Back in 2013 Linus requested a feature to allow end-users to have the
ability "to add their own keys and sign modules they trust". This was
his *second* order outlined here [1]. There have been many attempts
over the years to solve this problem, all have been rejected. Many
of the failed attempts loaded all preboot firmware keys into the kernel,
including the Secure Boot keys. Many distributions carry one of these
rejected attempts [2], [3], [4]. This series tries to solve this problem
with a solution that takes into account all the problems brought up in
the previous attempts.
On UEFI based systems, this series introduces a new Linux kernel keyring
containing the Machine Owner Keys (MOK) called machine. It also defines
a new MOK variable in shim. This variable allows the end-user to decide
if they want to load MOK keys into the machine keyring. Mimi has suggested
that only CA keys contained within the MOK be loaded into the machine
keyring. All other certs will load into the platform keyring instead.
By default, nothing changes; MOK keys are not loaded into the machine
keyring. They are only loaded after the end-user makes the decision
themselves. The end-user would set this through mokutil using a new
--trust-mok option [5]. This would work similar to how the kernel uses
MOK variables to enable/disable signature validation as well as use/ignore
the db. Any kernel operation that uses either the builtin or secondary
trusted keys as a trust source shall also reference the new machine
keyring as a trust source.
Secure Boot keys will never be loaded into the machine keyring. They
will always be loaded into the platform keyring. If an end-user wanted
to load one, they would need to enroll it into the MOK.
Steps required by the end user:
Sign kernel module with user created key:
$ /usr/src/kernels/$(uname -r)/scripts/sign-file sha512 \
machine_signing_key.priv machine_signing_key.x509 my_module.ko
Import the key into the MOK
$ mokutil --import machine_signing_key.x509
Setup the kernel to load MOK keys into the .machine keyring
$ mokutil --trust-mok
Then reboot, the MokManager will load and ask if you want to trust the
MOK key and enroll the MOK into the MOKList. Afterwards the signed kernel
module will load.
I have included a link to the mokutil [5] changes I have made to support
this new functionality. The shim changes have now been accepted
upstream [6].
[1] https://marc.info/?l=linux-kernel&m=136185386310140&w=2
[2] https://lore.kernel.org/lkml/[email protected]/
[3] https://lore.kernel.org/lkml/[email protected]/
[4] https://lore.kernel.org/linux-integrity/1e41f22b1f11784f1e943f32bf62034d4e054cdb.camel@HansenPartnership.com/
[5] https://github.com/esnowberg/mokutil/tree/mokvars-v3
[6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
Eric Snowberg (17):
integrity: Introduce a Linux keyring called machine
integrity: Do not allow machine keyring updates following init
KEYS: Create static version of public_key_verify_signature
X.509: Parse Basic Constraints for CA
KEYS: CA link restriction
integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca
integrity: Fix warning about missing prototypes
integrity: add new keyring handler for mok keys
KEYS: Rename get_builtin_and_secondary_restriction
KEYS: add a reference to machine keyring
KEYS: Introduce link restriction for machine keys
KEYS: integrity: change link restriction to trust the machine keyring
KEYS: link secondary_trusted_keys to machine trusted keys
integrity: store reference to machine keyring
efi/mokvar: move up init order
integrity: Trust MOK keys if MokListTrustedRT found
integrity: Only use machine keyring when uefi_check_trust_mok_keys is
true
certs/system_keyring.c | 44 ++++++++++-
crypto/asymmetric_keys/restrict.c | 43 +++++++++++
crypto/asymmetric_keys/x509_cert_parser.c | 9 +++
drivers/firmware/efi/mokvar-table.c | 2 +-
include/crypto/public_key.h | 15 ++++
include/keys/system_keyring.h | 14 ++++
security/integrity/Kconfig | 12 +++
security/integrity/Makefile | 1 +
security/integrity/digsig.c | 23 +++++-
security/integrity/integrity.h | 17 +++-
.../platform_certs/keyring_handler.c | 18 ++++-
.../platform_certs/keyring_handler.h | 5 ++
security/integrity/platform_certs/load_uefi.c | 4 +-
.../platform_certs/machine_keyring.c | 77 +++++++++++++++++++
14 files changed, 273 insertions(+), 11 deletions(-)
create mode 100644 security/integrity/platform_certs/machine_keyring.c
base-commit: fa55b7dcdc43c1aa1ba12bca9d2dd4318c2a0dbf
--
2.18.4
Allow the .machine keyring to be linked to the secondary_trusted_keys.
After the link is created, keys contained in the .machine keyring will
automatically be searched when searching secondary_trusted_keys.
Signed-off-by: Eric Snowberg <[email protected]>
---
v3: Initial version
v4: Unmodified from v3
v5: Rename to machine keyring
v7: Unmodified from v5
---
certs/system_keyring.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index ba732856ebd0..2a2dc70b126c 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void)
void __init set_machine_trusted_keys(struct key *keyring)
{
machine_trusted_keys = keyring;
+
+ if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0)
+ panic("Can't link (machine) trusted keyrings\n");
}
/**
--
2.18.4
A new Machine Owner Key (MOK) variable called MokListTrustedRT has been
introduced in shim. When this UEFI variable is set, it indicates the
end-user has made the decision themselves that they wish to trust MOK keys
within the Linux trust boundary. It is not an error if this variable
does not exist. If it does not exist, the MOK keys should not be trusted
within the kernel.
