Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756839AbbEUVog (ORCPT ); Thu, 21 May 2015 17:44:36 -0400 Received: from mail-ob0-f177.google.com ([209.85.214.177]:33761 "EHLO mail-ob0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755792AbbEUVoe (ORCPT ); Thu, 21 May 2015 17:44:34 -0400 MIME-Version: 1.0 In-Reply-To: <20150521213829.GH23057@wotan.suse.de> References: <20150515123513.16723.96340.stgit@warthog.procyon.org.uk> <555BD715.40202@kernel.org> <31772.1432128969@warthog.procyon.org.uk> <20150520162059.GC10473@localhost> <20150521213829.GH23057@wotan.suse.de> From: Andy Lutomirski Date: Thu, 21 May 2015 14:44:13 -0700 Message-ID: Subject: Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4] To: "Luis R. Rodriguez" Cc: David Howells , Andy Lutomirski , Rusty Russell , Michal Marek , Matthew Garrett , keyrings@linux-nfs.org, Dmitry Kasatkin , "linux-kernel@vger.kernel.org" , Seth Forshee , LSM List , David Woodhouse Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2445 Lines: 50 On Thu, May 21, 2015 at 2:38 PM, Luis R. Rodriguez wrote: > On Wed, May 20, 2015 at 07:21:00PM +0300, Petko Manolov wrote: >> On 15-05-20 08:56:21, Andy Lutomirski wrote: >> > >> > Would it make more sense to permit X.509 chains to be loaded into the keyring >> > instead if we actually need that feature? IOW, let userspace (or early >> > initramfs stuff) extend our keyring trust to intermediate certs that validly >> > chain to already-trusted things? I think that a reasonable design goal would >> > be that everything overcomplicated that's involved should be optional, and >> > moving toward embedding PKCS#7 signatures in the modules themselves does the >> > other direction? >> >> This is similar to what i am doing right now - create CA hierarchy so we can >> have something like: >> >> +-> KeyB >> | >> RootCA ---> CertA ---> CertB ---> CertC ---> KeyC >> | >> +-> CertA' ---> KeyA" > > How exactly do you go about uploading CertB to the kernel BTW? And could fw > signing replace that functionality? Keep in mind "fw uploading" should be > rebranded as "system data upload", which is one of the goals I have when > extending the firware_class module. In PKCS#7 land, you don't. Instead you stick CertB and CertC into the PKCS#7 signature on the module signed by KeyC. Then the kernel verifies them (in theory) using the X.509/PKIX godawful verification algorithm. For fun, go search for the large number of errors in the implementation of this awful algorithm in basically every TLS implementation out there. One option would be to add another type of verifiable thing. We can verify modules, and we should add firmware to the types of things that can be signed. We could add signing keys, too. IOW, you could ask the kernel to load a signing key with certain rights, and, if they key is validly signed by some other key that has the same rights and has a bit set saying that it can delegate those rights, then the kernel will add that signing key to the keyring. If the general infrastructure were there, this would be very little additional code. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/