[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From gcwil...@us.ibm.com 2024-03-12 17:34 EDT--- Closing on our side as ALT_SOLUTION_AVAIL. -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: [24.04] Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Invalid Status in linux package in Ubuntu: Invalid Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
(builds are ongoing ...) -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: Incomplete Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From naynj...@ibm.com 2021-10-14 11:12 EDT--- (In reply to comment #40) > Hi Nayna, > > I agree that Reviewed-by or Tested-by are in general helpful, but these tags > follow strict rules in Linux kernel (see: "Reviewer's statement of > oversight" in kernel documentation). I cannot provide such tags without > performing review or testing. Unfortunately I cannot do the review because > it is not an area of my expertise. About testing - I simply cannot test it. Thanks Krzysztof for your response. Of course, you should give Reviewed- by and Tested-by only if you actually do it. Sorry, if I assumed the details here. When I asked for the tags, what I meant was that if someone from Canonical can actually review and test the patch and then send their Reviewed-By, Tested-by. Sorry for the misunderstanding and I hope it is clarified now. In case it helps, I guess it should be possible to test it on any x86/Power system by embedding your own generated key in .platform keyring using this patch and ensure verified kexec on secure boot enabled system. > > Instead, you or your colleagues should engage in discussions with > open-source upstream community and resolve the kbuild reported bugs and > address raised concerns (about missing use-case). None of additional tags > would help in avoiding doing it. > v3 version of the patch has addressed all the concerns which are raised till now. https://lore.kernel.org/linux- integrity/20211004145258.14056-1-na...@linux.ibm.com/ Thanks & Regards, - Nayna -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: Incomplete Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From naynj...@ibm.com 2021-10-13 16:43 EDT--- Thanks !! I guess a Reviewed-by or Tested-by might be helpful. Thanks & Regards, - Nayna -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: Incomplete Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From naynj...@ibm.com 2021-09-10 13:31 EDT--- I have posted the patch today - https://lore.kernel.org/linux-integrity/20210910172515.8430-1-na...@linux.ibm.com/T/#u . It would be very helpful if someone from Canonical can test it and confirm. Thanks & Regards, - Nayna -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: Incomplete Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From naynj...@ibm.com 2021-05-19 16:51 EDT--- (In reply to comment #28) > @Nayna Jain @Daniel > > Hm but we have CONFIG_LOAD_PPC_KEYS=y already which I would expect to be > the only thing that loads keys into .platform keyring which was enabled as > part of https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1866909 > LTC-184073 . Which keys are present in firmware / get loaded into .platform > because of that? I would have expected canonical keys to be loaded by that > into the .platform keyring, or is that not the case? Hi, Yes you are right that CONFIG_LOAD_PPC_KEYS enables loading of keys into .platform keyring from firmware at runtime. However, as Daniel has mentioned in his comment dated 2020-12-17 , that the .platform keyring is currently not loaded in pseries firmware as it is static keys based solution and at the moment doesn't have any mechanism to expose trusted keys (this will change with the full key management solution). > > Can you please share contents of "powerpc:db"? Ideally it should contain > Canonical's two OPAL signing certs. > > If canonical keys are not in "powerpc:db", does it make sense to then add > the two Canonical keys to the .builtin_trusted_keys_keyring, and then link > the whole keyring into .ima keyring? > > I will attach the two Canonical OPAL signing keys here, and the ESL for them. The final conclusion was to add a config option for PLATFORM KEYRING similar to SYSTEM_TRUSTED_KEYS mechanism. It would allow loading additional keys compiled into the kernel to be loaded only to .platform keyring. This would be in addition to the existing support for loading firmware keys at runtime on the platfom keyring. It aligns with xnox comment dated "2012-03-18". At some point we will probably close the loop hole that allows self signed certificates loaded onto the builtin keyring to be loaded onto the IMA keyring. It's better to define a mechanism for loading additional certs on the platform keyring that would work today and will continue to work in the future. I am supposed to start looking at the patches. I would be starting to look at them in June timeframe. Thanks & Regards, - Nayna -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: Incomplete Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From daniel.axte...@ibm.com 2021-04-20 23:25 EDT--- Hi, Yes, actually. I've asked Nayna if she can extend those patches to also allow things to be loaded into .platform. Kind regards, Daniel -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: New Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From daniel.axte...@ibm.com 2021-03-31 10:31 EDT--- Hi, > If the key is self-signed, shouldn't having the key in .builtin_trusted_keys > allow for loading it into the IMA keyring? Or is that insufficient for some > reason? Yes, you could do that (I tried recently, in fact!), but then you'd need a userspace blob to perform that loading. As I understand it xnox isn't keen on more userspace blobs. Kind regards, Daniel -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: New Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From daniel.axte...@ibm.com 2021-03-18 09:39 EDT--- (In reply to comment #22) > Kind of wish for a config option that would do add_to_platform_keyring a > built-in set of keys, until we have something like the other platforms have > (ipl on s390x, uefi db on EFI platforms). > > Similar to how the built-in trusted keys are initialized. Yeah, I think that might be the least-awful option. I'll see if I can bash out an "UBUNTU: SAUCE: (no-up)" patch for you :) Kind regards, Daniel -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: New Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From daniel.axte...@ibm.com 2021-03-18 00:22 EDT---
Apologies once again for the delay.
> @Daniel
> "In either case, however, the CA that signs the kernel signing key needs to
> be built in to the kernel's .builtin_trusted_keys keyring."
