will
> > >>>> boot. Before booting the kernel, MOK keys have more privileges than
> > >>>> after the kernel is booted in some instances.
> > >>>>
> > >>>> Today MOK keys can be loaded into the machine keyring. These keys get
> > >>>> linked to the secondary trusted keyring. Currently key usage enforcement
> > >>>> is being applied to these keys behind some Kconfig options. By default
> > >>>> anything in the secondary has the same capabilities as the builtin trusted
> > >>>> keyring. What is challenging here with this request is the inconsistency
> > >>>> between how everything else currently works.
> > >>>>
> > >>>> Root can not arbitrarily add things to the secondary trusted keyring. These
> > >>>> keys must be signed by something in either the machine or the builtin. In
> > >>>> this thread [1], Jarkko is saying CA based infrastructure should be a policy
> > >>>> decision not to be enforced by the kernel. Wouldn’t this apply here as well?
> > >>>>
> > >>>> 1. https://lore.kernel.org/lkml/CVGUFUEQVCHS.37OA20PNG9EVB@suppilovahvero/
> > >>>
> > >>> Mickaël said, "This change is critical and should be tied to a
> > >>> dedicated kernel config
> > >>> (disabled by default), otherwise existing systems using this feature
> > >>> will have their threat model automatically changed without notice."
> > >>
> > >> I was thinking he meant it is critical not to change the current behavior
> > >> by limiting blacklisting to only CA keys. Not that it was critical to add
> > >> CA enforcement. Maybe Mickaël can comment?
> > >
> > > I meant that applying this patch as-is may change the threat model used
> > > by some users. Currently, only signed hashes vouched by the builtin
> > > trusted keyring are valid. If we extend this mechanism to the secondary
> > > trusted keyring without notice, this means that more certificates could
> > > vouch blacklisted hashes, which may include some certificates with an
> > > initial different usage.
> > >
> > > See commit 4da8f8c8a1e0 ("dm verity: Add support for signature
> > > verification with 2nd keyring") that adds
> > > CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING:
> > > https://lore.kernel.org/all/[email protected]/
> >
> > Thanks for clarifying. I’ll add something similar in v2.
> >
> > >>
> > >>> As a possible alternative I suggested limiting which file hashes the
> > >>> certs on the secondary (or machine) keyring could blacklist.
> > >>
> > >> I’m not sure I completely understand your suggestion here.
> > >> Do you mean, verify the CA bit is set for secondary keys, but
> > >> ignore the bit for builtin? And then only use those keys to add
> > >> hashes to the blacklist keyring? If I have that right, what would
> > >> be the justification for the change based on how things currently
> > >> get included in the blacklist keyring? Thanks.
> > >
> > > I'd like to be able to specify which kind of certificate can vouch for
> > > blacklisting hashes, and for other usages, but AFAIK this is not the
> > > path Linux has followed (e.g. unlike Windows). We only have the keyring
> > > to identify an usage, which is unfortunate. On the other side, this
> > > approach lets users manage their certificates without constraint, which
> > > is quite (too?) flexible.
> >
> > Yes, it is very flexible. What I believe Mimi is after is having a way to
> > track what cert actually vouched for each specific binary hash. But this
> > information is not tracked, plus entries within it can come from various
> > sources that are not signed (dbx, mokx, compiled in). Also key usage is
> > being ignored.
> >
> > > A complementary approach would be to create an
> > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > kernel usages, while still letting users configure these constraints.
> >
> > That is an interesting idea. Would the other security maintainers be in
> > support of such an approach? Would a LSM be the correct interface?
> > Some of the recent work I have done with introducing key usage and CA
> > enforcement is difficult for a distro to pick up, since these changes can be
> > viewed as a regression. Each end-user has different signing procedures
> > and policies, so making something work for everyone is difficult. Letting the
> > user configure these constraints would solve this problem.
> >
On Thu, Oct 5, 2023 at 6:32 AM Mickaël Salaün <[email protected]> wrote:
>
> The initial subject was "Re: [PATCH] certs: Restrict blacklist updates
> to the secondary trusted keyring":
> https://lore.kernel.org/all/[email protected]/
>
> On Thu, Sep 14, 2023 at 10:34:44AM +0200, Mickaël Salaün wrote:
> > CCing the LSM mailing list for this potential new LSM proposal:
> > On Wed, Sep 13, 2023 at 10:29:58PM +0000, Eric Snowberg wrote:
> > > > On Sep 13, 2023, at 4:21 AM, Mickaël Salaün <[email protected]> wrote:
> > > > On Wed, Sep 13, 2023 at 02:40:17AM +0000, Eric Snowberg wrote:
> > > >>> On Sep 12, 2023, at 4:47 PM, Mimi Zohar <[email protected]> wrote:
[Just a reminder that trimming massive emails to the relevant portions
is a nice thing to do]
> > > > A complementary approach would be to create an
> > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > kernel usages, while still letting users configure these constraints.
> > >
> > > That is an interesting idea. Would the other security maintainers be in
> > > support of such an approach? Would a LSM be the correct interface?
> > > Some of the recent work I have done with introducing key usage and CA
> > > enforcement is difficult for a distro to pick up, since these changes can be
> > > viewed as a regression. Each end-user has different signing procedures
> > > and policies, so making something work for everyone is difficult. Letting the
> > > user configure these constraints would solve this problem.
I can't say that I have been following this thread very closely, but I
see no reason why we wouldn't support a LSM that enforces access
controls on certificates/keys based on their attributes/properties.
We do have some LSM control points for the kernel keyring, which are
used by at least one LSM, but I'm sure you would probably need some
additional control points.
If you are interested in pursuing the creation of a new LSM, and
likely new LSM hooks, we do have some documented guidelines you should
keep in mind:
* https://github.com/LinuxSecurityModule/kernel/blob/main/README.md
--
paul-moore.com
On Thu, 2023-10-05 at 12:32 +0200, Micka?l Sala?n wrote:
> > > > A complementary approach would be to create an
> > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > kernel usages, while still letting users configure these constraints.
> > >
> > > That is an interesting idea. Would the other security maintainers be in
> > > support of such an approach? Would a LSM be the correct interface?
> > > Some of the recent work I have done with introducing key usage and CA
> > > enforcement is difficult for a distro to pick up, since these changes can be
> > > viewed as a regression. Each end-user has different signing procedures
> > > and policies, so making something work for everyone is difficult. Letting the
> > > user configure these constraints would solve this problem.
Something definitely needs to be done about controlling the usage of
x509 certificates. My concern is the level of granularity. Would this
be at the LSM hook level or even finer granaularity?
