Received: by 2002:a05:6358:7058:b0:131:369:b2a3 with SMTP id 24csp332236rwp; Wed, 12 Jul 2023 14:09:43 -0700 (PDT) X-Google-Smtp-Source: APBJJlH0bU1PbcnOU/TtHWdcSCCDEObAXBW5sPn1iK/d3mzWSyFScK47/6aaOvtxNKyXLaHc6M3m X-Received: by 2002:aa7:cf06:0:b0:51d:f37b:1b5c with SMTP id a6-20020aa7cf06000000b0051df37b1b5cmr8377347edy.23.1689196182871; Wed, 12 Jul 2023 14:09:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1689196182; cv=none; d=google.com; s=arc-20160816; b=APEh+qKOluXD9m3Ke6fosr/iNR8ffv8haRSwPfHGjqdrAx2fh+hO1I3fHROhoFA+Nx JUFKc63E/GJ+OOb+qRyxWTRTR5ITe1SjtmzbS2bkAxHfretWcCny5ps4WvilNjSrRvau h5Exf9sOKx1IndxmXtHs+P05PXBpl//Es0MzMIPwHEr7lM2ftAc4xcXgwZzmldfXDq2s HFycPx39NEjNLIfjKIi3ZaLora1fFk12mcsUAIRiwQCyDCR/7SbTvZSkUMZuzd4fe7oj gZAS9D56cDvXCEsPzEjXdhBp55WMlV8BqRXZmvgdwjhdQBG7qOgaowAnz2eHqbdaP7LG R/dQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:cc:to:subject :message-id:date:from:in-reply-to:references:mime-version; bh=Z/oVxk3o8HYcGeKfILeYttRvWsVW6N03kBpuoqBvHzQ=; fh=GdouKArbZqGSWq/9/7OkUzsbE/2YHljq+lBm3LJWp+Q=; b=Kwr58vmSGNxQd+AYjXhA4cnjZS+HPvhEYy9b8rybABgTzKrjdNQSQqh2dlzgD2OgtW rlDIG4S/U0PJ74QvsmwPnPIgK8LZe0rim3IvGtA6vvcXwnO8ov5uyA70YiO5Z66beQtS 9Or+I1aR5LHVq6jyZWsI5Hfuib7X9Fl77W1wiWUTYCQjWq4cEqMzpol7ahwkO/j7XuzO EK436Jm4JCJV7w/hmG7HT5k/Bt4PFXEIwOFxxGEo6auOGKfigiHd7sJO7k/LLzc3KYNd nsg6akCQgxjxnhNmqJ9IUl1pyYWrVPpgJunneMY70R83ETLVp3x9Epc5oPKxXs/bt9gs YRdg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id m20-20020a50ef14000000b0051e28859bdfsi5895827eds.279.2023.07.12.14.09.18; Wed, 12 Jul 2023 14:09:42 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232452AbjGLUlk convert rfc822-to-8bit (ORCPT + 99 others); Wed, 12 Jul 2023 16:41:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55444 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232314AbjGLUli (ORCPT ); Wed, 12 Jul 2023 16:41:38 -0400 Received: from mail-yw1-f175.google.com (mail-yw1-f175.google.com [209.85.128.175]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6F6F019B9 for ; Wed, 12 Jul 2023 13:41:36 -0700 (PDT) Received: by mail-yw1-f175.google.com with SMTP id 00721157ae682-5774335bb2aso80292147b3.0 for ; Wed, 12 Jul 2023 13:41:36 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689194495; x=1691786495; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0WUYKlpGhb0kJhf/+AumZoaOJjlTSMOB9Jdpi/GF+90=; b=kMSUGB+AZV7w79y8nTDXIgfeyxw1/UWUIs8IanU5ob3Ki0E8pU8mFjkz4poQil2kpv lWcsWvVerPouKkwBvb8SgBSILJXpN5XKq9L87aFL/c2P2RDx+DOMW9RqNNVpHQAn2UIG lQn/2WpZfphbJKplYRS8hZSYDFyiPgb4rtxMCNmWAj030XPsIsMvNjo5dDLHxn9OpHPk nRJ8nPkcLkhqoZVzmTvncDsTKk2T0orEm0s+Xw12feiGGqtbm+MR9tLU5s7REHk8qcy4 CQlc2ME06Gp079zysFvcBg/NjlHCFP3/6HG3jT3aKDal1LOtA3XSLV/y7GcdGjfKYZ70 I5oQ== X-Gm-Message-State: ABy/qLYf1PqU/VEeeAv75G6HYXB2K9YGaqLL+eFw/gK0QXKbWXqp2ctr n+h2zkmJfPBgsZW05dcVzTt8DgZe+h8G5g== X-Received: by 2002:a0d:d40c:0:b0:56d:3d83:15cb with SMTP id w12-20020a0dd40c000000b0056d3d8315cbmr17059654ywd.44.1689194495448; Wed, 12 Jul 2023 13:41:35 -0700 (PDT) Received: from mail-yw1-f181.google.com (mail-yw1-f181.google.com. [209.85.128.181]) by smtp.gmail.com with ESMTPSA id k63-20020a0dfa42000000b005773babc3cdsm1375653ywf.83.2023.07.12.13.41.35 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 12 Jul 2023 13:41:35 -0700 (PDT) Received: by mail-yw1-f181.google.com with SMTP id 00721157ae682-5774335bb2aso80291947b3.0 for ; Wed, 12 Jul 2023 13:41:35 -0700 (PDT) X-Received: by 2002:a0d:fa44:0:b0:577:cd0:681f with SMTP id k65-20020a0dfa44000000b005770cd0681fmr19302553ywf.26.1689194494878; Wed, 12 Jul 2023 13:41:34 -0700 (PDT) MIME-Version: 1.0 References: <20230712120002.GIZK6Vwga6DlJqdjEh@fat_crate.local> <20230712132840.GKZK6qiK70m1O90jFL@fat_crate.local> <2023071200-unopposed-unbuckled-cde8@gregkh> <2023071239-progress-molasses-3b3d@gregkh> <2023071229-dusk-repacking-da3a@gregkh> <2023071226-crafty-deviator-12e2@gregkh> In-Reply-To: <2023071226-crafty-deviator-12e2@gregkh> From: Luca Boccassi Date: Wed, 12 Jul 2023 21:41:23 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC PATCH v2] x86/boot: add .sbat section to the bzImage To: Greg KH Cc: =?UTF-8?Q?Daniel_P=2E_Berrang=C3=A9?