From: "Mickaël Salaün" <mic@digikod.net>
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: "Mike Snitzer" <snitzer@redhat.com>,
"Deven Bowers" <deven.desai@linux.microsoft.com>,
linux-kernel@vger.kernel.org,
"Mickaël Salaün" <mic@linux.microsoft.com>,
dm-devel@redhat.com, linux-integrity@vger.kernel.org,
"Milan Broz" <gmazyland@gmail.com>,
"Alasdair Kergon" <agk@redhat.com>,
"Jaskaran Khurana" <jaskarankhurana@linux.microsoft.com>
Subject: Re: [dm-devel] [PATCH v1] dm verity: Add support for signature verification with 2nd keyring
Date: Tue, 13 Oct 2020 10:51:34 +0200 [thread overview]
Message-ID: <1b344a3c-2671-3b1a-3c6b-f3b28e819bc5@digikod.net> (raw)
Message-ID: <20201013085134.eZeKtCgPk-eTbuRbGQzys5Vf-AS0AvLW5xRMZ9cDJWM@z> (raw)
In-Reply-To: <20201012235502.GA36149@linux.intel.com>
On 13/10/2020 01:55, Jarkko Sakkinen wrote:
> On Fri, Oct 09, 2020 at 11:50:03AM +0200, Mickaël Salaün wrote:
>> Hi,
>>
>> What do you think about this patch?
>>
>> Regards,
>> Mickaël
>>
>> On 02/10/2020 09:18, Mickaël Salaün wrote:
>>> From: Mickaël Salaün <mic@linux.microsoft.com>
>>>
>>> Add a new DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING configuration
>>> to enable dm-verity signatures to be verified against the secondary
>>> trusted keyring. This allows certificate updates without kernel update
>>> and reboot, aligning with module and kernel (kexec) signature
>>> verifications.
>
> I'd prefer a bit more verbose phrasing, not least because I have never
> really even peeked at dm-verity, but it is also a good practice.
>
> You have the middle part of the story missing - explaining the semantics
> of how the feature leads to the aimed solution.
OK, what about:
Add a new configuration DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
to enable dm-verity signatures to be verified against the secondary
trusted keyring. Instead of relying on the builtin trusted keyring (with
hard-coded certificates), the second trusted keyring can include
certificate authorities from the builtin trusted keyring and child
certificates loaded at run time. Using the secondary trusted keyring
enables to use dm-verity disks (e.g. loop devices) signed by keys which
did not exist at kernel build time, leveraging the certificate chain of
trust model. In practice, this allows to update certificates without
kernel update and reboot, aligning with module and kernel (kexec)
signature verification which already use the secondary trusted keyring.
--
dm-devel mailing list
dm-devel@redhat.com
https://www.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2020-10-15 8:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-02 7:18 [PATCH v1] dm verity: Add support for signature verification with 2nd keyring Mickaël Salaün
2020-10-09 9:50 ` Mickaël Salaün
2020-10-12 23:55 ` Jarkko Sakkinen
2020-10-12 23:55 ` [dm-devel] " Jarkko Sakkinen
2020-10-13 8:51 ` Mickaël Salaün [this message]
2020-10-13 8:51 ` Mickaël Salaün
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1b344a3c-2671-3b1a-3c6b-f3b28e819bc5@digikod.net \
--to=mic@digikod.net \
--cc=agk@redhat.com \
--cc=deven.desai@linux.microsoft.com \
--cc=dm-devel@redhat.com \
--cc=gmazyland@gmail.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=jaskarankhurana@linux.microsoft.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mic@linux.microsoft.com \
--cc=snitzer@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).