--
thanks,
Mimi
On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> > > > > A complementary approach would be to create an
> > > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > > kernel usages, while still letting users configure these constraints.
> > > >
> > > > That is an interesting idea. Would the other security maintainers be in
> > > > support of such an approach? Would a LSM be the correct interface?
> > > > Some of the recent work I have done with introducing key usage and CA
> > > > enforcement is difficult for a distro to pick up, since these changes can be
> > > > viewed as a regression. Each end-user has different signing procedures
> > > > and policies, so making something work for everyone is difficult. Letting the
> > > > user configure these constraints would solve this problem.
>
> Something definitely needs to be done about controlling the usage of
> x509 certificates. My concern is the level of granularity. Would this
> be at the LSM hook level or even finer granaularity?
You lost me, what do you mean by finer granularity than a LSM-based
access control? Can you give an existing example in the Linux kernel
of access control granularity that is finer grained than what is
provided by the LSMs?
--
paul-moore.com
On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> > On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> > > > > > A complementary approach would be to create an
> > > > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > > > kernel usages, while still letting users configure these constraints.
> > > > >
> > > > > That is an interesting idea. Would the other security maintainers be in
> > > > > support of such an approach? Would a LSM be the correct interface?
> > > > > Some of the recent work I have done with introducing key usage and CA
> > > > > enforcement is difficult for a distro to pick up, since these changes can be
> > > > > viewed as a regression. Each end-user has different signing procedures
> > > > > and policies, so making something work for everyone is difficult. Letting the
> > > > > user configure these constraints would solve this problem.
> >
> > Something definitely needs to be done about controlling the usage of
> > x509 certificates. My concern is the level of granularity. Would this
> > be at the LSM hook level or even finer granaularity?
>
> You lost me, what do you mean by finer granularity than a LSM-based
> access control? Can you give an existing example in the Linux kernel
> of access control granularity that is finer grained than what is
> provided by the LSMs?
The current x509 certificate access control granularity is at the
keyring level. Any key on the keyring may be used to verify a
signature. Finer granularity could associate a set of certificates on
a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
firmware, etc. Even finer granularity could somehow limit a key's
signature verification to files in particular software package(s) for
example.
Perhaps Mickaël and Eric were thinking about a new LSM to control usage
of x509 certificates from a totally different perspective. I'd like to
hear what they're thinking.
I hope this addressed your questions.
--
thanks,
Mimi
On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> > On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> > > On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> > > > > > > A complementary approach would be to create an
> > > > > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > > > > kernel usages, while still letting users configure these constraints.
> > > > > >
> > > > > > That is an interesting idea. Would the other security maintainers be in
> > > > > > support of such an approach? Would a LSM be the correct interface?
> > > > > > Some of the recent work I have done with introducing key usage and CA
> > > > > > enforcement is difficult for a distro to pick up, since these changes can be
> > > > > > viewed as a regression. Each end-user has different signing procedures
> > > > > > and policies, so making something work for everyone is difficult. Letting the
> > > > > > user configure these constraints would solve this problem.
> > >
> > > Something definitely needs to be done about controlling the usage of
> > > x509 certificates. My concern is the level of granularity. Would this
> > > be at the LSM hook level or even finer granaularity?
> >
> > You lost me, what do you mean by finer granularity than a LSM-based
> > access control? Can you give an existing example in the Linux kernel
> > of access control granularity that is finer grained than what is
> > provided by the LSMs?
>
> The current x509 certificate access control granularity is at the
> keyring level. Any key on the keyring may be used to verify a
> signature. Finer granularity could associate a set of certificates on
> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> firmware, etc. Even finer granularity could somehow limit a key's
> signature verification to files in particular software package(s) for
> example.
>
> Perhaps Mickaël and Eric were thinking about a new LSM to control usage
> of x509 certificates from a totally different perspective. I'd like to
> hear what they're thinking.
>
> I hope this addressed your questions.
Okay, so you were talking about finer granularity when compared to the
*current* LSM keyring hooks. Gotcha.
If we need additional, or modified, hooks that shouldn't be a problem.
Although I'm guessing the answer is going to be moving towards
purpose/operation specific keyrings which might fit in well with the
current keyring level controls.
--
paul-moore.com
On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
> On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
> > On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> > > On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> > > > On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> > > > > > > > A complementary approach would be to create an
> > > > > > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > > > > > kernel usages, while still letting users configure these constraints.
> > > > > > >
> > > > > > > That is an interesting idea. Would the other security maintainers be in
> > > > > > > support of such an approach? Would a LSM be the correct interface?
> > > > > > > Some of the recent work I have done with introducing key usage and CA
> > > > > > > enforcement is difficult for a distro to pick up, since these changes can be
> > > > > > > viewed as a regression. Each end-user has different signing procedures
> > > > > > > and policies, so making something work for everyone is difficult. Letting the
> > > > > > > user configure these constraints would solve this problem.
> > > >
> > > > Something definitely needs to be done about controlling the usage of
> > > > x509 certificates. My concern is the level of granularity. Would this
> > > > be at the LSM hook level or even finer granaularity?
> > >
> > > You lost me, what do you mean by finer granularity than a LSM-based
> > > access control? Can you give an existing example in the Linux kernel
> > > of access control granularity that is finer grained than what is
> > > provided by the LSMs?
> >
> > The current x509 certificate access control granularity is at the
> > keyring level. Any key on the keyring may be used to verify a
> > signature. Finer granularity could associate a set of certificates on
> > a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> > firmware, etc. Even finer granularity could somehow limit a key's
> > signature verification to files in particular software package(s) for
> > example.
> >
> > Perhaps Mickaël and Eric were thinking about a new LSM to control usage
> > of x509 certificates from a totally different perspective. I'd like to
> > hear what they're thinking.
> >
> > I hope this addressed your questions.
>
> Okay, so you were talking about finer granularity when compared to the
> *current* LSM keyring hooks. Gotcha.
>
> If we need additional, or modified, hooks that shouldn't be a problem.
> Although I'm guessing the answer is going to be moving towards
> purpose/operation specific keyrings which might fit in well with the
> current keyring level controls.
I don't believe defining per purpose/operation specific keyrings will
resolve the underlying problem of granularity. For example, different
applications could be signed with different keys and should only be
verified with the specific key.
--
thanks,
Mimi
On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
> On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
> > On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
> > > On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> > > > On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> > > > > On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> > > > > > > > > A complementary approach would be to create an
> > > > > > > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > > > > > > kernel usages, while still letting users configure these constraints.
> > > > > > > >
> > > > > > > > That is an interesting idea. Would the other security maintainers be in
> > > > > > > > support of such an approach? Would a LSM be the correct interface?