Signed-off-by: Eric Snowberg <[email protected]>
---
v1: Initial version
v2: Removed mok_keyring_trust_setup function
v4: Unmodified from v2
v5: Rename to machine keyring
v6: Unmodified from v5
v7: Use mokvar table instead of EFI var (suggested by Peter Jones)
---
.../platform_certs/machine_keyring.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
index ea2ac2f9f2b5..09fd8f20c756 100644
--- a/security/integrity/platform_certs/machine_keyring.c
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -5,6 +5,7 @@
* Copyright (c) 2021, Oracle and/or its affiliates.
*/
+#include <linux/efi.h>
#include "../integrity.h"
static __init int machine_keyring_init(void)
@@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t
if (rc)
pr_info("Error adding keys to machine keyring %s\n", source);
}
+
+/*
+ * Try to load the MokListTrustedRT MOK variable to see if we should trust
+ * the MOK keys within the kernel. It is not an error if this variable
+ * does not exist. If it does not exist, MOK keys should not be trusted
+ * within the machine keyring.
+ */
+static __init bool uefi_check_trust_mok_keys(void)
+{
+ struct efi_mokvar_table_entry *mokvar_entry;
+
+ mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT");
+
+ if (mokvar_entry)
+ return true;
+
+ return false;
+}
--
2.18.4
With the introduction of uefi_check_trust_mok_keys, it signifies the end-
user wants to trust the machine keyring as trusted keys. If they have
chosen to trust the machine keyring, load the qualifying keys into it
during boot, then link it to the secondary keyring . If the user has not
chosen to trust the machine keyring, it will be empty and not linked to
the secondary keyring.
Signed-off-by: Eric Snowberg <[email protected]>
---
v4: Initial version
v5: Rename to machine keyring
v6: Unmodified from v5
v7: Made trust_mok static
---
security/integrity/digsig.c | 2 +-
security/integrity/integrity.h | 5 +++++
.../integrity/platform_certs/keyring_handler.c | 2 +-
.../integrity/platform_certs/machine_keyring.c | 16 ++++++++++++++++
4 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 109b58840d45..1de09c7b5f93 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -116,7 +116,7 @@ static int __init __integrity_init_keyring(const unsigned int id,
} else {
if (id == INTEGRITY_KEYRING_PLATFORM)
set_platform_trusted_keys(keyring[id]);
- if (id == INTEGRITY_KEYRING_MACHINE)
+ if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist())
set_machine_trusted_keys(keyring[id]);
if (id == INTEGRITY_KEYRING_IMA)
load_module_cert(keyring[id]);
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 730771eececd..2e214c761158 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source,
#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
void __init add_to_machine_keyring(const char *source, const void *data, size_t len);
+bool __init trust_moklist(void);
#else
static inline void __init add_to_machine_keyring(const char *source,
const void *data, size_t len)
{
}
+static inline bool __init trust_moklist(void)
+{
+ return false;
+}
#endif
diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c
index 4872850d081f..1db4d3b4356d 100644
--- a/security/integrity/platform_certs/keyring_handler.c
+++ b/security/integrity/platform_certs/keyring_handler.c
@@ -83,7 +83,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type)
{
if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) {
- if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING))
+ if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist())
return add_to_machine_keyring;
else
return add_to_platform_keyring;
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
index 09fd8f20c756..7aaed7950b6e 100644
--- a/security/integrity/platform_certs/machine_keyring.c
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -8,6 +8,8 @@
#include <linux/efi.h>
#include "../integrity.h"
+static bool trust_mok;
+
static __init int machine_keyring_init(void)
{
int rc;
@@ -59,3 +61,17 @@ static __init bool uefi_check_trust_mok_keys(void)
return false;
}
+
+bool __init trust_moklist(void)
+{
+ static bool initialized;
+
+ if (!initialized) {
+ initialized = true;
+
+ if (uefi_check_trust_mok_keys())
+ trust_mok = true;
+ }
+
+ return trust_mok;
+}
--
2.18.4
Many UEFI Linux distributions boot using shim. The UEFI shim provides
what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure
Boot DB and MOK keys to validate the next step in the boot chain. The
MOK facility can be used to import user generated keys. These keys can
be used to sign an end-users development kernel build. When Linux
boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux
.platform keyring.
Define a new Linux keyring called machine. This keyring shall contain just
MOK CA keys and not the remaining keys in the platform keyring. This new
machine keyring will be used in follow on patches. Unlike keys in the
platform keyring, keys contained in the machine keyring will be trusted
within the kernel if the end-user has chosen to do so.
