Re: [PATCH 2/3] binfmt_elf: Verify signature of signed elf binary

[Vivek Goyal]

On Wed, Jan 16, 2013 at 05:35:23PM -0500, Mimi Zohar wrote:
> On Tue, 2013-01-15 at 16:34 -0500, Vivek Goyal wrote:
> > If a binary is signed, verify its signature. If signature is not valid, do
> > not allow execution. If binary is not signed, execution is allowed
> > unconditionally.
> 
> Basically you're building the policy into the executable.  Anyone can
> rebuild the executable and, without signing it, install/replace an
> existing one.  How is this safe?  The signature verification policy
> needs to be defined independently of the executable.

Upon signature verification this executable will also acquire a new
capability(say CAP_SIGNED). And some of the services can be allowed only
if process has that new capability. (TODO item)

So if somebody removes the signature and launches same executable, sure
it will run but it will fail to get some of the kernel services. For
example, in this case it should not be able to call sys_kexec() system
call.

Right now my goal is to not run anything which is not signed. For that
we will need a fully signed user space. And I am not sure that's going
to happen in near future, atleast for the generic case.

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/