> > > > > > > > Some of the recent work I have done with introducing key usage and CA
> > > > > > > > enforcement is difficult for a distro to pick up, since these changes can be
> > > > > > > > viewed as a regression. Each end-user has different signing procedures
> > > > > > > > and policies, so making something work for everyone is difficult. Letting the
> > > > > > > > user configure these constraints would solve this problem.
> > > > >
> > > > > Something definitely needs to be done about controlling the usage of
> > > > > x509 certificates. My concern is the level of granularity. Would this
> > > > > be at the LSM hook level or even finer granaularity?
> > > >
> > > > You lost me, what do you mean by finer granularity than a LSM-based
> > > > access control? Can you give an existing example in the Linux kernel
> > > > of access control granularity that is finer grained than what is
> > > > provided by the LSMs?
> > >
> > > The current x509 certificate access control granularity is at the
> > > keyring level. Any key on the keyring may be used to verify a
> > > signature. Finer granularity could associate a set of certificates on
> > > a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> > > firmware, etc. Even finer granularity could somehow limit a key's
> > > signature verification to files in particular software package(s) for
> > > example.
> > >
> > > Perhaps Mickaël and Eric were thinking about a new LSM to control usage
> > > of x509 certificates from a totally different perspective. I'd like to
> > > hear what they're thinking.
> > >
> > > I hope this addressed your questions.
> >
> > Okay, so you were talking about finer granularity when compared to the
> > *current* LSM keyring hooks. Gotcha.
> >
> > If we need additional, or modified, hooks that shouldn't be a problem.
> > Although I'm guessing the answer is going to be moving towards
> > purpose/operation specific keyrings which might fit in well with the
> > current keyring level controls.
>
> I don't believe defining per purpose/operation specific keyrings will
> resolve the underlying problem of granularity.
Perhaps not completely, but for in-kernel operations I believe it is
an attractive idea.
--
paul-moore.com
> On Oct 17, 2023, at 12:51 PM, Paul Moore <[email protected]> wrote:
>
> On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
>> On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
>>> On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
>>>> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
>>>>> On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
>>>>>> On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
>>>>>>>>>> A complementary approach would be to create an
>>>>>>>>>> LSM (or a dedicated interface) to tie certificate properties to a set of
>>>>>>>>>> kernel usages, while still letting users configure these constraints.
>>>>>>>>>
>>>>>>>>> That is an interesting idea. Would the other security maintainers be in
>>>>>>>>> support of such an approach? Would a LSM be the correct interface?
>>>>>>>>> Some of the recent work I have done with introducing key usage and CA
>>>>>>>>> enforcement is difficult for a distro to pick up, since these changes can be
>>>>>>>>> viewed as a regression. Each end-user has different signing procedures
>>>>>>>>> and policies, so making something work for everyone is difficult. Letting the
>>>>>>>>> user configure these constraints would solve this problem.
>>>>>>
>>>>>> Something definitely needs to be done about controlling the usage of
>>>>>> x509 certificates. My concern is the level of granularity. Would this
>>>>>> be at the LSM hook level or even finer granaularity?
>>>>>
>>>>> You lost me, what do you mean by finer granularity than a LSM-based
>>>>> access control? Can you give an existing example in the Linux kernel
>>>>> of access control granularity that is finer grained than what is
>>>>> provided by the LSMs?
>>>>
>>>> The current x509 certificate access control granularity is at the
>>>> keyring level. Any key on the keyring may be used to verify a
>>>> signature. Finer granularity could associate a set of certificates on
>>>> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
>>>> firmware, etc. Even finer granularity could somehow limit a key's
>>>> signature verification to files in particular software package(s) for
>>>> example.
>>>>
>>>> Perhaps Mickaël and Eric were thinking about a new LSM to control usage
>>>> of x509 certificates from a totally different perspective. I'd like to
>>>> hear what they're thinking.
>>>>
>>>> I hope this addressed your questions.
>>>
>>> Okay, so you were talking about finer granularity when compared to the
>>> *current* LSM keyring hooks. Gotcha.
>>>
>>> If we need additional, or modified, hooks that shouldn't be a problem.
>>> Although I'm guessing the answer is going to be moving towards
>>> purpose/operation specific keyrings which might fit in well with the
>>> current keyring level controls.
>>
>> I don't believe defining per purpose/operation specific keyrings will
>> resolve the underlying problem of granularity.
>
> Perhaps not completely, but for in-kernel operations I believe it is
> an attractive idea.
Could the X.509 Extended Key Usage (EKU) extension [1], be used here?
Various OIDs would need to be defined or assigned for each purpose.
Once assigned, the kernel could parse this information and do the
enforcement. Then all keys could continue to remain in the .builtin,
.secondary, and .machine keyrings. Only a subset of each keyring
would be used for verification based on what is contained in the EKU.
1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12
On Tue, Oct 17, 2023 at 07:34:25PM +0000, Eric Snowberg wrote:
>
>
> > On Oct 17, 2023, at 12:51 PM, Paul Moore <[email protected]> wrote:
> >
> > On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
> >> On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
> >>> On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
> >>>> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> >>>>> On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> >>>>>> On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> >>>>>>>>>> A complementary approach would be to create an
> >>>>>>>>>> LSM (or a dedicated interface) to tie certificate properties to a set of
> >>>>>>>>>> kernel usages, while still letting users configure these constraints.
> >>>>>>>>>
> >>>>>>>>> That is an interesting idea. Would the other security maintainers be in
> >>>>>>>>> support of such an approach? Would a LSM be the correct interface?
> >>>>>>>>> Some of the recent work I have done with introducing key usage and CA
> >>>>>>>>> enforcement is difficult for a distro to pick up, since these changes can be
> >>>>>>>>> viewed as a regression. Each end-user has different signing procedures
> >>>>>>>>> and policies, so making something work for everyone is difficult. Letting the
> >>>>>>>>> user configure these constraints would solve this problem.
> >>>>>>
> >>>>>> Something definitely needs to be done about controlling the usage of
> >>>>>> x509 certificates. My concern is the level of granularity. Would this
> >>>>>> be at the LSM hook level or even finer granaularity?
> >>>>>
> >>>>> You lost me, what do you mean by finer granularity than a LSM-based
> >>>>> access control? Can you give an existing example in the Linux kernel
> >>>>> of access control granularity that is finer grained than what is
> >>>>> provided by the LSMs?
> >>>>
> >>>> The current x509 certificate access control granularity is at the
> >>>> keyring level. Any key on the keyring may be used to verify a
> >>>> signature. Finer granularity could associate a set of certificates on
> >>>> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> >>>> firmware, etc. Even finer granularity could somehow limit a key's
> >>>> signature verification to files in particular software package(s) for
> >>>> example.