Signed-off-by: Eric Snowberg <[email protected]>
---
v1: Initial version
v2: Removed destory keyring code
v3: Unmodified from v2
v4: Add Kconfig, merged in "integrity: add add_to_mok_keyring"
v5: Rename to machine keyring
v6: Depend on EFI in kconfig (suggested by Mimi)
Test to see if ".platform" keyring is configured in
add_to_machine_keyring (suggested by Mimi)
v7: Depend on LOAD_UEFI_KEYS instead EFI for mokvar code
---
security/integrity/Kconfig | 12 ++++++
security/integrity/Makefile | 1 +
security/integrity/digsig.c | 1 +
security/integrity/integrity.h | 12 +++++-
.../platform_certs/machine_keyring.c | 42 +++++++++++++++++++
5 files changed, 67 insertions(+), 1 deletion(-)
create mode 100644 security/integrity/platform_certs/machine_keyring.c
diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
index 71f0177e8716..12879dec251d 100644
--- a/security/integrity/Kconfig
+++ b/security/integrity/Kconfig
@@ -62,6 +62,18 @@ config INTEGRITY_PLATFORM_KEYRING
provided by the platform for verifying the kexec'ed kerned image
and, possibly, the initramfs signature.
+config INTEGRITY_MACHINE_KEYRING
+ bool "Provide a keyring to which CA Machine Owner Keys may be added"
+ depends on SECONDARY_TRUSTED_KEYRING
+ depends on INTEGRITY_ASYMMETRIC_KEYS
+ depends on SYSTEM_BLACKLIST_KEYRING
+ depends on LOAD_UEFI_KEYS
+ help
+ If set, provide a keyring to which CA Machine Owner Keys (MOK) may
+ be added. This keyring shall contain just CA MOK keys. Unlike keys
+ in the platform keyring, keys contained in the .machine keyring will
+ be trusted within the kernel.
+
config LOAD_UEFI_KEYS
depends on INTEGRITY_PLATFORM_KEYRING
depends on EFI
diff --git a/security/integrity/Makefile b/security/integrity/Makefile
index 7ee39d66cf16..d0ffe37dc1d6 100644
--- a/security/integrity/Makefile
+++ b/security/integrity/Makefile
@@ -10,6 +10,7 @@ integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o
integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o
integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o
integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o
+integrity-$(CONFIG_INTEGRITY_MACHINE_KEYRING) += platform_certs/machine_keyring.o
integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \
platform_certs/load_uefi.o \
platform_certs/keyring_handler.o
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 3b06a01bd0fd..8c315be8ad99 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -30,6 +30,7 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = {
".ima",
#endif
".platform",
+ ".machine",
};
#ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 547425c20e11..730771eececd 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -151,7 +151,8 @@ int integrity_kernel_read(struct file *file, loff_t offset,
#define INTEGRITY_KEYRING_EVM 0
#define INTEGRITY_KEYRING_IMA 1
#define INTEGRITY_KEYRING_PLATFORM 2
-#define INTEGRITY_KEYRING_MAX 3
+#define INTEGRITY_KEYRING_MACHINE 3
+#define INTEGRITY_KEYRING_MAX 4
extern struct dentry *integrity_dir;
@@ -283,3 +284,12 @@ static inline void __init add_to_platform_keyring(const char *source,
{
}
#endif
+
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+void __init add_to_machine_keyring(const char *source, const void *data, size_t len);
+#else
+static inline void __init add_to_machine_keyring(const char *source,
+ const void *data, size_t len)
+{
+}
+#endif
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
new file mode 100644
index 000000000000..ea2ac2f9f2b5
--- /dev/null
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Machine keyring routines.
+ *
+ * Copyright (c) 2021, Oracle and/or its affiliates.
+ */
+
+#include "../integrity.h"
+
+static __init int machine_keyring_init(void)
+{
+ int rc;
+
+ rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE);
+ if (rc)
+ return rc;
+
+ pr_notice("Machine keyring initialized\n");
+ return 0;
+}
+device_initcall(machine_keyring_init);
+
+void __init add_to_machine_keyring(const char *source, const void *data, size_t len)
+{
+ key_perm_t perm;
+ int rc;
+
+ perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW;
+ rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm);
+
+ /*
+ * Some MOKList keys may not pass the machine keyring restrictions.
+ * If the restriction check does not pass and the platform keyring
+ * is configured, try to add it into that keyring instead.
+ */
+ if (rc && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
+ rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source,
+ data, len, perm);
+
+ if (rc)
+ pr_info("Error adding keys to machine keyring %s\n", source);
+}
--
2.18.4
make W=1 generates the following warning in keyring_handler.c
security/integrity/platform_certs/keyring_handler.c:71:30: warning: no previous prototype for get_handler_for_db [-Wmissing-prototypes]
__init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
^~~~~~~~~~~~~~~~~~
security/integrity/platform_certs/keyring_handler.c:82:30: warning: no previous prototype for get_handler_for_dbx [-Wmissing-prototypes]
__init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type)
^~~~~~~~~~~~~~~~~~~
Add the missing prototypes by including keyring_handler.h.
