Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <61a0420790250807837b5a701bb52f3d63ff0c84.camel@linux.ibm.com>
Subject: Re: [PATCH v4] certs: Add EFI_CERT_X509_GUID support for dbx entries
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     David Howells <dhowells@redhat.com>,
        Jarkko Sakkinen <jarkko@kernel.org>,
        linux-integrity <linux-integrity@vger.kernel.org>
Cc:     Eric Snowberg <eric.snowberg@oracle.com>,
        Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
        dwmw2@infradead.org, herbert@gondor.apana.org.au,
        davem@davemloft.net, jmorris@namei.org, serge@hallyn.com,
        nayna@linux.ibm.com, erichte@linux.ibm.com, mpe@ellerman.id.au,
        keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-crypto@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        James.Bottomley@hansenpartnership.com
Date:   Wed, 27 Jan 2021 09:03:59 -0500
In-Reply-To: <3063834.1611747971@warthog.procyon.org.uk>
References: <YAjMm9Gq/FFOzQYG@kernel.org>
         <E090372C-06A3-4991-8FC3-F06A0DA60729@oracle.com>
         <20200916004927.64276-1-eric.snowberg@oracle.com>
         <1360578.1607593748@warthog.procyon.org.uk>
         <2442460.1610463459@warthog.procyon.org.uk>
         <X/9a8naM8p4tT5sO@linux.intel.com>
         <A05E3573-B1AF-474B-94A5-779E69E5880A@oracle.com>
         <YAFdNiYZSWpB9vOw@kernel.org>
         <CFBF6AEC-2832-44F7-9D7F-F20489498C33@oracle.com>
         <YAgTawk3EENF/P6j@kernel.org>
         <D9F5E0BD-E2FC-428F-91B3-35D2750493A0@oracle.com>
         <3063834.1611747971@warthog.procyon.org.uk>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

[Cc'ing linux-integrity]

On Wed, 2021-01-27 at 11:46 +0000, David Howells wrote:
> Jarkko Sakkinen <jarkko@kernel.org> wrote:
> 
> > > I suppose a user space tool could be created. But wouldn’t what is
> > > currently done in the kernel in this area need to be removed?
> > 
> > Right. I don't think this was a great idea in the first place to
> > do to the kernel but since it exists, I guess the patch does make
> > sense.
> 
> This information needs to be loaded from the UEFI tables before the system
> starts loading any kernel modules or running any programs (if we do
> verification of such, which I think IMA can do).

There needs to a clear distinction between the pre-boot and post-boot
keys.  UEFI has its own trust model, which should be limited to UEFI. 
The .platform keyring was upstreamed and limited to verifying the kexec
kernel image.   Any other usage of the .platform keyring keys is
abusing its intended purpose.

The cover letter says,   "Anytime the .platform keyring is used, the
keys in the .blacklist keyring are referenced, if a matching key is
found, the key will be rejected."   I don't have a problem with loading
the UEFI X509 dbx entries as long as its usage is limited to verifying
the kexec kernel image.

Mimi