= , Borislav Petkov , Emanuele Giuseppe Esposito , "H. Peter Anvin" , x86@kernel.org, Thomas Gleixner , lennart@poettering.net, Ingo Molnar , Dave Hansen , Andrew Morton , Masahiro Yamada , Alexander Potapenko , Nick Desaulniers , Vitaly Kuznetsov , linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8BIT X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_00, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 12 Jul 2023 at 21:07, Greg KH wrote: > > On Wed, Jul 12, 2023 at 08:35:14PM +0100, Luca Boccassi wrote: > > On Wed, 12 Jul 2023 at 20:05, Greg KH wrote: > > > > > > On Wed, Jul 12, 2023 at 07:59:12PM +0100, Luca Boccassi wrote: > > > > On Wed, 12 Jul 2023 at 17:57, Greg KH wrote: > > > > > > > > > > On Wed, Jul 12, 2023 at 05:23:18PM +0100, Luca Boccassi wrote: > > > > > > On Wed, 12 Jul 2023 at 16:43, Greg KH wrote: > > > > > > > > > > > > > > On Wed, Jul 12, 2023 at 03:06:46PM +0100, Daniel P. Berrangé wrote: > > > > > > > > On Wed, Jul 12, 2023 at 03:28:40PM +0200, Borislav Petkov wrote: > > > > > > > > > On Wed, Jul 12, 2023 at 01:48:45PM +0100, Daniel P. Berrangé wrote: > > > > > > > > > > That doesn't make it useless, as the 3rd/4th/5th fields in the SBAT > > > > > > > > > > file are just human targetted metadata. The validation process just > > > > > > > > > > works off the 1st/2nd field. > > > > > > > > > > > > > > > > > > It's a good thing I asked - feels like I'm just scratching the surface > > > > > > > > > on what this thing actually is and the commit message is not explaining > > > > > > > > > any of that. > > > > > > > > > > > > > > > > > > First, second field, that's what, "linux,1"? > > > > > > > > > > > > > > > > Each sbat CSV file line has following fields: > > > > > > > > > > > > > > > > component_name: the name we're comparing > > > > > > > > component_generation: the generation number for the comparison > > > > > > > > vendor_name: human readable vendor name > > > > > > > > vendor_package_name: human readable package name > > > > > > > > vendor_version: human readable package version (maybe machine parseable too, not specified here) > > > > > > > > vendor_url: url to look stuff up, contact, whatever. > > > > > > > > > > > > > > > > So 'linux' is 'component_name' and '1' is component_generation > > > > > > > > > > > > > > > > > > From a functional POV, it doesn't have to be unique identified, > > > > > > > > > > as it is just a human targetted metadata field. A friendly git > > > > > > > > > > version as from 'git describe' is more appropriate than a build > > > > > > > > > > ID sha. > > > > > > > > > > > > > > > > > > So can you explain what exactly that version is supposed to describe? > > > > > > > > > Exact kernel sources the kernel was built from? Or a random, increasing > > > > > > > > > number which tools can use to mark as bad? > > > > > > > > > > > > > > > > AFAICT beyond being "human readable package version", it is a fairly > > > > > > > > arbitrary decision. A release version number for formal releases, or > > > > > > > > a 'git describe' version string for git snapshots both satisfy the > > > > > > > > versioning requirement IMHO. > > > > > > > > > > > > > > > > > How do you prevent people from binary-editing that section? Secure boot > > > > > > > > > does that because that changes the signed kernel image? > > > > > > > > > > > > > > > > The PE files are signed by the vendor who builds them, using their > > > > > > > > SecureBoot signing key. The data covered by the signature includes > > > > > > > > the '.sbat' section. > > > > > > > > > > > > > > > > IOW, if you binary edit the section, the SecureBoot signature > > > > > > > > verification fails and the