Signed-off-by: Eric Snowberg <[email protected]>
---
v7: Initial version
---
security/integrity/platform_certs/keyring_handler.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c
index 5604bd57c990..e9791be98fd9 100644
--- a/security/integrity/platform_certs/keyring_handler.c
+++ b/security/integrity/platform_certs/keyring_handler.c
@@ -9,6 +9,7 @@
#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
#include "../integrity.h"
+#include "keyring_handler.h"
static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID;
static efi_guid_t efi_cert_x509_sha256_guid __initdata =
--
2.18.4
Set the restriction check for INTEGRITY_KEYRING_MACHINE keys to
restrict_link_by_ca. This will only allow CA keys into the machine
keyring.
Signed-off-by: Eric Snowberg <[email protected]>
---
v1: Initial version
v2: Added !IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING check so mok
keyring gets created even when it isn't enabled
v3: Rename restrict_link_by_system_trusted_or_ca to restrict_link_by_ca
v4: removed unnecessary restriction->check set
v5: Rename to machine keyring
v6: split line over 80 char (suggested by Mimi)
v7: Unmodified from v6
---
security/integrity/digsig.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 910fe29a5037..e7dfc55a7c55 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -132,14 +132,18 @@ int __init integrity_init_keyring(const unsigned int id)
goto out;
}
- if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING))
+ if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING) &&
+ id != INTEGRITY_KEYRING_MACHINE)
return 0;
restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
if (!restriction)
return -ENOMEM;
- restriction->check = restrict_link_to_ima;
+ if (id == INTEGRITY_KEYRING_MACHINE)
+ restriction->check = restrict_link_by_ca;
+ else
+ restriction->check = restrict_link_to_ima;
/*
* No additional keys shall be allowed to load into the machine
--
2.18.4
Move up the init order so it can be used by the new machine keyring.
Signed-off-by: Eric Snowberg <[email protected]>
---
v7: Initial version
---
drivers/firmware/efi/mokvar-table.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c
index 38722d2009e2..5ed0602c2f75 100644
--- a/drivers/firmware/efi/mokvar-table.c
+++ b/drivers/firmware/efi/mokvar-table.c
@@ -359,4 +359,4 @@ static int __init efi_mokvar_sysfs_init(void)
}
return err;
}
-device_initcall(efi_mokvar_sysfs_init);
+fs_initcall(efi_mokvar_sysfs_init);
--
2.18.4
Store a reference to the machine keyring in system keyring code. The
system keyring code needs this to complete the keyring link to
to machine keyring.
Signed-off-by: Eric Snowberg <[email protected]>
---
v2: Initial version
v3: Unmodified from v2
v4: Removed trust_moklist check
v5: Rename to machine keyring
v7: Unmodified from v5
---
security/integrity/digsig.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 74f73f7cc4fe..109b58840d45 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -116,6 +116,8 @@ static int __init __integrity_init_keyring(const unsigned int id,
} else {
if (id == INTEGRITY_KEYRING_PLATFORM)
set_platform_trusted_keys(keyring[id]);
+ if (id == INTEGRITY_KEYRING_MACHINE)
+ set_machine_trusted_keys(keyring[id]);
if (id == INTEGRITY_KEYRING_IMA)
load_module_cert(keyring[id]);
}
--
2.18.4
On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
> Back in 2013 Linus requested a feature to allow end-users to have the
> ability "to add their own keys and sign modules they trust". This was
> his *second* order outlined here [1]. There have been many attempts
> over the years to solve this problem, all have been rejected. Many
> of the failed attempts loaded all preboot firmware keys into the kernel,
> including the Secure Boot keys. Many distributions carry one of these
> rejected attempts [2], [3], [4]. This series tries to solve this problem
> with a solution that takes into account all the problems brought up in
> the previous attempts.
>
> On UEFI based systems, this series introduces a new Linux kernel keyring
> containing the Machine Owner Keys (MOK) called machine. It also defines
> a new MOK variable in shim. This variable allows the end-user to decide
> if they want to load MOK keys into the machine keyring. Mimi has suggested
> that only CA keys contained within the MOK be loaded into the machine
> keyring. All other certs will load into the platform keyring instead.
>
> By default, nothing changes; MOK keys are not loaded into the machine
> keyring. They are only loaded after the end-user makes the decision
> themselves. The end-user would set this through mokutil using a new
> --trust-mok option [5]. This would work similar to how the kernel uses
> MOK variables to enable/disable signature validation as well as use/ignore
> the db. Any kernel operation that uses either the builtin or secondary
> trusted keys as a trust source shall also reference the new machine
> keyring as a trust source.
>
> Secure Boot keys will never be loaded into the machine keyring. They
> will always be loaded into the platform keyring. If an end-user wanted
> to load one, they would need to enroll it into the MOK.
>
> Steps required by the end user:
>
> Sign kernel module with user created key:
> $ /usr/src/kernels/$(uname -r)/scripts/sign-file sha512 \
> machine_signing_key.priv machine_signing_key.x509 my_module.ko
>
> Import the key into the MOK
> $ mokutil --import machine_signing_key.x509
>
> Setup the kernel to load MOK keys into the .machine keyring
> $ mokutil --trust-mok
>
> Then reboot, the MokManager will load and ask if you want to trust the
> MOK key and enroll the MOK into the MOKList. Afterwards the signed kernel
> module will load.