> >>>>
> >>>> Perhaps Mickaël and Eric were thinking about a new LSM to control usage
> >>>> of x509 certificates from a totally different perspective. I'd like to
> >>>> hear what they're thinking.
> >>>>
> >>>> I hope this addressed your questions.
> >>>
> >>> Okay, so you were talking about finer granularity when compared to the
> >>> *current* LSM keyring hooks. Gotcha.
> >>>
> >>> If we need additional, or modified, hooks that shouldn't be a problem.
> >>> Although I'm guessing the answer is going to be moving towards
> >>> purpose/operation specific keyrings which might fit in well with the
> >>> current keyring level controls.
> >>
> >> I don't believe defining per purpose/operation specific keyrings will
> >> resolve the underlying problem of granularity.
> >
> > Perhaps not completely, but for in-kernel operations I believe it is
> > an attractive idea.
>
> Could the X.509 Extended Key Usage (EKU) extension [1], be used here?
> Various OIDs would need to be defined or assigned for each purpose.
> Once assigned, the kernel could parse this information and do the
> enforcement. Then all keys could continue to remain in the .builtin,
> .secondary, and .machine keyrings. Only a subset of each keyring
> would be used for verification based on what is contained in the EKU.
>
> 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12
I was also thinking about this kind of use cases. Because it might be
difficult in practice to control all certificate properties, we might
want to let sysadmins configure these subset of keyring according to
various certificate properties. There are currently LSM hooks to control
interactions with kernel keys by user space, and keys are already tied
to LSM blobs. New LSM hooks could be added to dynamically filter
keyrings according to kernel usages (e.g. kernel module verification, a
subset of an authentication mechanism according to the checked object).
> On Oct 18, 2023, at 8:14 AM, Mickaël Salaün <[email protected]> wrote:
>
> On Tue, Oct 17, 2023 at 07:34:25PM +0000, Eric Snowberg wrote:
>>
>>
>>> On Oct 17, 2023, at 12:51 PM, Paul Moore <[email protected]> wrote:
>>>
>>> On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
>>>> On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
>>>>> On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
>>>>>> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
>>>>>>> On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
>>>>>>>> On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
>>>>>>>>>>>> A complementary approach would be to create an
>>>>>>>>>>>> LSM (or a dedicated interface) to tie certificate properties to a set of
>>>>>>>>>>>> kernel usages, while still letting users configure these constraints.
>>>>>>>>>>>
>>>>>>>>>>> That is an interesting idea. Would the other security maintainers be in
>>>>>>>>>>> support of such an approach? Would a LSM be the correct interface?
>>>>>>>>>>> Some of the recent work I have done with introducing key usage and CA
>>>>>>>>>>> enforcement is difficult for a distro to pick up, since these changes can be
>>>>>>>>>>> viewed as a regression. Each end-user has different signing procedures
>>>>>>>>>>> and policies, so making something work for everyone is difficult. Letting the
>>>>>>>>>>> user configure these constraints would solve this problem.
>>>>>>>>
>>>>>>>> Something definitely needs to be done about controlling the usage of
>>>>>>>> x509 certificates. My concern is the level of granularity. Would this
>>>>>>>> be at the LSM hook level or even finer granaularity?
>>>>>>>
>>>>>>> You lost me, what do you mean by finer granularity than a LSM-based
>>>>>>> access control? Can you give an existing example in the Linux kernel
>>>>>>> of access control granularity that is finer grained than what is
>>>>>>> provided by the LSMs?
>>>>>>
>>>>>> The current x509 certificate access control granularity is at the
>>>>>> keyring level. Any key on the keyring may be used to verify a
>>>>>> signature. Finer granularity could associate a set of certificates on
>>>>>> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
>>>>>> firmware, etc. Even finer granularity could somehow limit a key's
>>>>>> signature verification to files in particular software package(s) for
>>>>>> example.
>>>>>>
>>>>>> Perhaps Mickaël and Eric were thinking about a new LSM to control usage
>>>>>> of x509 certificates from a totally different perspective. I'd like to
>>>>>> hear what they're thinking.
>>>>>>
>>>>>> I hope this addressed your questions.
>>>>>
>>>>> Okay, so you were talking about finer granularity when compared to the
>>>>> *current* LSM keyring hooks. Gotcha.
>>>>>
>>>>> If we need additional, or modified, hooks that shouldn't be a problem.
>>>>> Although I'm guessing the answer is going to be moving towards
>>>>> purpose/operation specific keyrings which might fit in well with the
>>>>> current keyring level controls.
>>>>
>>>> I don't believe defining per purpose/operation specific keyrings will
>>>> resolve the underlying problem of granularity.
>>>
>>> Perhaps not completely, but for in-kernel operations I believe it is
>>> an attractive idea.
>>
>> Could the X.509 Extended Key Usage (EKU) extension [1], be used here?
>> Various OIDs would need to be defined or assigned for each purpose.
>> Once assigned, the kernel could parse this information and do the
>> enforcement. Then all keys could continue to remain in the .builtin,
>> .secondary, and .machine keyrings. Only a subset of each keyring
>> would be used for verification based on what is contained in the EKU.
>>
>> 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12
>
> I was also thinking about this kind of use cases. Because it might be
> difficult in practice to control all certificate properties, we might
> want to let sysadmins configure these subset of keyring according to
> various certificate properties.
I agree, a configuration component for a sysadmin would be needed.
> There are currently LSM hooks to control
> interactions with kernel keys by user space, and keys are already tied
> to LSM blobs. New LSM hooks could be added to dynamically filter
> keyrings according to kernel usages (e.g. kernel module verification, a
> subset of an authentication mechanism according to the checked object).
If an LSM hook could dynamically filter keyrings, and the EKU was used,
is there an opinion on how flexible this should be? Meaning, should there
be OIDs defined and carried in mainline code? This would make it easier
to setup and use. However who would be the initial OID owner? Or would
predefined OIDs not be contained within mainline code, leaving it to the
sysadmin to create a policy that would be fed to the LSM to do the filtering.
On Wed, Oct 18, 2023 at 11:12:45PM +0000, Eric Snowberg wrote:
>
>
> > On Oct 18, 2023, at 8:14 AM, Mickaël Salaün <[email protected]> wrote:
> >
> > On Tue, Oct 17, 2023 at 07:34:25PM +0000, Eric Snowberg wrote:
> >>
> >>
> >>> On Oct 17, 2023, at 12:51 PM, Paul Moore <[email protected]> wrote:
> >>>
> >>> On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
> >>>> On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
> >>>>> On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
> >>>>>> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> >>>>>>> On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> >>>>>>>> On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> >>>>>>>>>>>> A complementary approach would be to create an
> >>>>>>>>>>>> LSM (or a dedicated interface) to tie certificate properties to a set of
> >>>>>>>>>>>> kernel usages, while still letting users configure these constraints.
