On Tue, 2014-06-10 at 09:29 -0400, Josh Boyer wrote: > On Tue, Jun 10, 2014 at 04:21:36PM +0300, Dmitry Kasatkin wrote: > > On 10/06/14 15:52, Mimi Zohar wrote: > > > On Tue, 2014-06-10 at 08:20 -0400, Josh Boyer wrote: > > >> On Tue, Jun 10, 2014 at 11:48:14AM +0300, Dmitry Kasatkin wrote: > > >>> Also I want to discuss here Fedora UEFI patches as they are the reason > > >>> for > > >>> the these original patchset. > > >>> > > >>> http://pkgs.fedoraproject.org/cgit/kernel.git/tree/modsign-uefi.patch > > >>> > > >>> They provide functionality to specify MokIgnoreDb variable to limit > > >>> loading of > > >>> UEFI keys only from MOK List, while ignoring DB. This is certainly a > > >>> good > > >>> functionality. But once MODULE_SIG_UEFI is enabled, it looks there is > > >>> no way > > >>> to prevent loading keys from UEFI at all. And this might not be a good > > >>> default > > >>> functionality. Someone might want not allow loading of keys from UEFI > > >>> unless > > >>> kernel parameter is specified to allow it without recompiling the kernel > > >>> and disabling MODULE_SIG_UEFI. > > >>> > > >>> Josh, why such design decision was made? > > >> IIRC, it's because kernel parameters can be added programmatically from a > > >> remote user if they gain root access. Having a kernel parameter to > > >> disable a key piece of secure boot isn't all that great. We disable > > >> other kernel parameters like acpi_rspd as well. > > > In this case, there shouldn't be a problem as the kernel parameters > > > would further limit the keys usage. > > > > > > Mimi > > > > Josh probably means that it can be removed and restriction is lifted.. > > And after reboot, all keys come to the keyring.. > > Right. Or if we went with your suggestion of the default being "do not > load UEFI keys", then they could conversely add the parameter instead. > This might not be an immediate threat to the SB attack vector itself > (thought it could be if I thought about it harder), but it's certainly > a change in system behavior that would catch a user unaware.
Agreed, it could catch the user unaware of the change, but always allowing all the UEFI keys, is not a better alternative. Perhaps, requiring the option, would at least prevent the user from being unaware of the change. Mimi > At any rate, I'm likely not the best person to weigh in on this aspect. > Matthew has certainly done more thinking about these kinds of problems. > > josh -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