>
> I have included a link to the mokutil [5] changes I have made to support
> this new functionality. The shim changes have now been accepted
> upstream [6].
>
> [1] https://marc.info/?l=linux-kernel&m=136185386310140&w=2
> [2] https://lore.kernel.org/lkml/[email protected]/
> [3] https://lore.kernel.org/lkml/[email protected]/
> [4] https://lore.kernel.org/linux-integrity/1e41f22b1f11784f1e943f32bf62034d4e054cdb.camel@HansenPartnership.com/
> [5] https://github.com/esnowberg/mokutil/tree/mokvars-v3
> [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
>
> Eric Snowberg (17):
> integrity: Introduce a Linux keyring called machine
> integrity: Do not allow machine keyring updates following init
> KEYS: Create static version of public_key_verify_signature
> X.509: Parse Basic Constraints for CA
> KEYS: CA link restriction
> integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca
> integrity: Fix warning about missing prototypes
> integrity: add new keyring handler for mok keys
> KEYS: Rename get_builtin_and_secondary_restriction
> KEYS: add a reference to machine keyring
> KEYS: Introduce link restriction for machine keys
> KEYS: integrity: change link restriction to trust the machine keyring
> KEYS: link secondary_trusted_keys to machine trusted keys
> integrity: store reference to machine keyring
> efi/mokvar: move up init order
> integrity: Trust MOK keys if MokListTrustedRT found
> integrity: Only use machine keyring when uefi_check_trust_mok_keys is
> true
>
> certs/system_keyring.c | 44 ++++++++++-
> crypto/asymmetric_keys/restrict.c | 43 +++++++++++
> crypto/asymmetric_keys/x509_cert_parser.c | 9 +++
> drivers/firmware/efi/mokvar-table.c | 2 +-
> include/crypto/public_key.h | 15 ++++
> include/keys/system_keyring.h | 14 ++++
> security/integrity/Kconfig | 12 +++
> security/integrity/Makefile | 1 +
> security/integrity/digsig.c | 23 +++++-
> security/integrity/integrity.h | 17 +++-
> .../platform_certs/keyring_handler.c | 18 ++++-
> .../platform_certs/keyring_handler.h | 5 ++
> security/integrity/platform_certs/load_uefi.c | 4 +-
> .../platform_certs/machine_keyring.c | 77 +++++++++++++++++++
> 14 files changed, 273 insertions(+), 11 deletions(-)
> create mode 100644 security/integrity/platform_certs/machine_keyring.c
>
>
> base-commit: fa55b7dcdc43c1aa1ba12bca9d2dd4318c2a0dbf
Does shim have the necessary features in a release?
/Jarkko
> > I have included? a link to the mokutil [5] changes I have made to support
> > this new functionality.? The shim changes have now been accepted
> > upstream [6].
..snip..
> > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
..snip..
>
> Does shim have the necessary features in a release?
Hi!
It has been accepted in the upstream shim. If you are looking
for a distribution having rolled out a shim with this feature (so signed
by MSF) I fear that distributions are not that fast with shim releases.
Also these:
https://github.com/rhboot/shim/pulls
https://github.com/rhboot/shim/issues
do mean some extra work would need to go in before an official
release is cut.
Hope this helps?
On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
> > > I have included a link to the mokutil [5] changes I have made to support
> > > this new functionality. The shim changes have now been accepted
> > > upstream [6].
>
> ..snip..
> > > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
>
> ..snip..
> >
> > Does shim have the necessary features in a release?
>
> Hi!
>
> It has been accepted in the upstream shim. If you are looking
> for a distribution having rolled out a shim with this feature (so signed
> by MSF) I fear that distributions are not that fast with shim releases.
>
> Also these:
> https://github.com/rhboot/shim/pulls
> https://github.com/rhboot/shim/issues
>
> do mean some extra work would need to go in before an official
> release is cut.
>
> Hope this helps?
Yes. I'll hold with this up until there is an official release. Thank you.
/Jarkko
On Tue, Nov 16, 2021 at 06:24:52PM +0200, Jarkko Sakkinen wrote:
> On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
> > > > I have included? a link to the mokutil [5] changes I have made to support
> > > > this new functionality.? The shim changes have now been accepted
> > > > upstream [6].
> >
> > ..snip..
> > > > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
> >
> > ..snip..
> > >
> > > Does shim have the necessary features in a release?
> >
> > Hi!
> >
> > It has been accepted in the upstream shim. If you are looking
> > for a distribution having rolled out a shim with this feature (so signed
> > by MSF) I fear that distributions are not that fast with shim releases.
> >
> > Also these:
> > https://github.com/rhboot/shim/pulls
> > https://github.com/rhboot/shim/issues
> >
> > do mean some extra work would need to go in before an official
> > release is cut.
> >
> > Hope this helps?
>
> Yes. I'll hold with this up until there is an official release. Thank you.
Not sure I understand - but what are the concerns you have with shim
code that has been accepted?