> >>>>>>>>>>>
> >>>>>>>>>>> That is an interesting idea. Would the other security maintainers be in
> >>>>>>>>>>> support of such an approach? Would a LSM be the correct interface?
> >>>>>>>>>>> Some of the recent work I have done with introducing key usage and CA
> >>>>>>>>>>> enforcement is difficult for a distro to pick up, since these changes can be
> >>>>>>>>>>> viewed as a regression. Each end-user has different signing procedures
> >>>>>>>>>>> and policies, so making something work for everyone is difficult. Letting the
> >>>>>>>>>>> user configure these constraints would solve this problem.
> >>>>>>>>
> >>>>>>>> Something definitely needs to be done about controlling the usage of
> >>>>>>>> x509 certificates. My concern is the level of granularity. Would this
> >>>>>>>> be at the LSM hook level or even finer granaularity?
> >>>>>>>
> >>>>>>> You lost me, what do you mean by finer granularity than a LSM-based
> >>>>>>> access control? Can you give an existing example in the Linux kernel
> >>>>>>> of access control granularity that is finer grained than what is
> >>>>>>> provided by the LSMs?
> >>>>>>
> >>>>>> The current x509 certificate access control granularity is at the
> >>>>>> keyring level. Any key on the keyring may be used to verify a
> >>>>>> signature. Finer granularity could associate a set of certificates on
> >>>>>> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> >>>>>> firmware, etc. Even finer granularity could somehow limit a key's
> >>>>>> signature verification to files in particular software package(s) for
> >>>>>> example.
> >>>>>>
> >>>>>> Perhaps Mickaël and Eric were thinking about a new LSM to control usage
> >>>>>> of x509 certificates from a totally different perspective. I'd like to
> >>>>>> hear what they're thinking.
> >>>>>>
> >>>>>> I hope this addressed your questions.
> >>>>>
> >>>>> Okay, so you were talking about finer granularity when compared to the
> >>>>> *current* LSM keyring hooks. Gotcha.
> >>>>>
> >>>>> If we need additional, or modified, hooks that shouldn't be a problem.
> >>>>> Although I'm guessing the answer is going to be moving towards
> >>>>> purpose/operation specific keyrings which might fit in well with the
> >>>>> current keyring level controls.
> >>>>
> >>>> I don't believe defining per purpose/operation specific keyrings will
> >>>> resolve the underlying problem of granularity.
> >>>
> >>> Perhaps not completely, but for in-kernel operations I believe it is
> >>> an attractive idea.
> >>
> >> Could the X.509 Extended Key Usage (EKU) extension [1], be used here?
> >> Various OIDs would need to be defined or assigned for each purpose.
> >> Once assigned, the kernel could parse this information and do the
> >> enforcement. Then all keys could continue to remain in the .builtin,
> >> .secondary, and .machine keyrings. Only a subset of each keyring
> >> would be used for verification based on what is contained in the EKU.
> >>
> >> 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12
> >
> > I was also thinking about this kind of use cases. Because it might be
> > difficult in practice to control all certificate properties, we might
> > want to let sysadmins configure these subset of keyring according to
> > various certificate properties.
>
> I agree, a configuration component for a sysadmin would be needed.
>
> > There are currently LSM hooks to control
> > interactions with kernel keys by user space, and keys are already tied
> > to LSM blobs. New LSM hooks could be added to dynamically filter
> > keyrings according to kernel usages (e.g. kernel module verification, a
> > subset of an authentication mechanism according to the checked object).
>
> If an LSM hook could dynamically filter keyrings, and the EKU was used,
> is there an opinion on how flexible this should be? Meaning, should there
> be OIDs defined and carried in mainline code? This would make it easier
> to setup and use. However who would be the initial OID owner? Or would
> predefined OIDs not be contained within mainline code, leaving it to the
> sysadmin to create a policy that would be fed to the LSM to do the filtering.
The more flexible approach would be to not hardcode any policy in the
kernel but let sysadmins define their own, including OIDs. We "just"
need to find an adequate configuration scheme to define these
constraints. We already have an ASN.1 parser in the kernel, so we might
want to leverage that to match a certificate. Another option would be to
rely on an eBPF program to filter certificates but I'm not sure how
complex it could get. Maybe exposing the ASN.1 parser to eBPF? :)
> On Oct 19, 2023, at 3:12 AM, Mickaël Salaün <[email protected]> wrote:
>
> On Wed, Oct 18, 2023 at 11:12:45PM +0000, Eric Snowberg wrote:
>>
>>
>>> On Oct 18, 2023, at 8:14 AM, Mickaël Salaün <[email protected]> wrote:
>>>
>>> On Tue, Oct 17, 2023 at 07:34:25PM +0000, Eric Snowberg wrote:
>>>>
>>>>
>>>>> On Oct 17, 2023, at 12:51 PM, Paul Moore <[email protected]> wrote:
>>>>>
>>>>> On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
>>>>>> On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
>>>>>>> On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
>>>>>>>> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
>>>>>>>>> On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
>>>>>>>>>> On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
>>>>>>>>>>>>>> A complementary approach would be to create an
>>>>>>>>>>>>>> LSM (or a dedicated interface) to tie certificate properties to a set of
>>>>>>>>>>>>>> kernel usages, while still letting users configure these constraints.
>>>>>>>>>>>>>
>>>>>>>>>>>>> That is an interesting idea. Would the other security maintainers be in
>>>>>>>>>>>>> support of such an approach? Would a LSM be the correct interface?
>>>>>>>>>>>>> Some of the recent work I have done with introducing key usage and CA
>>>>>>>>>>>>> enforcement is difficult for a distro to pick up, since these changes can be
>>>>>>>>>>>>> viewed as a regression. Each end-user has different signing procedures
>>>>>>>>>>>>> and policies, so making something work for everyone is difficult. Letting the
>>>>>>>>>>>>> user configure these constraints would solve this problem.
>>>>>>>>>>
>>>>>>>>>> Something definitely needs to be done about controlling the usage of
>>>>>>>>>> x509 certificates. My concern is the level of granularity. Would this
>>>>>>>>>> be at the LSM hook level or even finer granaularity?
>>>>>>>>>
>>>>>>>>> You lost me, what do you mean by finer granularity than a LSM-based
>>>>>>>>> access control? Can you give an existing example in the Linux kernel
>>>>>>>>> of access control granularity that is finer grained than what is
>>>>>>>>> provided by the LSMs?
