RE: Linux Firmware Signing

[Roberts, William C]

> -----Original Message-----
> From: owner-linux-security-module@xxxxxxxxxxxxxxx [mailto:owner-linux-
> security-module@xxxxxxxxxxxxxxx] On Behalf Of Joshua Brindle
> Sent: Tuesday, September 1, 2015 7:13 AM
> To: Paul Moore
> Cc: Luis R. Rodriguez; Takashi Iwai; Ming Lei; David Howells; Peter Jones;
> selinux@xxxxxxxxxxxxx; Schaufler, Casey; Stephen Smalley; Matthew Garrett;
> Kees Cook; Vojtech Pavlík; Seth Forshee; james.l.morris@xxxxxxxxxx; Dmitry
> Kasatkin; Johannes Berg; Joey Lee; Kyle McMartin; linux-
> wireless@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Andy Lutomirski; linux-
> security-module@xxxxxxxxxxxxxxx; Greg Kroah-Hartman; Vitaly Kuznetsov; David
> Woodhouse
> Subject: Re: Linux Firmware Signing
> 
> Paul Moore wrote:
> <snip>
> >
> > Yes, there are lots of way we could solve the signed policy format
> > issue, I just don't have one in mind at this moment.  Also, to be
> > honest, there are enough limitations to signing SELinux policies that
> > this isn't very high onmy personal SELinux priority list.

Yes I would say this is low on my end. Especially if we can kill off
Reloadable policy support on Android, my need for this goes away 100%.

> >
> 
> The fact that there are so many userspace specific parts of the policy that never
> make it into the kernel precludes any meaningful verification anyway.

Yes and no. On Android, if I was able to load a policy I could grant myself capabilities that
We're not possible via the userspace portions, i.e. relabeling, etc. Granted, not checking the
userspace portions Is not great. In an ideal world, everything is checked. However, the main
reason to doing it in the kernel is where you want your trust to be. For instance, If I trust that
userspace Loader, then I need to trust that + the kernel. In the case of verifying the policy signature
In the kernel, I need to trust only the kernel.

As far as the desktop environment, I claim ignorance and have no input there.

> 
> And SELinux already has a mechanism for raising the integrity of a process to do
> things like signature checking in userspace, the domain transition. If someone
> wants validation of the SELinux policy they just need to eliminate every domains
> ability to load policy except for a trusted policy loader that does signature
> checking.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at
> http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/