On Tue, 2021-11-16 at 11:39 -0500, Konrad Rzeszutek Wilk wrote:
> On Tue, Nov 16, 2021 at 06:24:52PM +0200, Jarkko Sakkinen wrote:
> > On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
> > > > > I have included a link to the mokutil [5] changes I have made to support
> > > > > this new functionality. The shim changes have now been accepted
> > > > > upstream [6].
> > >
> > > ..snip..
> > > > > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
> > >
> > > ..snip..
> > > >
> > > > Does shim have the necessary features in a release?
> > >
> > > Hi!
> > >
> > > It has been accepted in the upstream shim. If you are looking
> > > for a distribution having rolled out a shim with this feature (so signed
> > > by MSF) I fear that distributions are not that fast with shim releases.
~~~
Should that be MS, or what does MSF mean?
> > >
> > > Also these:
> > > https://github.com/rhboot/shim/pulls
> > > https://github.com/rhboot/shim/issues
> > >
> > > do mean some extra work would need to go in before an official
> > > release is cut.
> > >
> > > Hope this helps?
> >
> > Yes. I'll hold with this up until there is an official release. Thank you.
>
> Not sure I understand - but what are the concerns you have with shim
> code that has been accepted?
Maybe my concern is that none of the patches have a tested-by?
Probably would be easier to get a test coverage, e.g. for people like
me who do not even know how to self-compile Shim, how to setup user
space using the product and so forth.
I don't demand a release, if the changes have been accepted, but 17
patches do need to be tested.
/Jarkko
On Wed, 2021-11-17 at 09:50 +0200, Jarkko Sakkinen wrote:
> On Tue, 2021-11-16 at 11:39 -0500, Konrad Rzeszutek Wilk wrote:
> > On Tue, Nov 16, 2021 at 06:24:52PM +0200, Jarkko Sakkinen wrote:
> > > On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
> > > > > > I have included a link to the mokutil [5] changes I have made to support
> > > > > > this new functionality. The shim changes have now been accepted
> > > > > > upstream [6].
> > > >
> > > > ..snip..
> > > > > > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
> > > >
> > > > ..snip..
> > > > >
> > > > > Does shim have the necessary features in a release?
> > > >
> > > > Hi!
> > > >
> > > > It has been accepted in the upstream shim. If you are looking
> > > > for a distribution having rolled out a shim with this feature (so signed
> > > > by MSF) I fear that distributions are not that fast with shim releases.
> ~~~
>
> Should that be MS, or what does MSF mean?
>
> > > >
> > > > Also these:
> > > > https://github.com/rhboot/shim/pulls
> > > > https://github.com/rhboot/shim/issues
> > > >
> > > > do mean some extra work would need to go in before an official
> > > > release is cut.
> > > >
> > > > Hope this helps?
> > >
> > > Yes. I'll hold with this up until there is an official release. Thank you.
> >
> > Not sure I understand - but what are the concerns you have with shim
> > code that has been accepted?
>
> Maybe my concern is that none of the patches have a tested-by?
>
> Probably would be easier to get a test coverage, e.g. for people like
> me who do not even know how to self-compile Shim, how to setup user
> space using the product and so forth.
~~~~~~~~~~~~~~~~~
for the end product
/Jarkko
Hi Eric,
On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
> Many UEFI Linux distributions boot using shim. The UEFI shim provides
> what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure
> Boot DB and MOK keys to validate the next step in the boot chain. The
> MOK facility can be used to import user generated keys. These keys can
> be used to sign an end-users development kernel build. When Linux
> boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux
> .platform keyring.
, which can be used to verify kexec'ed kernel images.
> Define a new Linux keyring called machine. This keyring shall contain just
> MOK CA keys and not the remaining keys in the platform keyring. This new
> machine keyring will be used in follow on patches. Unlike keys in the
> platform keyring, keys contained in the machine keyring will be trusted
> within the kernel if the end-user has chosen to do so.
allowing, for example, keys to be loaded onto the trusted IMA keyring.
>
> Signed-off-by: Eric Snowberg <[email protected]>
Thank you for all the work! Just letting you know I'm slowly making my
through the patch set. With the previous patch re-organization, we
should be able to test everything up to the introduction of the MOK
variable support.
Reviewed-by: Mimi Zohar <[email protected]>
Hi Eric,
On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
> make W=1 generates the following warning in keyring_handler.c
>
> security/integrity/platform_certs/keyring_handler.c:71:30: warning: no previous prototype for get_handler_for_db [-Wmissing-prototypes]
> __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
> ^~~~~~~~~~~~~~~~~~
> security/integrity/platform_certs/keyring_handler.c:82:30: warning: no previous prototype for get_handler_for_dbx [-Wmissing-prototypes]
> __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type)
> ^~~~~~~~~~~~~~~~~~~
> Add the missing prototypes by including keyring_handler.h.
>
> Signed-off-by: Eric Snowberg <[email protected]>
These sorts of fixes, which aren't really dependent on the patch set,
could be moved to the begining of the patch set.