kernel won't be booted. > > > > > > > > > > > > > > > > > > > And then why does it have to be a separate section? All those > > > > > > > > > > > requirements need to be written down. > > > > > > > > > > > > > > > > > > You missed this question. > > > > > > > > > > > > > > > > That's simply what the spec defines as the approach. > > > > > > > > > > > > > > > > The PE file format used by EFI applications has multiple > > > > > > > > sections and the spec has declare that the '.sbat' section > > > > > > > > is where this data shall live. > > > > > > > > > > > > > > > > > > The first line just identifies the file format and should > > > > > > > > > > never change: > > > > > > > > > > > > > > > > > > > > sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md > > > > > > > > > > > > > > > > > > Why do you even need it then? > > > > > > > > > > > > > > > > First it identifies the data format, and second if a > > > > > > > > problem is ever discovered with the SBAT concept, > > > > > > > > a fixed approach can be indicated by changing to > > > > > > > > 'sbat,2,.....' and thus have the effect of revoking > > > > > > > > use of any binaries which declare the 'sbat,1,....' > > > > > > > > version. Pretty unlikely this will happen, but a useful > > > > > > > > backup plan/safety net. > > > > > > > > > > > > > > > > > > The second line identifies the kernel generation > > > > > > > > > > > > > > > > > > > > linux,1,The Linux Developers,linux,6.5.0-rc1,https://linux.org > > > > > > > > > > > > > > > > > > > > The first field 'linux' should never change once decided upon, as it is > > > > > > > > > > the name of the upstream project's EFI component - in this case the > > > > > > > > > > linux kernel. > > > > > > > > > > > > > > > > > > > > The second field '1' is the most important one, as it is the mechanism > > > > > > > > > > through which revokation takes places, and the only one a human upstream > > > > > > > > > > maintainer should manually change. > > > > > > > > > > > > > > > > > > Hold on, how often are those things going to change? And who's going to > > > > > > > > > change them? I sure hope we won't start getting patches constantly > > > > > > > > > updating those numbers? > > > > > > > > > > > > > > > > It is hard to predict the future, but my gut feeling is very infrequently. > > > > > > > > > > > > > > Have you looked at the past as proof of this? > > > > > > > > > > > > I can't quite think of relevant bugs, in the recent past. Are you > > > > > > aware of past instances of kernel module signature verification being > > > > > > broken? Or userspace being allowed to do arbitrary kernel memory > > > > > > manipulation before ExitBootServices? > > > > > > > > > > Yes. > > > > > > > > Then you already know the answer w.r.t. frequency > > > > > > I have a clue, yes. But given that others do not that are proposing > > > this, that's quite worrying. > > > > Not really, as that's not the purpose. As the documentation clearly > > states, the purpose is to have a revocation mechanism that won't > > exhaust nvram space. > > How do you know that the list of issues will not exhaust it, if you > don't know how many issues are found? > > Take the time and look over the past 10 years and get an idea of what > you are dealing with here please. > > Also note that "single identifiers for individual issues" do NOT work > for kernel fixes (and arguably do not work for any other software > project either) as they fail to properly describe things. > > Think about Meltdown, one "identifier" of a CVE, and hundreds of > patches. What if you happened to not backport one of them? > > Same goes for the issue reported last week or so, tens of fixes, over > multiple stable kernel releases, for one "identifier", how would you > have classified that? > > Anyway, I've been over this loads before, giving whole talks about this, > there's a reason the kernel