From: Arvind Sankar <nivedita@alum.mit.edu>
To: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Greg KH <gregkh@linuxfoundation.org>,
Andy Lutomirski <luto@kernel.org>, Rob Landley <rob@landley.net>,
Arvind Sankar <niveditas98@gmail.com>,
LKML <linux-kernel@vger.kernel.org>,
Linux API <linux-api@vger.kernel.org>,
Linux FS Devel <linux-fsdevel@vger.kernel.org>,
linux-integrity <linux-integrity@vger.kernel.org>,
initramfs@vger.kernel.org
Subject: Re: [PATCH v2 0/3] initramfs: add support for xattrs in the initial ram disk
Date: Tue, 14 May 2019 20:25:57 -0400 [thread overview]
Message-ID: <20190515002556.GA88615@rani.riverdale.lan> (raw)
In-Reply-To: <f01ad775-54de-033f-d8cb-f27f36e92f0c@huawei.com>
On Tue, May 14, 2019 at 07:20:15PM +0200, Roberto Sassu wrote:
> On 5/14/2019 6:58 PM, Greg KH wrote:
> > On Tue, May 14, 2019 at 06:33:29PM +0200, Roberto Sassu wrote:
> >> Right, the measurement/signature verification of the kernel image is
> >> sufficient.
> >>
> >> Now, assuming that we defer the IMA initialization until /init in the
> >> embedded initramfs has been executed, the problem is how to handle
> >> processes launched with the user mode helper or files directly read by
> >> the kernel (if it can happen before /init is executed). If IMA is not
> >> yet enabled, these operations will be performed without measurement and
> >> signature verification.
> >
> > If you really care about this, don't launch any user mode helper
> > programs (hint, you have the kernel option to control this and funnel
> > everything into one, or no, binaries). And don't allow the kernel to
> > read any files either, again, you have control over this.
> >
> > Or start IMA earlier if you need/want/care about this.
>
> Yes, this is how it works now. It couldn't start earlier than
> late_initcall, as it has to wait until the TPM driver is initialized.
>
> Anyway, it is enabled at the time /init is executed. And this would be
> an issue because launching /init and reading xattrs from /.xattr-list
> would be denied (the signature is missing).
>
> And /.xattr-list won't have a signature, if initramfs is generated
> locally.
>
> Roberto
>
> --
> HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
> Managing Director: Bo PENG, Jian LI, Yanli SHI
The uevent and firmware loader user mode helpers are both obsolete I
believe, so those shouldn't be an issue.
There is still the internal firmware loader (CONFIG_FW_LOADER). If this
is built-in, there's probably no way to 100% stop it racing with /init if we
depend on an embedded /init and a malicious external initramfs image
contains /lib/firmware, but it can be built as an external module, in
which case there should be no danger until the boot process actually loads it.
next prev parent reply other threads:[~2019-05-15 0:26 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-09 11:24 [PATCH v2 0/3] initramfs: add support for xattrs in the initial ram disk Roberto Sassu
2019-05-09 11:24 ` [PATCH v2 1/3] fs: add ksys_lsetxattr() wrapper Roberto Sassu
2019-05-10 21:28 ` Jann Horn
2019-05-09 11:24 ` [PATCH v2 2/3] initramfs: set extended attributes Roberto Sassu
2019-05-09 11:24 ` [PATCH v2 3/3] initramfs: introduce do_readxattrs() Roberto Sassu
2019-05-10 21:33 ` Jann Horn
2019-05-13 13:03 ` Roberto Sassu
2019-05-09 18:34 ` [PATCH v2 0/3] initramfs: add support for xattrs in the initial ram disk Rob Landley
2019-05-10 6:56 ` Roberto Sassu
2019-05-10 11:49 ` Mimi Zohar
2019-05-10 20:46 ` Rob Landley
2019-05-10 22:38 ` Mimi Zohar
2019-05-11 22:44 ` Andy Lutomirski
2019-05-12 4:04 ` Rob Landley
2019-05-12 4:12 ` Rob Landley
2019-05-12 9:17 ` Dominik Brodowski
2019-05-12 10:18 ` hpa
2019-05-12 15:31 ` Dominik Brodowski
2019-05-13 0:02 ` Mimi Zohar
2019-05-13 0:21 ` hpa
2019-05-13 0:23 ` hpa
2019-05-12 12:52 ` Mimi Zohar
2019-05-12 17:05 ` Rob Landley
2019-05-12 19:43 ` Arvind Sankar
2019-05-13 7:49 ` Roberto Sassu
2019-05-13 9:07 ` Rob Landley
2019-05-13 12:08 ` Mimi Zohar
2019-05-13 12:47 ` Roberto Sassu
2019-05-13 17:20 ` Arvind Sankar
2019-05-13 17:51 ` Arvind Sankar
2019-05-13 17:52 ` Arvind Sankar
2019-05-13 18:36 ` Mimi Zohar
2019-05-13 18:47 ` Arvind Sankar
2019-05-13 22:09 ` Mimi Zohar
2019-05-14 6:06 ` Rob Landley
2019-05-14 14:44 ` Arvind Sankar
2019-05-14 6:06 ` Rob Landley
2019-05-14 11:52 ` Roberto Sassu
2019-05-14 15:12 ` Rob Landley
2019-05-14 15:27 ` Arvind Sankar
2019-05-14 15:57 ` Arvind Sankar
2019-05-14 17:44 ` Roberto Sassu
2019-05-15 1:00 ` Arvind Sankar
2019-05-14 15:19 ` Andy Lutomirski
2019-05-14 16:33 ` Roberto Sassu
2019-05-14 16:58 ` Greg KH
2019-05-14 17:20 ` Roberto Sassu
2019-05-15 0:25 ` Arvind Sankar [this message]
2019-05-14 19:18 ` James Bottomley
2019-05-14 23:39 ` Rob Landley
2019-05-14 23:54 ` James Bottomley
2019-05-15 0:52 ` Arvind Sankar
2019-05-15 11:19 ` Roberto Sassu
2019-05-15 16:08 ` Arvind Sankar
2019-05-15 17:06 ` Roberto Sassu
2019-05-16 5:29 ` Arvind Sankar
2019-05-16 11:42 ` Roberto Sassu
2019-05-16 13:31 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190515002556.GA88615@rani.riverdale.lan \
--to=nivedita@alum.mit.edu \
--cc=gregkh@linuxfoundation.org \
--cc=initramfs@vger.kernel.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=niveditas98@gmail.com \
--cc=rob@landley.net \
--cc=roberto.sassu@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).