Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) client-ip=2620:137:e000::3:1;
MIME-Version: 1.0
References: <CEA476C1-4CE5-4FFC-91D7-6061C8605B18@oracle.com>
 <ba2f5560800608541e81fbdd28efa9875b35e491.camel@linux.ibm.com>
 <932231F5-8050-4436-84B8-D7708DC43845@oracle.com> <7335a4587233626a39ce9bc8a969957d7f43a34c.camel@linux.ibm.com>
 <FD6FB139-F901-4E55-9705-E7B0023BDBA8@oracle.com> <1149b6dbfdaabef3e48dc2852cc76aa11a6dd6b0.camel@linux.ibm.com>
 <4A0505D0-2933-43BD-BEEA-94350BB22AE7@oracle.com> <20230913.Ceifae7ievei@digikod.net>
 <D0F16BFD-72EB-4BE2-BA3D-BAE1BCCDCB6F@oracle.com> <20230914.shah5al9Kaib@digikod.net>
 <20231005.dajohf2peiBu@digikod.net> <d3b51f26c14fd273d41da3432895fdce9f4d047c.camel@linux.ibm.com>
 <CAHC9VhRdU1CZJpPSEdSmui-Xirr0j261K=+SM7KiDwiPG-JSrQ@mail.gmail.com> <a851227aaa75ab16b0d6dd93433e1ee1679715f9.camel@linux.ibm.com>
In-Reply-To: <a851227aaa75ab16b0d6dd93433e1ee1679715f9.camel@linux.ibm.com>
From:   Paul Moore <paul@paul-moore.com>
Date:   Tue, 17 Oct 2023 13:29:07 -0400
Message-ID: <CAHC9VhS_Ttdy5ZB=jYdVfNyaJfn_7G1wztr5+g0g7uUDForXvA@mail.gmail.com>
Subject: Re: RFC: New LSM to control usage of x509 certificates
To:     Mimi Zohar <zohar@linux.ibm.com>
Cc:     =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= <mic@digikod.net>,
        Eric Snowberg <eric.snowberg@oracle.com>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Jarkko Sakkinen <jarkko@kernel.org>,
        David Howells <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>,
        Kanth Ghatraju <kanth.ghatraju@oracle.com>,
        Konrad Wilk <konrad.wilk@oracle.com>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        linux-security-module@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Tue, Oct 17, 2023 at 1:09=E2=80=AFPM Mimi Zohar <zohar@linux.ibm.com> wr=
ote:
> On Tue, 2023-10-17 at 11:45 -0400, Paul Moore wrote:
> > On Tue, Oct 17, 2023 at 9:48=E2=80=AFAM Mimi Zohar <zohar@linux.ibm.com=
> wrote:
> > > On Thu, 2023-10-05 at 12:32 +0200, Micka=C3=ABl Sala=C3=BCn wrote:
> > > > > > > A complementary approach would be to create an
> > > > > > > LSM (or a dedicated interface) to tie certificate properties =
to a set of
> > > > > > > kernel usages, while still letting users configure these cons=
traints.
> > > > > >
> > > > > > That is an interesting idea.  Would the other security maintain=
ers be in
> > > > > > support of such an approach?  Would a LSM be the correct interf=
ace?
> > > > > > Some of the recent work I have done with introducing key usage =
and CA
> > > > > > enforcement is difficult for a distro to pick up, since these c=
hanges can be
> > > > > > viewed as a regression.  Each end-user has different signing pr=
ocedures
> > > > > > and policies, so making something work for everyone is difficul=
t.  Letting the
> > > > > > user configure these constraints would solve this problem.
> > >
> > > Something definitely needs to be done about controlling the usage of
> > > x509 certificates.  My concern is the level of granularity.  Would th=
is
> > > be at the LSM hook level or even finer granaularity?
> >
> > You lost me, what do you mean by finer granularity than a LSM-based
> > access control?  Can you give an existing example in the Linux kernel
> > of access control granularity that is finer grained than what is
> > provided by the LSMs?
>
> The current x509 certificate access control granularity is at the
> keyring level.  Any key on the keyring may be used to verify a
> signature.  Finer granularity could associate a set of certificates on
> a particular keyring with an LSM hook - kernel modules, BPRM, kexec,
> firmware, etc.  Even finer granularity could somehow limit a key's
> signature verification to files in particular software package(s) for
> example.
>
> Perhaps Micka=C3=ABl and Eric were thinking about a new LSM to control us=
age
> of x509 certificates from a totally different perspective.  I'd like to
> hear what they're thinking.
>
> I hope this addressed your questions.

Okay, so you were talking about finer granularity when compared to the
*current* LSM keyring hooks.  Gotcha.

If we need additional, or modified, hooks that shouldn't be a problem.
Although I'm guessing the answer is going to be moving towards
purpose/operation specific keyrings which might fit in well with the
current keyring level controls.

--=20
paul-moore.com