Reviewed-by: Mimi Zohar <[email protected]>
On Wed, Nov 17, 2021 at 09:51:25AM +0200, Jarkko Sakkinen wrote:
> On Wed, 2021-11-17 at 09:50 +0200, Jarkko Sakkinen wrote:
> > On Tue, 2021-11-16 at 11:39 -0500, Konrad Rzeszutek Wilk wrote:
> > > On Tue, Nov 16, 2021 at 06:24:52PM +0200, Jarkko Sakkinen wrote:
> > > > On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
> > > > > > > I have included? a link to the mokutil [5] changes I have made to support
> > > > > > > this new functionality.? The shim changes have now been accepted
> > > > > > > upstream [6].
> > > > >
> > > > > ..snip..
> > > > > > > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
> > > > >
> > > > > ..snip..
> > > > > >
> > > > > > Does shim have the necessary features in a release?
> > > > >
> > > > > Hi!
> > > > >
> > > > > It has been accepted in the upstream shim. If you are looking
> > > > > for a distribution having rolled out a shim with this feature (so signed
> > > > > by MSF) I fear that distributions are not that fast with shim releases.
> > ???????? ~~~
> >
> > Should that be MS, or what does MSF mean?
Microsoft :-)
> >
> > > > >
> > > > > Also these:
> > > > > https://github.com/rhboot/shim/pulls
> > > > > https://github.com/rhboot/shim/issues
> > > > >
> > > > > do mean some extra work would need to go in before an official
> > > > > release is cut.
> > > > >
> > > > > Hope this helps?
> > > >
> > > > Yes. I'll hold with this up until there is an official release. Thank you.
> > >
> > > Not sure I understand - but what are the concerns you have with shim
> > > code that has been accepted?
> >
> > Maybe my concern is that none of the patches have a tested-by?
> >
> > Probably would be easier to get a test coverage, e.g. for people like
> > me who do not even know how to self-compile Shim, how to setup user
> > space using the product and so forth.
> ~~~~~~~~~~~~~~~~~
>
> for the end product
<nods> That makes total sense. Thanks for the explanation, let me double
check whether
https://github.com/rhboot/shim/blob/main/BUILDING
is still correct.
>
> /Jarkko
>
>
>
> On Nov 17, 2021, at 10:02 AM, Konrad Wilk <[email protected]> wrote:
>
> On Wed, Nov 17, 2021 at 09:51:25AM +0200, Jarkko Sakkinen wrote:
>> On Wed, 2021-11-17 at 09:50 +0200, Jarkko Sakkinen wrote:
>>> On Tue, 2021-11-16 at 11:39 -0500, Konrad Rzeszutek Wilk wrote:
>>>> On Tue, Nov 16, 2021 at 06:24:52PM +0200, Jarkko Sakkinen wrote:
>>>>> On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
>>>>>>>> I have included a link to the mokutil [5] changes I have made to support
>>>>>>>> this new functionality. The shim changes have now been accepted
>>>>>>>> upstream [6].
>>>>>>
>>>>>> ..snip..
>>>>>>>> [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
>>>>>>
>>>>>> ..snip..
>>>>>>>
>>>>>>> Does shim have the necessary features in a release?
>>>>>>
>>>>>> Hi!
>>>>>>
>>>>>> It has been accepted in the upstream shim. If you are looking
>>>>>> for a distribution having rolled out a shim with this feature (so signed
>>>>>> by MSF) I fear that distributions are not that fast with shim releases.
>>> ~~~
>>>
>>> Should that be MS, or what does MSF mean?
>
> Microsoft :-)
Correct, I’ll fix that in the next round.
>>>>>>
>>>>>> Also these:
>>>>>> https://github.com/rhboot/shim/pulls
>>>>>> https://github.com/rhboot/shim/issues
>>>>>>
>>>>>> do mean some extra work would need to go in before an official
>>>>>> release is cut.
>>>>>>
>>>>>> Hope this helps?
>>>>>
>>>>> Yes. I'll hold with this up until there is an official release. Thank you.
>>>>
>>>> Not sure I understand - but what are the concerns you have with shim
>>>> code that has been accepted?
>>>
>>> Maybe my concern is that none of the patches have a tested-by?
>>>
>>> Probably would be easier to get a test coverage, e.g. for people like
>>> me who do not even know how to self-compile Shim, how to setup user
>>> space using the product and so forth.
>> ~~~~~~~~~~~~~~~~~
>>
>> for the end product
>
> <nods> That makes total sense. Thanks for the explanation, let me double
> check whether
>
> https://github.com/rhboot/shim/blob/main/BUILDING
>
> is still correct.
Those are the steps I use for building. I then move over mmx64.efi and
shimx64.efi to the ESP. I can add the shim build/install instructions to the next
cover letter If you think that would be appropriate.
On Wed, 2021-11-17 at 17:20 +0000, Eric Snowberg wrote:
>
>
> > On Nov 17, 2021, at 10:02 AM, Konrad Wilk <[email protected]> wrote:
> >
> > On Wed, Nov 17, 2021 at 09:51:25AM +0200, Jarkko Sakkinen wrote:
> > > On Wed, 2021-11-17 at 09:50 +0200, Jarkko Sakkinen wrote:
> > > > On Tue, 2021-11-16 at 11:39 -0500, Konrad Rzeszutek Wilk wrote:
> > > > > On Tue, Nov 16, 2021 at 06:24:52PM +0200, Jarkko Sakkinen wrote:
> > > > > > On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
> > > > > > > > > I have included a link to the mokutil [5] changes I have made to support
> > > > > > > > > this new functionality. The shim changes have now been accepted
> > > > > > > > > upstream [6].
