All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kees Cook <keescook@chromium.org>
To: Mike Snitzer <snitzer@kernel.org>
Cc: linux-security-module@vger.kernel.org,
	Douglas Anderson <dianders@chromium.org>,
	linux-kernel@vger.kernel.org, James Morris <jmorris@namei.org>,
	linux-raid@vger.kernel.org, Song Liu <song@kernel.org>,
	dm-devel@redhat.com, Matthias Kaehlcke <mka@chromium.org>,
	Milan Broz <gmazyland@gmail.com>,
	Alasdair Kergon <agk@redhat.com>,
	"Serge E . Hallyn" <serge@hallyn.com>
Subject: Re: [dm-devel] [PATCH v7 0/3] LoadPin: Enable loading from trusted dm-verity devices
Date: Wed, 6 Jul 2022 20:58:19 -0700	[thread overview]
Message-ID: <202207062058.49046961A4@keescook> (raw)
In-Reply-To: <YsWmPt7xwTlvTfAf@redhat.com>

On Wed, Jul 06, 2022 at 11:11:58AM -0400, Mike Snitzer wrote:
> On Mon, Jun 27 2022 at 11:35P -0400,
> Matthias Kaehlcke <mka@chromium.org> wrote:
> 
> > As of now LoadPin restricts loading of kernel files to a single pinned
> > filesystem, typically the rootfs. This works for many systems, however it
> > can result in a bloated rootfs (and OTA updates) on platforms where
> > multiple boards with different hardware configurations use the same rootfs
> > image. Especially when 'optional' files are large it may be preferable to
> > download/install them only when they are actually needed by a given board.
> > Chrome OS uses Downloadable Content (DLC) [1] to deploy certain 'packages'
> > at runtime. As an example a DLC package could contain firmware for a
> > peripheral that is not present on all boards. DLCs use dm-verity [2] to
> > verify the integrity of the DLC content.
> > 
> > This series extends LoadPin to allow loading of kernel files from trusted
> > dm-verity devices. LoadPin maintains a list of root digests of verity
> > devices it considers trusted. Userspace can populate this list through an
> > ioctl on the new LoadPin securityfs entry 'dm-verity'. The ioctl receives
> > a file descriptor of a file with verity digests as parameter. Verity reads
> > the digests from this file after confirming that the file is located on the
> > pinned root. The digest file must contain one digest per line. The list of
> > trusted digests can only be set up once, which is typically done at boot
> > time.
> > 
> > When a kernel file is read LoadPin first checks (as usual) whether the file
> > is located on the pinned root, if so the file can be loaded. Otherwise, if
> > the verity extension is enabled, LoadPin determines whether the file is
> > located on a verity backed device and whether the root digest of that
> > device is in the list of trusted digests. The file can be loaded if the
> > verity device has a trusted root digest.
> > 
> > [1] https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
> > [2] https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html
> 
> Hi Kees,
> 
> Please pick this series up, thanks.

Thanks for the Acks! I'll get this into -next shortly.

-- 
Kees Cook

--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel


WARNING: multiple messages have this Message-ID
From: Kees Cook <keescook@chromium.org>
To: Mike Snitzer <snitzer@kernel.org>
Cc: Alasdair Kergon <agk@redhat.com>,
	Matthias Kaehlcke <mka@chromium.org>,
	James Morris <jmorris@namei.org>,
	"Serge E . Hallyn" <serge@hallyn.com>,
	linux-kernel@vger.kernel.org, dm-devel@redhat.com,
	Douglas Anderson <dianders@chromium.org>,
	linux-raid@vger.kernel.org, Song Liu <song@kernel.org>,
	linux-security-module@vger.kernel.org,
	Milan Broz <gmazyland@gmail.com>
Subject: Re: [PATCH v7 0/3] LoadPin: Enable loading from trusted dm-verity devices
Date: Wed, 6 Jul 2022 20:58:19 -0700	[thread overview]
Message-ID: <202207062058.49046961A4@keescook> (raw)
In-Reply-To: <YsWmPt7xwTlvTfAf@redhat.com>

