From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756426AbbEUVif (ORCPT ); Thu, 21 May 2015 17:38:35 -0400 Received: from cantor2.suse.de ([195.135.220.15]:56344 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751702AbbEUVid (ORCPT ); Thu, 21 May 2015 17:38:33 -0400 Date: Thu, 21 May 2015 23:38:29 +0200 From: "Luis R. Rodriguez" To: Andy Lutomirski , David Howells , Andy Lutomirski , Rusty Russell , Michal Marek , Matthew Garrett , keyrings@linux-nfs.org, Dmitry Kasatkin , "linux-kernel@vger.kernel.org" , Seth Forshee , LSM List , David Woodhouse Subject: Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4] Message-ID: <20150521213829.GH23057@wotan.suse.de> References: <20150515123513.16723.96340.stgit@warthog.procyon.org.uk> <555BD715.40202@kernel.org> <31772.1432128969@warthog.procyon.org.uk> <20150520162059.GC10473@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150520162059.GC10473@localhost> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 20, 2015 at 07:21:00PM +0300, Petko Manolov wrote: > On 15-05-20 08:56:21, Andy Lutomirski wrote: > > > > Would it make more sense to permit X.509 chains to be loaded into the keyring > > instead if we actually need that feature? IOW, let userspace (or early > > initramfs stuff) extend our keyring trust to intermediate certs that validly > > chain to already-trusted things? I think that a reasonable design goal would > > be that everything overcomplicated that's involved should be optional, and > > moving toward embedding PKCS#7 signatures in the modules themselves does the > > other direction? > > This is similar to what i am doing right now - create CA hierarchy so we can > have something like: > > +-> KeyB > | > RootCA ---> CertA ---> CertB ---> CertC ---> KeyC > | > +-> CertA' ---> KeyA" How exactly do you go about uploading CertB to the kernel BTW? And could fw signing replace that functionality? Keep in mind "fw uploading" should be rebranded as "system data upload", which is one of the goals I have when extending the firware_class module. > The RootCA may be the one whose private key was used to sign the modules and all > downstream certificates are either directly signed by it or one of the others. > Not all of the infrastructure is in the mainline kernel, but this can easily be > rectified. > > Now, as Mimi pointed out this scheme is flawed and should be used with care if > at all. Revoking certificates is always a PITA. Being valid for one year only > adds to the fun. Freedom of stupidity comes with a cost :) Luis