>>>>>>>>
>>>>>>>> The current x509 certificate access control granularity is at the
>>>>>>>> keyring level. Any key on the keyring may be used to verify a
>>>>>>>> signature. Finer granularity could associate a set of certificates on
>>>>>>>> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
>>>>>>>> firmware, etc. Even finer granularity could somehow limit a key's
>>>>>>>> signature verification to files in particular software package(s) for
>>>>>>>> example.
>>>>>>>>
>>>>>>>> Perhaps Mickaël and Eric were thinking about a new LSM to control usage
>>>>>>>> of x509 certificates from a totally different perspective. I'd like to
>>>>>>>> hear what they're thinking.
>>>>>>>>
>>>>>>>> I hope this addressed your questions.
>>>>>>>
>>>>>>> Okay, so you were talking about finer granularity when compared to the
>>>>>>> *current* LSM keyring hooks. Gotcha.
>>>>>>>
>>>>>>> If we need additional, or modified, hooks that shouldn't be a problem.
>>>>>>> Although I'm guessing the answer is going to be moving towards
>>>>>>> purpose/operation specific keyrings which might fit in well with the
>>>>>>> current keyring level controls.
>>>>>>
>>>>>> I don't believe defining per purpose/operation specific keyrings will
>>>>>> resolve the underlying problem of granularity.
>>>>>
>>>>> Perhaps not completely, but for in-kernel operations I believe it is
>>>>> an attractive idea.
>>>>
>>>> Could the X.509 Extended Key Usage (EKU) extension [1], be used here?
>>>> Various OIDs would need to be defined or assigned for each purpose.
>>>> Once assigned, the kernel could parse this information and do the
>>>> enforcement. Then all keys could continue to remain in the .builtin,
>>>> .secondary, and .machine keyrings. Only a subset of each keyring
>>>> would be used for verification based on what is contained in the EKU.
>>>>
>>>> 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12
>>>
>>> I was also thinking about this kind of use cases. Because it might be
>>> difficult in practice to control all certificate properties, we might
>>> want to let sysadmins configure these subset of keyring according to
>>> various certificate properties.
>>
>> I agree, a configuration component for a sysadmin would be needed.
>>
>>> There are currently LSM hooks to control
>>> interactions with kernel keys by user space, and keys are already tied
>>> to LSM blobs. New LSM hooks could be added to dynamically filter
>>> keyrings according to kernel usages (e.g. kernel module verification, a
>>> subset of an authentication mechanism according to the checked object).
>>
>> If an LSM hook could dynamically filter keyrings, and the EKU was used,
>> is there an opinion on how flexible this should be? Meaning, should there
>> be OIDs defined and carried in mainline code? This would make it easier
>> to setup and use. However who would be the initial OID owner? Or would
>> predefined OIDs not be contained within mainline code, leaving it to the
>> sysadmin to create a policy that would be fed to the LSM to do the filtering.
>
> The more flexible approach would be to not hardcode any policy in the
> kernel but let sysadmins define their own, including OIDs. We "just"
> need to find an adequate configuration scheme to define these
> constraints.
Also, with the flexible approach, the policy would need to be given to the
kernel before any kernel module loads, fs-verity starts, or anything dealing
with digital signature based IMA runs, etc. With hardcoded policies this
could be setup from the kernel command line or be set from a Kconfig.
I assume with a flexible approach, this would need to come in early within
the initram?
> We already have an ASN.1 parser in the kernel, so we might
> want to leverage that to match a certificate.
We have the parser, however after parsing the certificate we do not
retain all the information within it. Some of the recent changes I have
done required modifications to the public_key struct. If there isn’t any
type of hard coded policy, what would be the reception of retaining the
entire cert within the kernel?
On Thu, Oct 19, 2023 at 11:08:38PM +0000, Eric Snowberg wrote:
>
>
> > On Oct 19, 2023, at 3:12 AM, Mickaël Salaün <[email protected]> wrote:
> >
> > On Wed, Oct 18, 2023 at 11:12:45PM +0000, Eric Snowberg wrote:
> >>
> >>
> >>> On Oct 18, 2023, at 8:14 AM, Mickaël Salaün <[email protected]> wrote:
> >>>
> >>> On Tue, Oct 17, 2023 at 07:34:25PM +0000, Eric Snowberg wrote:
> >>>>
> >>>>
> >>>>> On Oct 17, 2023, at 12:51 PM, Paul Moore <[email protected]> wrote:
> >>>>>
> >>>>> On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
> >>>>>> On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
> >>>>>>> On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
> >>>>>>>> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> >>>>>>>>> On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> >>>>>>>>>> On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> >>>>>>>>>>>>>> A complementary approach would be to create an
> >>>>>>>>>>>>>> LSM (or a dedicated interface) to tie certificate properties to a set of
> >>>>>>>>>>>>>> kernel usages, while still letting users configure these constraints.
> >>>>>>>>>>>>>
> >>>>>>>>>>>>> That is an interesting idea. Would the other security maintainers be in
> >>>>>>>>>>>>> support of such an approach? Would a LSM be the correct interface?
> >>>>>>>>>>>>> Some of the recent work I have done with introducing key usage and CA
> >>>>>>>>>>>>> enforcement is difficult for a distro to pick up, since these changes can be
> >>>>>>>>>>>>> viewed as a regression. Each end-user has different signing procedures
> >>>>>>>>>>>>> and policies, so making something work for everyone is difficult. Letting the
> >>>>>>>>>>>>> user configure these constraints would solve this problem.
> >>>>>>>>>>
> >>>>>>>>>> Something definitely needs to be done about controlling the usage of
> >>>>>>>>>> x509 certificates. My concern is the level of granularity. Would this
> >>>>>>>>>> be at the LSM hook level or even finer granaularity?
> >>>>>>>>>
> >>>>>>>>> You lost me, what do you mean by finer granularity than a LSM-based
> >>>>>>>>> access control? Can you give an existing example in the Linux kernel
> >>>>>>>>> of access control granularity that is finer grained than what is
> >>>>>>>>> provided by the LSMs?
> >>>>>>>>
> >>>>>>>> The current x509 certificate access control granularity is at the
> >>>>>>>> keyring level. Any key on the keyring may be used to verify a
> >>>>>>>> signature. Finer granularity could associate a set of certificates on
> >>>>>>>> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> >>>>>>>> firmware, etc. Even finer granularity could somehow limit a key's
> >>>>>>>> signature verification to files in particular software package(s) for
> >>>>>>>> example.