developers don't mess with CVEs (i.e. > individual identifiers), they fail to work. There is no 'single identifier for individual issues' nor CVE involved here. The purpose of the generation id (which is per EFI component, not per bug) is to let the boot process know whether an EFI component should be accepted or rejected, in a way that doesn't exhaust nvram. Issues are not individually singled out, and there is no direct correlation with CVEs. It doesn't matter how many fixes there are, or how many bugs, if a generation of a component is vulnerable in any way that matters, then it gets denied. The only thing that matters is, "if we had infinite space in DBX and sensible ways to service it and nvram didn't wear down, would we blocklist this component version" - if the answer is no, then nothing happens. If the answer is yes, then the counter goes up. > > > > > And no, I will not provide examples for obvious reasons. > > > > > > > > Security-through-obscurity? Nice! > > > > > > That's not what this is, please see the many places this is explained > > > in detail. If you wish to discuss how the kernel security team handles > > > known security fixes, we can do so on a relevant thread (i.e. not this > > > one.) > > > > > > > > > > > I can't say I recall any specific Linux bugs that would warrant it, but > > > > > > > > those involved in Linux/Bootloade/SecureBoot world can probably answer > > > > > > > > this better than me. IIUC, the scope of bugs relevent to this is quite > > > > > > > > narrow. > > > > > > > > > > > > > > Really? I know a lot of people who would disagree... > > > > > > > > > > > > They'd better have some convincing reasons > > > > > > > > > > > > > > > > If there is discovered a flaw in Linux that allows the Secure Boot chain > > > > > > > > > > to be broken (eg some flaw allowed linux to be exploited as a mechanism > > > > > > > > > > to load an unsigned binary), then this 'generation' number would need > > > > > > > > > > to be incremented when a fix is provided in upstream Linux trees. > > > > > > > > > > > > > > > > > > Oh boy, there it is. And then when those fixes need to be backported to > > > > > > > > > stable, then those patches updating that number would need to be > > > > > > > > > backported too. I can already see the mess on the horizon. > > > > > > > > > > > > > > > > If applicable, yes. > > > > > > > > > > > > > > And how are you going to determine this? > > > > > > > > > > > > Same as it's done for the bootloaders - does it enable a secure boot > > > > > > bypass -> yes/no > > > > > > > > > > And how are you going to determine this? Seriously, please explain the > > > > > auditing you are going to do here and who is going to maintain it and > > > > > fund the effort? > > > > > > > > Same way it is determined for Shim, Grub, sd-boot, Windows BootMngr, > > > > etc - maintainers doing their jobs, researchers poking at them, or if > > > > we are particularly unlucky by live exploits in the wild. I'm not > > > > exactly sure where the confusion comes from, none of this is novel. > > > > > > But why does any of this matter at all? Just use the kernel version > > > (which is already in the image), and be done with it. We always > > > increment it so all should be fine. > > > > No, all will not be fine, because stable branches exist, so it would > > not be _one_ kernel version but N, with monotonically increasing > > values of N. That doesn't work, and the reason for that are explained > > in the protocol documentation that was linked in the initial mail. > > Pointing to an external document that is thousands of lines long, > talking about bootloaders, is NOT a good way to get people to want to > accept a kernel patch :) Then how about just asking for that? "Hello submitter, please send a v2 with a detailed summary of the problem being solved for those of us who are not familiar with it, thank you"