Re: [RFD] linux-firmware key arrangement for firmware signing

[Mimi Zohar <zohar@linux.vnet.ibm.com>]

On Thu, 2015-05-21 at 19:43 +0300, Petko Manolov wrote:
> On 15-05-21 16:51:49, David Howells wrote:
> > 
> > I do have patches to parse PGP key data and add the public keys found therein
> > onto the kernel keyring, but that would mean adding an extra key data parser.
> 
> PGP is widely used so i would gladly have one more parser in the kernel.
> 
> > You could probably do this with the integrity functions - but turning them on 
> > has a performance cost and you have to load things in the right order as I 
> > understand it.
> 
> The performance hit is negligible, especially on modern hardware.  The problem 
> is that Joe user must wrap his head around IMA as a concept and go through the 
> pains of doing everything right.  Failing to do so will result in a lot of 
> frustration, and i speak from experience.
> 
> Once you make it run properly it mostly stays out of your way.  To put it 
> another way: IMA is not for sissies... :)

The main problem today is that software doesn't come and isn't installed
with file signatures.   Once file signatures are installed with the
files,  then it is just a matter of the machine owner signing the
software's public keys.   Dracut (or equivalent) would load the signed
keys onto the trusted IMA keyring.

Mimi