> > > > > > >
> > > > > > > ..snip..
> > > > > > > > > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
> > > > > > >
> > > > > > > ..snip..
> > > > > > > >
> > > > > > > > Does shim have the necessary features in a release?
> > > > > > >
> > > > > > > Hi!
> > > > > > >
> > > > > > > It has been accepted in the upstream shim. If you are looking
> > > > > > > for a distribution having rolled out a shim with this feature (so signed
> > > > > > > by MSF) I fear that distributions are not that fast with shim releases.
> > > > ~~~
> > > >
> > > > Should that be MS, or what does MSF mean?
> >
> > Microsoft :-)
>
> Correct, I’ll fix that in the next round.
>
> > > > > > >
> > > > > > > Also these:
> > > > > > > https://github.com/rhboot/shim/pulls
> > > > > > > https://github.com/rhboot/shim/issues
> > > > > > >
> > > > > > > do mean some extra work would need to go in before an official
> > > > > > > release is cut.
> > > > > > >
> > > > > > > Hope this helps?
> > > > > >
> > > > > > Yes. I'll hold with this up until there is an official release. Thank you.
> > > > >
> > > > > Not sure I understand - but what are the concerns you have with shim
> > > > > code that has been accepted?
> > > >
> > > > Maybe my concern is that none of the patches have a tested-by?
> > > >
> > > > Probably would be easier to get a test coverage, e.g. for people like
> > > > me who do not even know how to self-compile Shim, how to setup user
> > > > space using the product and so forth.
> > > ~~~~~~~~~~~~~~~~~
> > >
> > > for the end product
> >
> > <nods> That makes total sense. Thanks for the explanation, let me double
> > check whether
> >
> > https://github.com/rhboot/shim/blob/main/BUILDING
> >
> > is still correct.
>
> Those are the steps I use for building. I then move over mmx64.efi and
> shimx64.efi to the ESP. I can add the shim build/install instructions to the next
> cover letter If you think that would be appropriate.
Yeah, that would be great. I'll try to setup VM for that purpose. I have
already a script to build UEFI enabled archlinux VM's, which I use to
test SGX patches. I can probably tailor that for this purpose.
/Jarkko
Hi Eric,
Is the subject line left over from the original patch? Shouldn't it
be "link machine trusted keys to secondary_trusted_keys".
On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
> Allow the .machine keyring to be linked to the secondary_trusted_keys.
> After the link is created, keys contained in the .machine keyring will
> automatically be searched when searching secondary_trusted_keys.
>
> Signed-off-by: Eric Snowberg <[email protected]>
> ---
> v3: Initial version
> v4: Unmodified from v3
> v5: Rename to machine keyring
> v7: Unmodified from v5
> ---
> certs/system_keyring.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index ba732856ebd0..2a2dc70b126c 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void)
> void __init set_machine_trusted_keys(struct key *keyring)
> {
> machine_trusted_keys = keyring;
> +
> + if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0)
> + panic("Can't link (machine) trusted keyrings\n");
> }
>
> /**
In general is the ordering of the patches "bisect safe"[1]? Only in
the next patch is machine_trusted_keys set. In this case, either
merge the two patches or reverse their order.
thanks,
Mimi
[1] Refer to the section "Separate your changes" in
Documentation/process/submitting-patches.rst.
> On Nov 18, 2021, at 5:32 AM, Mimi Zohar <[email protected]> wrote:
>
> Hi Eric,
>
> Is the subject line left over from the original patch? Shouldn't it
> be "link machine trusted keys to secondary_trusted_keys".
Yes, you are right, this was left over from the original patch. I’ll update
the heading in the next round.
> On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
>> Allow the .machine keyring to be linked to the secondary_trusted_keys.
>> After the link is created, keys contained in the .machine keyring will
>> automatically be searched when searching secondary_trusted_keys.
>>
>> Signed-off-by: Eric Snowberg <[email protected]>
>> ---
>> v3: Initial version
>> v4: Unmodified from v3
>> v5: Rename to machine keyring
>> v7: Unmodified from v5
>> ---
>> certs/system_keyring.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
>> index ba732856ebd0..2a2dc70b126c 100644
>> --- a/certs/system_keyring.c
>> +++ b/certs/system_keyring.c
>> @@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void)
>> void __init set_machine_trusted_keys(struct key *keyring)
>> {
>> machine_trusted_keys = keyring;
>> +
>> + if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0)
>> + panic("Can't link (machine) trusted keyrings\n");
>> }
>>
>> /**
>
> In general is the ordering of the patches "bisect safe"[1]? Only in
> the next patch is machine_trusted_keys set. In this case, either
> merge the two patches or reverse their order.
I’ll also reverse the ordering in the next round too. Thanks.