Messages in this thread | | | Date | Tue, 01 Sep 2015 16:46:36 -0400 | From | Joshua Brindle <> | Subject | Re: Linux Firmware Signing |
| |
Roberts, William C wrote: >> From: owner-linux-security-module@vger.kernel.org [mailto:owner-linux- >> security-module@vger.kernel.org] On Behalf Of Joshua Brindle >> Sent: Tuesday, September 1, 2015 7:13 AM >> To: Paul Moore >> Cc: Luis R. Rodriguez; Takashi Iwai; Ming Lei; David Howells; Peter Jones; >> selinux@tycho.nsa.gov; Schaufler, Casey; Stephen Smalley; Matthew Garrett; >> Kees Cook; Vojtech Pavlík; Seth Forshee; james.l.morris@oracle.com; Dmitry >> Kasatkin; Johannes Berg; Joey Lee; Kyle McMartin; linux- >> wireless@vger.kernel.org; linux-kernel@vger.kernel.org; Andy Lutomirski; linux- >> security-module@vger.kernel.org; Greg Kroah-Hartman; Vitaly Kuznetsov; David >> Woodhouse >> Subject: Re: Linux Firmware Signing >> >> Paul Moore wrote: >> <snip> >>> Yes, there are lots of way we could solve the signed policy format >>> issue, I just don't have one in mind at this moment. Also, to be >>> honest, there are enough limitations to signing SELinux policies that >>> this isn't very high onmy personal SELinux priority list. > > Yes I would say this is low on my end. Especially if we can kill off > Reloadable policy support on Android, my need for this goes away 100%. >
I'm not sure who "we" is as you are the only person I've heard advocating for removing that support.
>> The fact that there are so many userspace specific parts of the policy that never >> make it into the kernel precludes any meaningful verification anyway. > > Yes and no. On Android, if I was able to load a policy I could grant myself capabilities that > We're not possible via the userspace portions, i.e. relabeling, etc. Granted, not checking the > userspace portions Is not great. In an ideal world, everything is checked. However, the main > reason to doing it in the kernel is where you want your trust to be. For instance, If I trust that > userspace Loader, then I need to trust that + the kernel. In the case of verifying the policy signature > In the kernel, I need to trust only the kernel.
Especially on Android, userspace files are very important. Changing seapp_contexts or property_contexts can easily get you a privilege escalation to let you do whatever. Checking only the kernel binary is a half-solution and should not even be considered.
> > As far as the desktop environment, I claim ignorance and have no input there. > >> And SELinux already has a mechanism for raising the integrity of a process to do >> things like signature checking in userspace, the domain transition. If someone >> wants validation of the SELinux policy they just need to eliminate every domains >> ability to load policy except for a trusted policy loader that does signature >> checking. >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in >> the body of a message to majordomo@vger.kernel.org More majordomo info at >> http://vger.kernel.org/majordomo-info.html
| |