From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753781AbeDCVvr (ORCPT ); Tue, 3 Apr 2018 17:51:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:47684 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753367AbeDCVvo (ORCPT ); Tue, 3 Apr 2018 17:51:44 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3A03721837 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=luto@kernel.org X-Google-Smtp-Source: AIpwx48N6dqNXosuSQrhLGJQcOEfAvBJHPhTlDD5RBGJ8iwEbci4eyujrUXFg0pfmIhZ6ohYeHjxXbbHwx4efHIm//0= MIME-Version: 1.0 In-Reply-To: References: <4136.1522452584@warthog.procyon.org.uk> <186aeb7e-1225-4bb8-3ff5-863a1cde86de@kernel.org> <30459.1522739219@warthog.procyon.org.uk> From: Andy Lutomirski Date: Tue, 3 Apr 2018 14:51:23 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [GIT PULL] Kernel lockdown for secure boot To: Matthew Garrett Cc: Andrew Lutomirski , David Howells , Ard Biesheuvel , James Morris , Alan Cox , Linus Torvalds , Greg Kroah-Hartman , Linux Kernel Mailing List , Justin Forbes , linux-man , joeyli , LSM List , Linux API , Kees Cook , linux-efi Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 3, 2018 at 12:29 PM, Matthew Garrett wrote: > On Tue, Apr 3, 2018 at 9:46 AM Andy Lutomirski wrote: >> On Tue, Apr 3, 2018 at 9:29 AM, Matthew Garrett wrote: >> > A kernel that allows users arbitrary access to ring 0 is just an >> > overfeatured bootloader. Why would you want secure boot in that case? > >> To get a chain of trust. I can provision a system with some public >> keys, stored in UEFI authenticated variables, such that the system >> will only boot a signed image. That signed image, can, in turn, load >> a signed (or hashed or otherwise verfified) kernel and a verified >> initramfs. The initramfs can run a full system from a verified (using >> dm-verity or similar) filesystem, for example. Now it's very hard to >> persistently attack this system. Chromium OS does something very much >> like this, except that it doesn't use UEFI as far as I know. So does >> iOS, and so do some Android versions. None of this requires lockdown, >> or even a separation between usermode and kernelmode, to work >> correctly. One could even do this on an MMU-less system if one really >> cared to. More usefully, someone probably has done this using a >> unikernel. > > That's only viable if you're the only person with the ability to sign stuff > for your machine - the moment there are generic distributions that your > machine trusts, an attacker can use one as a bootloader to compromise your > trust chain. If you removed "as a bootloader", then I agree with that sentence. Can someone please explain why the UEFI crowd cares so much about "as a bootloader"? Once I'm able to install an OS (Linux kernel + bootloader, Windows embedded doodad, OpenBSD, whatever) on your machine, I can use your peripherals, read your data, write your data, see your keystrokes, use your network connection, re-flash your BIOS (at least as well as any OS can), run VMs, and generally own your system. Somehow you all seem fine with all of this, except that the fact that I can chainload something else gives UEFI people the willies. Can someone explain why?