Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756295AbaFLRBA (ORCPT ); Thu, 12 Jun 2014 13:01:00 -0400 Received: from mx1.redhat.com ([209.132.183.28]:31874 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753116AbaFLRA7 (ORCPT ); Thu, 12 Jun 2014 13:00:59 -0400 Date: Thu, 12 Jun 2014 13:00:44 -0400 From: Vivek Goyal To: Mimi Zohar Cc: Dmitry Kasatkin , dhowells@redhat.com, jwboyer@redhat.com, keyrings@linux-nfs.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dmitry.kasatkin@gmail.com, mjg59@srcf.ucam.org Subject: Re: [PATCH 3/4] KEYS: validate key trust only with selected owner key Message-ID: <20140612170044.GI9578@redhat.com> References: <20140612160346.GG9578@redhat.com> <1402592126.5318.32.camel@dhcp-9-2-203-236.watson.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1402592126.5318.32.camel@dhcp-9-2-203-236.watson.ibm.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jun 12, 2014 at 12:55:26PM -0400, Mimi Zohar wrote: > On Thu, 2014-06-12 at 12:03 -0400, Vivek Goyal wrote: > > On Tue, Jun 10, 2014 at 11:48:17AM +0300, Dmitry Kasatkin wrote: > > > This patch provides kernel parameter to specify owner's key id which > > > must be used for trust validate of keys. Keys signed with other keys > > > are not trusted. > > > > > > Signed-off-by: Dmitry Kasatkin > > > > Hi, > > > > I am continuing to work on verifying kernel signature for kexec/kdump. I > > am planning to take david howell's patches for pkcs7 signature > > verification and verify bzImage signature. > > > > Part of that process will boil down to verifying a certificate in > > pkcs7 x509 cert chain using a key in system_trusted_keyring. > > > > I think the OS vendor key which signs the kernel signing key propagates to > > system_trusted_keyring. (shim has that and I am not sure how shim makes > > it propogate all they way to system_trusted_keyring). > > The shim patches are here > http://pkgs.fedoraproject.org/cgit/kernel.git/tree/modsign-uefi.patch > > > So I was planning to use same functionality where I look for any key > > which can verify the signing cert of kernel. As OS vendor key will be > > in system_trusted_keyring, it should work. > > > > Now with this change where you will trust only one selected owner key. > > That means you will not even trust the OS vendor key which signs kernel > > signing key. I think this will stop working with keys_ownerid=<....> > > > > As I am doing that work in parallel and I saw these patches, I thought > > I will bring it up. > > Right, the current discussion is whether we need an owner trusted > keyring or if just one key was enough. Thanks for chiming in. > > The other option would be to sign the bzImage file creating a > 'security.ima' extended attribute and verifying it. Have you created a > security kexec hook? No, I have not created another hook. As bzImage is already signed it is much simpler to verify same signature instead of carrying another set of detached signatures and key management etc. Thanks Vivek -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/