Messages in this thread | | | Subject | Re: [PATCH v4 0/3] ima: kernel build support for loading the kernel module signing key | From | Mimi Zohar <> | Date | Fri, 09 Apr 2021 14:48:45 -0400 |
| |
On Fri, 2021-04-09 at 10:35 -0400, Nayna Jain wrote: > Kernel modules are currently only signed when CONFIG_MODULE_SIG is enabled. > The kernel module signing key is a self-signed CA only loaded onto the > .builtin_trusted_key keyring. On secure boot enabled systems with an arch > specific IMA policy enabled, but without MODULE_SIG enabled, kernel modules > are not signed, nor is the kernel module signing public key loaded onto the > IMA keyring. > > In order to load the the kernel module signing key onto the IMA trusted > keyring ('.ima'), the certificate needs to be signed by a CA key either on > the builtin or secondary keyrings. The original version of this patch set > created and loaded a kernel-CA key onto the builtin keyring. The kernel-CA > key signed the kernel module signing key, allowing it to be loaded onto the > IMA trusted keyring. > > However, missing from this version was support for the kernel-CA to sign the > hardware token certificate. Adding that support would add additional > complexity. > > Since the kernel module signing key is embedded into the Linux kernel at > build time, instead of creating and loading a kernel-CA onto the builtin > trusted keyring, this version makes an exception and allows the > self-signed kernel module signing key to be loaded directly onto the > trusted IMA keyring.
Thanks, Nayna.
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
Mimi
| |