Received-SPF: pass (google.com: domain of linux-kernel+bounces-74850-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Wed, 21 Feb 2024 06:02:30 -0800
From: "H. Peter Anvin" <hpa@zytor.com>
To: Petr Tesarik <petr.tesarik1@huawei-partners.com>,
        Roberto Sassu <roberto.sassu@huaweicloud.com>,
        Matthew Wilcox <willy@infradead.org>,
        Petr Tesarik <petrtesarik@huaweicloud.com>
CC: Dave Hansen <dave.hansen@intel.com>,
        =?UTF-8?Q?Petr_Tesa=C5=99=C3=ADk?= <petr@tesarici.cz>,
        Jonathan Corbet <corbet@lwn.net>, Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@kernel.org>,
        Andy Lutomirski <luto@kernel.org>, Oleg Nesterov <oleg@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>, Xin Li <xin3.li@intel.com>,
        Arnd Bergmann <arnd@arndb.de>,
        Andrew Morton <akpm@linux-foundation.org>,
        Rick Edgecombe <rick.p.edgecombe@intel.com>,
        Kees Cook <keescook@chromium.org>,
        "Masami Hiramatsu (Google)" <mhiramat@kernel.org>,
        Pengfei Xu <pengfei.xu@intel.com>,
        Josh Poimboeuf <jpoimboe@kernel.org>, Ze Gao <zegao2021@gmail.com>,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        Kai Huang <kai.huang@intel.com>, David Woodhouse <dwmw@amazon.co.uk>,
        Brian Gerst <brgerst@gmail.com>, Jason Gunthorpe <jgg@ziepe.ca>,
        Joerg Roedel <jroedel@suse.de>,
        "Mike Rapoport (IBM)" <rppt@kernel.org>,
        Tina Zhang <tina.zhang@intel.com>,
        Jacob Pan <jacob.jun.pan@linux.intel.com>,
        "open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        David Howells <dhowells@redhat.com>
Subject: Re: [RFC 6/8] KEYS: PGP data parser
User-Agent: K-9 Mail for Android
In-Reply-To: <773dd9fb-e668-4652-8b24-712553bb7ab1@huawei-partners.com>
References: <fb4a40c7-af9a-406a-95ab-406595f3ffe5@intel.com> <20240216152435.1575-1-petrtesarik@huaweicloud.com> <20240216152435.1575-7-petrtesarik@huaweicloud.com> <Zc-Q5pVHjngq9lpX@casper.infradead.org> <5916fa3ac3d0ce2ade71e7ed1c9eb6923e374c1f.camel@huaweicloud.com> <EC53BCED-0D4C-4561-9041-584378326DD5@zytor.com> <773dd9fb-e668-4652-8b24-712553bb7ab1@huawei-partners.com>
Message-ID: <70F9F1E7-4803-46C8-AB6E-AC1CF345F03E@zytor.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

On February 20, 2024 2:55:12 AM PST, Petr Tesarik <petr=2Etesarik1@huawei-p=
artners=2Ecom> wrote:
>On 2/16/2024 6:08 PM, H=2E Peter Anvin wrote:
>> On February 16, 2024 8:53:01 AM PST, Roberto Sassu <roberto=2Esassu@hua=
weicloud=2Ecom> wrote:
>>> On Fri, 2024-02-16 at 16:44 +0000, Matthew Wilcox wrote:
>>>> On Fri, Feb 16, 2024 at 04:24:33PM +0100, Petr Tesarik wrote:
>>>>> From: David Howells <dhowells@redhat=2Ecom>
>>>>>
>>>>> Implement a PGP data parser for the crypto key type to use when
>>>>> instantiating a key=2E
>>>>>
>>>>> This parser attempts to parse the instantiation data as a PGP packet
>>>>> sequence (RFC 4880) and if it parses okay, attempts to extract a pub=
lic-key
>>>>> algorithm key or subkey from it=2E
>>>>
>>>> I don't understand why we want to do this in-kernel instead of in
>>>> userspace and then pass in the actual key=2E
>>>
>>> Sigh, this is a long discussion=2E
>>>
>>> PGP keys would be used as a system-wide trust anchor to verify RPM
>>> package headers, which already contain file digests that can be used a=
s
>>> reference values for kernel-enforced integrity appraisal=2E
>>>
>>> With the assumptions that:
>>>
>>> - In a locked-down system the kernel has more privileges than root
>>> - The kernel cannot offload this task to an user space process due to
>>>  insufficient isolation
>>>
>>> the only available option is to do it in the kernel (that is what I go=
t
>>> as suggestion)=2E
>>>
>>> Roberto
>>>
>>>
>>=20
>> Ok, at least one of those assumptions is false, and *definitely* this a=
pproach seems to be a solution in search of a problem=2E
>
>As a matter of fact, there is some truth to this observation=2E
>
>The frustrating story of Roberto's PGP parser sparked the idea, but it
>would clearly be overkill to add all this code just for this one parser=
=2E
>I started looking around if there are other potential uses of a sandbox
>mode, which might justify the effort=2E I quickly found out that it is
>difficult to find a self-contained part of the kernel=2E
>
>Now I believe that these dependencies among different parts of the
>kernel present an issue, both to kernel security and to maintainability
>of the source code=2E Even if sandbox mode as such is rejected (hopefully
>with an explanation of the reasons), I believe that it is good to split
>the kernel into smaller parts and reduce their interdependencies=2E In
>this sense, sandbox mode is a way to express and enforce the remaining
>dependencies=2E
>
>Petr T

Congratulations=2E You just reinvented the microkernel=2E