Re: [PATCH 3/4] KEYS: validate key trust only with selected owner key

From: Vivek Goyal <vgoyal@redhat.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Dmitry Kasatkin <d.kasatkin@samsung.com>,
	dhowells@redhat.com, jwboyer@redhat.com, keyrings@linux-nfs.org,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, dmitry.kasatkin@gmail.com,
	mjg59@srcf.ucam.org
Subject: Re: [PATCH 3/4] KEYS: validate key trust only with selected owner key
Date: Thu, 12 Jun 2014 13:00:44 -0400	[thread overview]
Message-ID: <20140612170044.GI9578@redhat.com> (raw)
In-Reply-To: <1402592126.5318.32.camel@dhcp-9-2-203-236.watson.ibm.com>

On Thu, Jun 12, 2014 at 12:55:26PM -0400, Mimi Zohar wrote:
> On Thu, 2014-06-12 at 12:03 -0400, Vivek Goyal wrote: 
> > On Tue, Jun 10, 2014 at 11:48:17AM +0300, Dmitry Kasatkin wrote:
> > > This patch provides kernel parameter to specify owner's key id which
> > > must be used for trust validate of keys. Keys signed with other keys
> > > are not trusted.
> > > 
> > > Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
> > 
> > Hi,
> > 
> > I am continuing to work on verifying kernel signature for kexec/kdump. I 
> > am planning to take david howell's patches for pkcs7 signature
> > verification and verify bzImage signature.
> > 
> > Part of that process will boil down to verifying a certificate in
> > pkcs7 x509 cert chain using a key in system_trusted_keyring.
> > 
> > I think the OS vendor key which signs the kernel signing key propagates to
> > system_trusted_keyring. (shim has that and I am not sure how shim makes
> > it propogate all they way to system_trusted_keyring).
> 
> The shim patches are here
> http://pkgs.fedoraproject.org/cgit/kernel.git/tree/modsign-uefi.patch
> 
> > So I was planning to use same functionality where I look for any key
> > which can verify the signing cert of kernel. As OS vendor key will be
> > in system_trusted_keyring, it should work.
> > 
> > Now with this change where you will trust only one selected owner key.
> > That means you will not even trust the OS vendor key which signs kernel
> > signing key. I think this will stop working with  keys_ownerid=<....>
> > 
> > As I am doing that work in parallel and I saw these patches, I thought
> > I will bring it up.
> 
> Right, the current discussion is whether we need an owner trusted
> keyring or if just one key was enough.  Thanks for chiming in.
> 
> The other option would be to sign the bzImage file creating a
> 'security.ima' extended attribute and verifying it.  Have you created a
> security kexec hook?

No, I have not created another hook. As bzImage is already signed it is
much simpler to verify same signature instead of carrying another set
of detached signatures and key management etc.

Thanks
Vivek