Messages in this thread | | | Date | Tue, 12 Sep 2023 00:15:30 +0300 | Subject | Re: [PATCH v2] certs: Add option to disallow non-CA certificates in secondary trusted keying | From | "Jarkko Sakkinen" <> |
| |
On Fri Sep 8, 2023 at 3:14 PM EEST, Denis Glazkov wrote: > The Linux kernel has an IMA (Integrity Measurement Architecture) > subsystem to check the integrity of the file system based on digital > signatures. IMA uses certificates in `.ima` keying to check integrity. > > Only certificates issued by one of the trusted CA (Certificate Authority) > certificates can be added to the `.ima` keying. > > The Linux kernel now has a secondary trusted keying to which trusted > certificates from user space can be added if you have superuser > privileges. Previously, all trusted certificates were in the built-in > trusted keying, which could not be modified from user space. > Trusted certificates were placed in the built-in trusted keying at > kernel compile time. > > The secondary trusted keying is designed so that any certificates that > are signed by one of the trusted CA certificates in the built-in or > secondary trusted keyring can be added to it. > > Let's imagine that we have the following certificate trust chain: > > ┌───────────────────────────┬─────────────────────┐ > │ │ ┌───────┐ │ > │ │ │ │ │ > ┌────────────▼────────┐ ┌─────────────▼─────▼────┐ │ ┌─────┴─────┐ > │.builtin_trusted_keys│◄───┤.secondary_trusted_keys ├──┘ │ .ima │ > ├─────────────────────┤ ├────────────────────────┤ ├───────────┤ > │ Root CA Cert │-----► Intermediate CA Cert │-----► IMA Cert │ > └─────────────────────┘ └────────────────────────┘ └───────────┘ > > Issues Restricted by > -------------► ──────────────► > > Since the IMA certificate is signed by a CA certificate from a secondary > trusted keying, an attacker with superuser privileges will be able to > add the IMA certificate to the secondary trusted keying. That is, the IMA > certificate will become trusted. > > Since, with `CONFIG_MODULE_SIG` option enabled, modules can only be > loaded into kernel space if they are signed with one of the trusted > certificates, an attacker could sign untrusted kernel modules with > the private key corresponding to the IMA certificate and successfully > load the untrusted modules into kernel space. > > This patch adds the configuration that once enabled, only > certificates that meet the following requirements can be added > to the secondary trusted keying: > > 1. The certificate is a CA (Certificate Authority) > 2. The certificate must be used for verifying a CA's signatures > 3. The certificate must not be used for digital signatures > > Signed-off-by: Denis Glazkov <d.glazkov@omp.ru>
s/keying/keyring/ (multiple)
Have you considered instead making mod_verify_sig() more robust? Obviously this would mean making selection of keys in verify_pkcs7_signature() more robust (see the documentation of 'trusted_keys').
The this would be also less niche feature to pick for distributors if it was just concerning module loading, and have associated config flag over there.
BR, Jarkko
| |