| Message ID | 20210409143507.191443-1-nayna@linux.ibm.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | ima: kernel build support for loading the kernel module signing key | expand |
On Fri, 2021-04-09 at 10:35 -0400, Nayna Jain wrote: > Kernel modules are currently only signed when CONFIG_MODULE_SIG is enabled. > The kernel module signing key is a self-signed CA only loaded onto the > .builtin_trusted_key keyring. On secure boot enabled systems with an arch > specific IMA policy enabled, but without MODULE_SIG enabled, kernel modules > are not signed, nor is the kernel module signing public key loaded onto the > IMA keyring. > > In order to load the the kernel module signing key onto the IMA trusted > keyring ('.ima'), the certificate needs to be signed by a CA key either on > the builtin or secondary keyrings. The original version of this patch set > created and loaded a kernel-CA key onto the builtin keyring. The kernel-CA > key signed the kernel module signing key, allowing it to be loaded onto the > IMA trusted keyring. > > However, missing from this version was support for the kernel-CA to sign the > hardware token certificate. Adding that support would add additional > complexity. > > Since the kernel module signing key is embedded into the Linux kernel at > build time, instead of creating and loading a kernel-CA onto the builtin > trusted keyring, this version makes an exception and allows the > self-signed kernel module signing key to be loaded directly onto the > trusted IMA keyring. Thanks, Nayna. Applied to git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity Mimi
Kernel modules are currently only signed when CONFIG_MODULE_SIG is enabled. The kernel module signing key is a self-signed CA only loaded onto the .builtin_trusted_key keyring. On secure boot enabled systems with an arch specific IMA policy enabled, but without MODULE_SIG enabled, kernel modules are not signed, nor is the kernel module signing public key loaded onto the IMA keyring. In order to load the the kernel module signing key onto the IMA trusted keyring ('.ima'), the certificate needs to be signed by a CA key either on the builtin or secondary keyrings. The original version of this patch set created and loaded a kernel-CA key onto the builtin keyring. The kernel-CA key signed the kernel module signing key, allowing it to be loaded onto the IMA trusted keyring. However, missing from this version was support for the kernel-CA to sign the hardware token certificate. Adding that support would add additional complexity. Since the kernel module signing key is embedded into the Linux kernel at build time, instead of creating and loading a kernel-CA onto the builtin trusted keyring, this version makes an exception and allows the self-signed kernel module signing key to be loaded directly onto the trusted IMA keyring. v4: * Updated Jarkko's Reviewed-by and Stefan's Ack-by. * Fixed a bug where size was miscalculated for the case when only IMA_APPRAISE_MODSIG is enabled. Thanks Mimi for noticing it. v3: * Fix the "Fixes" tag as suggested by Stefan for Patch 1/3. * Revert back the CA signed module signing key to only self-signed. * Allow self signed key as exception only for build time generated module signing key onto .ima keyring. v2: * Include feedback from Stefan - corrected the Fixes commit id in Patch 1 and cleaned Patch 5/5. * Fix the issue reported by kernel test bot. * Include Jarkko's feedback on patch description. Nayna Jain (3): keys: cleanup build time module signing keys ima: enable signing of modules with build time generated key ima: enable loading of build time generated key on .ima keyring Makefile | 6 ++--- certs/Kconfig | 2 +- certs/Makefile | 8 ++++++ certs/system_certificates.S | 13 ++++++++- certs/system_keyring.c | 50 ++++++++++++++++++++++++++++------- include/keys/system_keyring.h | 7 +++++ init/Kconfig | 6 ++--- security/integrity/digsig.c | 2 ++ 8 files changed, 76 insertions(+), 18 deletions(-)