Re: [PATCH 0/3] KEXEC_SIG with appended signature

[Mimi Zohar]

On Fri, 2021-11-19 at 12:18 +0100, Michal Suchánek wrote:
> Maybe I was not clear enough. If you happen to focus on an architecture
> that supports IMA fully it's great.
> 
> My point of view is maintaining multiple architectures. Both end users
> and people conecerend with security are rarely familiar with
> architecture specifics. Portability of documentation and debugging
> instructions across architectures is a concern.
> 
> IMA has large number of options with varying availablitily across
> architectures for no apparent reason. The situation is complex and hard
> to grasp.

IMA measures, verifies, and audits the integrity of files based on a
system wide policy.  The known "good" integrity value may be stored in
the security.ima xattr or more recently as an appended signature.

With both IMA kexec appraise and measurement policy rules, not only is
the kernel image signature verified and the file hash included in the
IMA measurement list, but the signature used to verify the integrity of
the kexec kernel image is also included in the IMA measurement list
(ima_template=ima-sig).

Even without PECOFF support in IMA, IMA kexec measurement policy rules
can be defined to supplement the KEXEC_SIG signature verfication.

> 
> In comparison the *_SIG options are widely available. The missing
> support for KEXEC_SIG on POWER is trivial to add by cut&paste from s390.
> With that all the documentation that exists already is also trivially
> applicable to POWER. Any additional code cleanup is a bonus but not
> really needed to enable the kexec lockdown on POWER.

Before lockdown was upstreamed, Matthew made sure that IMA signature
verification could co-exist.   Refer to commit 29d3c1c8dfe7 ("kexec:
Allow kexec_file() with appropriate IMA policy when locked down").   If
there is a problem with the downstream kexec lockdown patches, they
should be fixed.

The kexec kselftest might provide some insight into how the different
signature verification methods and lockdown co-exist.

As for adding KEXEC_SIG appended signature support on PowerPC based on
the s390 code, it sounds reasonable.

thanks,

Mimi