Re: Kdump with signed images

From: Vivek Goyal <vgoyal@redhat.com>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Matthew Garrett <mjg@redhat.com>,
	Mimi Zohar <zohar@linux.vnet.ibm.com>,
	Khalid Aziz <khalid@gonehiking.org>,
	kexec@lists.infradead.org, horms@verge.net.au,
	Dave Young <dyoung@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
	linux kernel mailing list <linux-kernel@vger.kernel.org>,
	Dmitry Kasatkin <dmitry.kasatkin@intel.com>,
	Roberto Sassu <roberto.sassu@polito.it>,
	Kees Cook <keescook@chromium.org>,
	Peter Jones <pjones@redhat.com>
Subject: Re: Kdump with signed images
Date: Thu, 8 Nov 2012 14:40:51 -0500	[thread overview]
Message-ID: <20121108194050.GB27586@redhat.com> (raw)
In-Reply-To: <87k3tynvc0.fsf@xmission.com>

On Tue, Nov 06, 2012 at 03:51:59PM -0800, Eric W. Biederman wrote:

[..]

Thnking more about executable signature verification, I have another question.

While verifyign the signature, we will have to read the whole executable
in memory. That sounds bad as we are in kernel mode and will not be killed
and if sombody is trying to execute a malformed exceptionally large
executable, system will start killing other processess. We can potentially
lock all the memory in kernel just by trying to execute a signed huge
executable. Not good.

I was looking at IMA and they seem to be using kernel_read() for reading
page in and update digest. IIUC, that means page is read from disk,
brought in cache and if needed will be read back from disk. But that
means hacker can try to do some timing tricks and try to replace disk image
after signature verification and run unsigned program.

So how do we go about it. Neither of the approaches sound appealing
to me.

Thanks
Vivek