On Wed, Jul 06, 2022 at 11:11:58AM -0400, Mike Snitzer wrote:
> On Mon, Jun 27 2022 at 11:35P -0400,
> Matthias Kaehlcke <mka@chromium.org> wrote:
> 
> > As of now LoadPin restricts loading of kernel files to a single pinned
> > filesystem, typically the rootfs. This works for many systems, however it
> > can result in a bloated rootfs (and OTA updates) on platforms where
> > multiple boards with different hardware configurations use the same rootfs
> > image. Especially when 'optional' files are large it may be preferable to
> > download/install them only when they are actually needed by a given board.
> > Chrome OS uses Downloadable Content (DLC) [1] to deploy certain 'packages'
> > at runtime. As an example a DLC package could contain firmware for a
> > peripheral that is not present on all boards. DLCs use dm-verity [2] to
> > verify the integrity of the DLC content.
> > 
> > This series extends LoadPin to allow loading of kernel files from trusted
> > dm-verity devices. LoadPin maintains a list of root digests of verity
> > devices it considers trusted. Userspace can populate this list through an
> > ioctl on the new LoadPin securityfs entry 'dm-verity'. The ioctl receives
> > a file descriptor of a file with verity digests as parameter. Verity reads
> > the digests from this file after confirming that the file is located on the
> > pinned root. The digest file must contain one digest per line. The list of
> > trusted digests can only be set up once, which is typically done at boot
> > time.
> > 
> > When a kernel file is read LoadPin first checks (as usual) whether the file
> > is located on the pinned root, if so the file can be loaded. Otherwise, if
> > the verity extension is enabled, LoadPin determines whether the file is
> > located on a verity backed device and whether the root digest of that
> > device is in the list of trusted digests. The file can be loaded if the
> > verity device has a trusted root digest.
> > 
> > [1] https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
> > [2] https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html
> 
> Hi Kees,
> 
> Please pick this series up, thanks.

Thanks for the Acks! I'll get this into -next shortly.

-- 
Kees Cook

  reply	other threads:[~2022-07-07  3:58 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-27 15:35 [PATCH v7 0/3] LoadPin: Enable loading from trusted dm-verity devices Matthias Kaehlcke
2022-06-27 15:35 ` [dm-devel] " Matthias Kaehlcke
2022-06-27 15:35 ` [PATCH v7 1/3] dm: Add verity helpers for LoadPin Matthias Kaehlcke
2022-06-27 15:35   ` [dm-devel] " Matthias Kaehlcke
2022-07-06 15:06   ` Mike Snitzer
2022-07-06 15:06     ` [dm-devel] " Mike Snitzer
2022-06-27 15:35 ` [PATCH v7 2/3] LoadPin: Enable loading from trusted dm-verity devices Matthias Kaehlcke
2022-06-27 15:35   ` [dm-devel] " Matthias Kaehlcke
2022-07-06 15:08   ` Mike Snitzer
2022-07-06 15:08     ` [dm-devel] " Mike Snitzer
2022-06-27 15:35 ` [PATCH v7 3/3] dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional compilation Matthias Kaehlcke
2022-06-27 15:35   ` [dm-devel] " Matthias Kaehlcke
2022-07-06 15:09   ` Mike Snitzer
2022-07-06 15:09     ` [dm-devel] " Mike Snitzer
2022-07-06 15:11 ` [PATCH v7 0/3] LoadPin: Enable loading from trusted dm-verity devices Mike Snitzer
2022-07-06 15:11   ` [dm-devel] " Mike Snitzer
2022-07-07  3:58   ` Kees Cook [this message]
2022-07-07  3:58     ` Kees Cook
2022-07-08 17:47 ` Kees Cook
2022-07-08 17:47   ` [dm-devel] " Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202207062058.49046961A4@keescook \
    --to=keescook@chromium.org \
    --cc=agk@redhat.com \
    --cc=dianders@chromium.org \
    --cc=dm-devel@redhat.com \
    --cc=gmazyland@gmail.com \
    --cc=jmorris@namei.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-raid@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mka@chromium.org \
    --cc=serge@hallyn.com \
    --cc=snitzer@kernel.org \
    --cc=song@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.