lkml.org 
[lkml]   [2023]   [Sep]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] integrity: powerpc: Do not select CA_MACHINE_KEYRING
From

On 9/7/23 13:32, Michal Suchánek wrote:
> Adding more CC's from the original patch, looks like get_maintainers is
> not that great for this file.
>
> On Thu, Sep 07, 2023 at 06:52:19PM +0200, Michal Suchanek wrote:
>> No other platform needs CA_MACHINE_KEYRING, either.
>>
>> This is policy that should be decided by the administrator, not Kconfig
>> dependencies.

We certainly agree that flexibility is important. However, in this case,
this also implies that we are expecting system admins to be security
experts. As per our understanding, CA based infrastructure(PKI) is the
standard to be followed and not the policy decision. And we can only
speak for Power.

INTEGRITY_CA_MACHINE_KEYRING ensures that we always have CA signed leaf
certs.

INTEGRITY_CA_MACHINE_KEYRING_MAX ensures that CA is only allowed to do
key signing and not code signing.

Having CA signed certs also permits easy revocation of all leaf certs.

Loading certificates is completely new for Power Systems. We would like
to make it as clean as possible from the start. We want to enforce CA
signed leaf certificates(INTEGRITY_CA_MACHINE_KEYRING). As per
keyUsage(INTEGRITY_CA_MACHINE_KEYRING_MAX), if we want more flexibility,
probably a boot time override can be considered.

Thanks & Regards,

    - Nayna


>>
>> cc: joeyli <jlee@suse.com>
>> Signed-off-by: Michal Suchanek <msuchanek@suse.de>
>> ---
>> security/integrity/Kconfig | 2 --
>> 1 file changed, 2 deletions(-)
>>
>> diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
>> index 232191ee09e3..b6e074ac0227 100644
>> --- a/security/integrity/Kconfig
>> +++ b/security/integrity/Kconfig
>> @@ -68,8 +68,6 @@ config INTEGRITY_MACHINE_KEYRING
>> depends on INTEGRITY_ASYMMETRIC_KEYS
>> depends on SYSTEM_BLACKLIST_KEYRING
>> depends on LOAD_UEFI_KEYS || LOAD_PPC_KEYS
>> - select INTEGRITY_CA_MACHINE_KEYRING if LOAD_PPC_KEYS
>> - select INTEGRITY_CA_MACHINE_KEYRING_MAX if LOAD_PPC_KEYS
>> help
>> If set, provide a keyring to which Machine Owner Keys (MOK) may
>> be added. This keyring shall contain just MOK keys. Unlike keys
>> --
>> 2.41.0
>>

\
 
 \ /
  Last update: 2023-09-12 05:43    [W:0.084 / U:1.856 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site