> >>>>>>>>
> >>>>>>>> Perhaps Mickaël and Eric were thinking about a new LSM to control usage
> >>>>>>>> of x509 certificates from a totally different perspective. I'd like to
> >>>>>>>> hear what they're thinking.
> >>>>>>>>
> >>>>>>>> I hope this addressed your questions.
> >>>>>>>
> >>>>>>> Okay, so you were talking about finer granularity when compared to the
> >>>>>>> *current* LSM keyring hooks. Gotcha.
> >>>>>>>
> >>>>>>> If we need additional, or modified, hooks that shouldn't be a problem.
> >>>>>>> Although I'm guessing the answer is going to be moving towards
> >>>>>>> purpose/operation specific keyrings which might fit in well with the
> >>>>>>> current keyring level controls.
> >>>>>>
> >>>>>> I don't believe defining per purpose/operation specific keyrings will
> >>>>>> resolve the underlying problem of granularity.
> >>>>>
> >>>>> Perhaps not completely, but for in-kernel operations I believe it is
> >>>>> an attractive idea.
> >>>>
> >>>> Could the X.509 Extended Key Usage (EKU) extension [1], be used here?
> >>>> Various OIDs would need to be defined or assigned for each purpose.
> >>>> Once assigned, the kernel could parse this information and do the
> >>>> enforcement. Then all keys could continue to remain in the .builtin,
> >>>> .secondary, and .machine keyrings. Only a subset of each keyring
> >>>> would be used for verification based on what is contained in the EKU.
> >>>>
> >>>> 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12
> >>>
> >>> I was also thinking about this kind of use cases. Because it might be
> >>> difficult in practice to control all certificate properties, we might
> >>> want to let sysadmins configure these subset of keyring according to
> >>> various certificate properties.
> >>
> >> I agree, a configuration component for a sysadmin would be needed.
> >>
> >>> There are currently LSM hooks to control
> >>> interactions with kernel keys by user space, and keys are already tied
> >>> to LSM blobs. New LSM hooks could be added to dynamically filter
> >>> keyrings according to kernel usages (e.g. kernel module verification, a
> >>> subset of an authentication mechanism according to the checked object).
> >>
> >> If an LSM hook could dynamically filter keyrings, and the EKU was used,
> >> is there an opinion on how flexible this should be? Meaning, should there
> >> be OIDs defined and carried in mainline code? This would make it easier
> >> to setup and use. However who would be the initial OID owner? Or would
> >> predefined OIDs not be contained within mainline code, leaving it to the
> >> sysadmin to create a policy that would be fed to the LSM to do the filtering.
> >
> > The more flexible approach would be to not hardcode any policy in the
> > kernel but let sysadmins define their own, including OIDs. We "just"
> > need to find an adequate configuration scheme to define these
> > constraints.
>
> Also, with the flexible approach, the policy would need to be given to the
> kernel before any kernel module loads, fs-verity starts, or anything dealing
> with digital signature based IMA runs, etc. With hardcoded policies this
> could be setup from the kernel command line or be set from a Kconfig.
> I assume with a flexible approach, this would need to come in early within
> the initram?
Yes, either the cmdline and/or the initramfs.
>
> > We already have an ASN.1 parser in the kernel, so we might
> > want to leverage that to match a certificate.
>
> We have the parser, however after parsing the certificate we do not
> retain all the information within it. Some of the recent changes I have
> done required modifications to the public_key struct. If there isn’t any
> type of hard coded policy, what would be the reception of retaining the
> entire cert within the kernel?
I think it would make sense to have a default policy loaded at boot
time, then load and take into account new pieces of policies at run
time, but only parse/tag/assign a role to certificates/keys when they
are loaded.
On Fri, 2023-10-20 at 17:05 +0200, Mickaël Salaün wrote:
> On Thu, Oct 19, 2023 at 11:08:38PM +0000, Eric Snowberg wrote:
> >
> >
> > > On Oct 19, 2023, at 3:12 AM, Mickaël Salaün <[email protected]> wrote:
> > >
> > > On Wed, Oct 18, 2023 at 11:12:45PM +0000, Eric Snowberg wrote:
> > > >
> > > >
> > > > > On Oct 18, 2023, at 8:14 AM, Mickaël Salaün <[email protected]> wrote:
> > > > >
> > > > > On Tue, Oct 17, 2023 at 07:34:25PM +0000, Eric Snowberg wrote:
> > > > > >
> > > > > >
> > > > > > > On Oct 17, 2023, at 12:51 PM, Paul Moore <[email protected]> wrote:
> > > > > > >
> > > > > > > On Tue, Oct 17, 2023 at 1:59 PM Mimi Zohar <[email protected]> wrote:
> > > > > > > > On Tue, 2023-10-17 at 13:29 -0400, Paul Moore wrote:
> > > > > > > > > On Tue, Oct 17, 2023 at 1:09 PM Mimi Zohar <[email protected]> wrote:
> > > > > > > > > > On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> > > > > > > > > > > On Tue, Oct 17, 2023 at 9:48 AM Mimi Zohar <[email protected]> wrote:
> > > > > > > > > > > > On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote:
> > > > > > > > > > > > > > > > A complementary approach would be to create an
> > > > > > > > > > > > > > > > LSM (or a dedicated interface) to tie certificate properties to a set of
> > > > > > > > > > > > > > > > kernel usages, while still letting users configure these constraints.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > That is an interesting idea. Would the other security maintainers be in
> > > > > > > > > > > > > > > support of such an approach? Would a LSM be the correct interface?
> > > > > > > > > > > > > > > Some of the recent work I have done with introducing key usage and CA
> > > > > > > > > > > > > > > enforcement is difficult for a distro to pick up, since these changes can be
> > > > > > > > > > > > > > > viewed as a regression. Each end-user has different signing procedures
> > > > > > > > > > > > > > > and policies, so making something work for everyone is difficult. Letting the
> > > > > > > > > > > > > > > user configure these constraints would solve this problem.
> > > > > > > > > > > >
> > > > > > > > > > > > Something definitely needs to be done about controlling the usage of
> > > > > > > > > > > > x509 certificates. My concern is the level of granularity. Would this
> > > > > > > > > > > > be at the LSM hook level or even finer granaularity?
> > > > > > > > > > >
> > > > > > > > > > > You lost me, what do you mean by finer granularity than a LSM-based
> > > > > > > > > > > access control? Can you give an existing example in the Linux kernel
> > > > > > > > > > > of access control granularity that is finer grained than what is
> > > > > > > > > > > provided by the LSMs?
