Message-id: <53970660.4030101@samsung.com>
Date: Tue, 10 Jun 2014 16:21:36 +0300
From: Dmitry Kasatkin <d.kasatkin@samsung.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101
 Thunderbird/24.5.0
MIME-version: 1.0
To: Mimi Zohar <zohar@linux.vnet.ibm.com>, Josh Boyer <jwboyer@redhat.com>
Cc: dhowells@redhat.com, keyrings@linux-nfs.org,
        linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org,
        dmitry.kasatkin@gmail.com, mjg59@srcf.ucam.org
Subject: Re: [PATCH 0/4] KEYS: validate key trust with owner and builtin keys
 only
References: <1402331614.7064.60.camel@dhcp-9-2-203-236.watson.ibm.com>
 <cover.1402387862.git.d.kasatkin@samsung.com>
 <20140610122008.GA31944@hansolo.jdub.homelinux.org>
 <1402404750.5350.7.camel@dhcp-9-2-203-236.watson.ibm.com>
In-reply-to: <1402404750.5350.7.camel@dhcp-9-2-203-236.watson.ibm.com>
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org

On 10/06/14 15:52, Mimi Zohar wrote:
> On Tue, 2014-06-10 at 08:20 -0400, Josh Boyer wrote: 
>> On Tue, Jun 10, 2014 at 11:48:14AM +0300, Dmitry Kasatkin wrote:
>>> Also I want to discuss here Fedora UEFI patches as they are the reason for
>>> the these original patchset.
>>>
>>> http://pkgs.fedoraproject.org/cgit/kernel.git/tree/modsign-uefi.patch
>>>
>>> They provide functionality to specify MokIgnoreDb variable to limit loading of
>>> UEFI keys only from MOK List, while ignoring DB. This is certainly a good
>>> functionality. But once MODULE_SIG_UEFI is enabled, it looks there is no way
>>> to prevent loading keys from UEFI at all. And this might not be a good default
>>> functionality. Someone might want not allow loading of keys from UEFI unless
>>> kernel parameter is specified to allow it without recompiling the kernel
>>> and disabling MODULE_SIG_UEFI.
>>>
>>> Josh, why such design decision was made?
>> IIRC, it's because kernel parameters can be added programmatically from a
>> remote user if they gain root access.  Having a kernel parameter to
>> disable a key piece of secure boot isn't all that great.  We disable
>> other kernel parameters like acpi_rspd as well.
> In this case, there shouldn't be a problem as the kernel parameters
> would further limit the keys usage.
>
> Mimi

Josh probably means that it can be removed and restriction is lifted..
And after reboot, all keys come to the keyring..


>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/