> > > > > > > > > >
> > > > > > > > > > The current x509 certificate access control granularity is at the
> > > > > > > > > > keyring level. Any key on the keyring may be used to verify a
> > > > > > > > > > signature. Finer granularity could associate a set of certificates on
> > > > > > > > > > a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> > > > > > > > > > firmware, etc. Even finer granularity could somehow limit a key's
> > > > > > > > > > signature verification to files in particular software package(s) for
> > > > > > > > > > example.
> > > > > > > > > >
> > > > > > > > > > Perhaps Mickaël and Eric were thinking about a new LSM to control usage
> > > > > > > > > > of x509 certificates from a totally different perspective. I'd like to
> > > > > > > > > > hear what they're thinking.
> > > > > > > > > >
> > > > > > > > > > I hope this addressed your questions.
> > > > > > > > >
> > > > > > > > > Okay, so you were talking about finer granularity when compared to the
> > > > > > > > > *current* LSM keyring hooks. Gotcha.
> > > > > > > > >
> > > > > > > > > If we need additional, or modified, hooks that shouldn't be a problem.
> > > > > > > > > Although I'm guessing the answer is going to be moving towards
> > > > > > > > > purpose/operation specific keyrings which might fit in well with the
> > > > > > > > > current keyring level controls.
> > > > > > > >
> > > > > > > > I don't believe defining per purpose/operation specific keyrings will
> > > > > > > > resolve the underlying problem of granularity.
> > > > > > >
> > > > > > > Perhaps not completely, but for in-kernel operations I believe it is
> > > > > > > an attractive idea.
> > > > > >
> > > > > > Could the X.509 Extended Key Usage (EKU) extension [1], be used here?
> > > > > > Various OIDs would need to be defined or assigned for each purpose.
> > > > > > Once assigned, the kernel could parse this information and do the
> > > > > > enforcement. Then all keys could continue to remain in the .builtin,
> > > > > > .secondary, and .machine keyrings. Only a subset of each keyring
> > > > > > would be used for verification based on what is contained in the EKU.
> > > > > >
> > > > > > 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12
> > > > >
> > > > > I was also thinking about this kind of use cases. Because it might be
> > > > > difficult in practice to control all certificate properties, we might
> > > > > want to let sysadmins configure these subset of keyring according to
> > > > > various certificate properties.
> > > >
> > > > I agree, a configuration component for a sysadmin would be needed.
> > > >
> > > > > There are currently LSM hooks to control
> > > > > interactions with kernel keys by user space, and keys are already tied
> > > > > to LSM blobs. New LSM hooks could be added to dynamically filter
> > > > > keyrings according to kernel usages (e.g. kernel module verification, a
> > > > > subset of an authentication mechanism according to the checked object).
> > > >
> > > > If an LSM hook could dynamically filter keyrings, and the EKU was used,
> > > > is there an opinion on how flexible this should be? Meaning, should there
> > > > be OIDs defined and carried in mainline code? This would make it easier
> > > > to setup and use. However who would be the initial OID owner? Or would
> > > > predefined OIDs not be contained within mainline code, leaving it to the
> > > > sysadmin to create a policy that would be fed to the LSM to do the filtering.
> > >
> > > The more flexible approach would be to not hardcode any policy in the
> > > kernel but let sysadmins define their own, including OIDs. We "just"
> > > need to find an adequate configuration scheme to define these
> > > constraints.
> >
> > Also, with the flexible approach, the policy would need to be given to the
> > kernel before any kernel module loads, fs-verity starts, or anything dealing
> > with digital signature based IMA runs, etc. With hardcoded policies this
> > could be setup from the kernel command line or be set from a Kconfig.
> > I assume with a flexible approach, this would need to come in early within
> > the initram?
>
> Yes, either the cmdline and/or the initramfs.
If SELinux was enabled in the initramfs, I would have thought to extend
the 'key' class with a sig_verify permission, and you pass the label of
the key used for signature verification and of the data to verify (from
the file it was read from?).
Just an idea.
Roberto
> > > We already have an ASN.1 parser in the kernel, so we might
> > > want to leverage that to match a certificate.
> >
> > We have the parser, however after parsing the certificate we do not
> > retain all the information within it. Some of the recent changes I have
> > done required modifications to the public_key struct. If there isn’t any
> > type of hard coded policy, what would be the reception of retaining the
> > entire cert within the kernel?
>
> I think it would make sense to have a default policy loaded at boot
> time, then load and take into account new pieces of policies at run
> time, but only parse/tag/assign a role to certificates/keys when they
> are loaded.
> On Oct 20, 2023, at 9:05 AM, Mickaël Salaün <[email protected]> wrote:
>
> On Thu, Oct 19, 2023 at 11:08:38PM +0000, Eric Snowberg wrote:
>>
>>
>>> On Oct 19, 2023, at 3:12 AM, Mickaël Salaün <[email protected]> wrote:
>>>
>>> The more flexible approach would be to not hardcode any policy in the
>>> kernel but let sysadmins define their own, including OIDs. We "just"
>>> need to find an adequate configuration scheme to define these
>>> constraints.
>>
>> Also, with the flexible approach, the policy would need to be given to the
>> kernel before any kernel module loads, fs-verity starts, or anything dealing
>> with digital signature based IMA runs, etc. With hardcoded policies this
>> could be setup from the kernel command line or be set from a Kconfig.
>> I assume with a flexible approach, this would need to come in early within
>> the initram?
>
> Yes, either the cmdline and/or the initramfs.
>
>>
>>> We already have an ASN.1 parser in the kernel, so we might
>>> want to leverage that to match a certificate.
>>
>> We have the parser, however after parsing the certificate we do not
>> retain all the information within it. Some of the recent changes I have
>> done required modifications to the public_key struct. If there isn’t any
>> type of hard coded policy, what would be the reception of retaining the
>> entire cert within the kernel?
>
> I think it would make sense to have a default policy loaded at boot
> time, then load and take into account new pieces of policies at run
> time, but only parse/tag/assign a role to certificates/keys when they
> are loaded.
Many keys are loaded into the kernel before the initram is used. This
includes: builtin, platform (UEFI DB), and machine (MOK). I believe
these are the keys of most interest for controlling usage. By not retaining
all the attributes, I’m not sure how a useful filtering policy could be
implemented afterwards. Do you have any ideas?
Also, for revocation, today we allow any system key to vouch for inclusion
into the blacklist keyring. Shouldn’t only the CA with the correct attributes
that originally signed the key be able to do this? If all attributes were retained
this could also be possible. There is a similar issue with keys added to the
secondary keyring. Any key linked to the secondary can do the vouching
for inclusion and usage is ignored. If a policy is added afterwards to enforce
this, we don’t have all the information necessary to do the enforcement.