>
> On Ubuntu, for OPAL singing, on PowerPC, we do not use CA at all. It is our
> understanding that firmware doesn't support verifying signature chains to a
> CA. Thus instead we use self-signed certificates for the kernel which have
> not been signed by a CA.
>
> Thus we should simply include them all in trusted keyring, and there is no
> need to ship anything on disk or load anything from the userspace.
My mistake. Yes, if you build the kernel signing key into the trusted
keyring, that should cover everything.
Kind regards,
Daniel
--- Comment From daniel.axte...@ibm.com 2021-03-18 00:29 EDT---
Wait, no, hang on, this keeps tripping me up.
IMA kexec appended-signature verification uses only the %.ima and
%.platform keyrings. Having the key in %.builtin_trusted_keys should
logically be enough, but that's not how the code works, much to my
regular frustration. Here's groovy/master
security/integrity/ima/ima_appraise.c modsig_verify():
rc = integrity_modsig_verify(INTEGRITY_KEYRING_IMA, modsig);
if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc &&
func == KEXEC_KERNEL_CHECK)
rc = integrity_modsig_verify(INTEGRITY_KEYRING_PLATFORM,
modsig);
if (rc) {
*cause = "invalid-signature";
*status = INTEGRITY_FAIL;
} else {
*status = INTEGRITY_PASS;
}
So just having it in %:.builtin_trusted_keys doesn't suffice, we need to
get it into %:.ima or %:.platform somehow.
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1903288
Title:
Power guest secure boot with static keys: kernel portion
Status in The Ubuntu-power-systems project:
Triaged
Status in linux package in Ubuntu:
New
Bug description:
== Comment: #2 - Daniel John Axtens - 2020-11-05
20:15:10 ==
This is the kernel side of changes needed for LPAR/guest secure boot.
Because Ubuntu keeps its kernels so wonderfully up to date, I don't
think there are any extra patches you need to pick up. (I'll double-
check against the 21.04 tree once my git pulls finish!)
However, we potentially need some configuration changes to make sure
kexec-ing into a crashdump kernel still works.
Because Lockdown requires that kexec kernels are signed by a key
trusted by IMA, the public key for used for signing the kdump kernel
needs to be in the IMA keyring or the platform keyring. For host
secure boot (and in the UEFI case), it's loaded into the platform
keyring. But in the case of guest secure boot with static keys, it's
not loaded into the platform keyring so it needs to be loaded into the
IMA keyring.
This is easy enough to do. Firstly, load the Secure Boot CA into the
.primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS
property. We assume the key used to sign the kernel is signed by this
CA.
Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the
.primary_trusted_keys keyring to be loaded into the IMA keyring. Then set
IMA_X509_PATH to provide a path to the signing key on installed file system.
(It may also be possible to do this step in userspace, so long as the CA is
trusted by the kernel.)
Then that key will be loaded into the .ima keyring at boot and be used to
appraise the kexec kernel for crashdumps.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From daniel.axte...@ibm.com 2020-12-17 19:59 EDT--- I checked out LP: #1643652. I don't know why we asked for IMA_X509_PATH there, we don't need it for OpenPower secure boot. For guest secure boot, the end goal of my request here is to get the pieces in place to enable signed kexec - at least for the kdump case. Under secure boot, only signed kernels can be kexeced. The kernel will verify the appended signature against the .platform and .ima keyrings. The .platform keyring is fine on OpenPower secure boot and UEFI secure boot because the keyring gets populated by keys out of firmware. However, at the moment pseries firmware doesn't have any mechanism to expose trusted keys (this will change with the full key management solution!), so nothing ends up in .platform. So we want to get a key into the .ima keychain instead. IMA_X509_PATH purports to achieve this, but unfortunately just setting it isn't quite sufficient. The key will only be loaded into the .ima keychain if it's signed by a key already trusted by the kernel, that is, in .builtin_trusted_keys. (I discovered recently that it's also possible to load a key into .ima at runtime with keyctl, so loading the key as part of the kexec scripts could be an alternative. However, this also requires that the key being loaded into .ima be trusted by the kernel.) So, what I think I need is: - the key that signs the kernel on the filesystem so that it can be loaded by IMA_X509_PATH or keyctl. - the CA key that signs the kernel-signing key to be trusted by the kernel by being included in the .pem file that gets loaded by CONFIG_SYSTEM_TRUSTED_KEYS. -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Triaged Status in linux package in Ubuntu: New Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From daniel.axte...@ibm.com 2020-11-19 20:25 EDT--- Hi, I think that's the only feature patch required. There's not a lot because at this stage it's all based on static keys. So unlike the OpenPower secure boot, there's no code to interact with keys stored in firmware. There is one config change that we also need: because there are no keys advertised by firmware or early boot, and because lockdown requires that kexec kernels be signed, we need to get the kernel signing key into the .ima keyring somehow. One way to do this is at boot with IMA_X509_PATH, but it can also be done at runtime. In either case, however, the CA that signs the kernel signing key needs to be built in to the kernel's .builtin_trusted_keys keyring. I haven't attempted this because I don't know much about how the signing process works in your build infrastructure, but I'm happy to help. Of course, I expect there will also be bug fixes later! Kind regards, Daniel -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1903288 Title: Power guest secure boot with static keys: kernel portion Status in The Ubuntu-power-systems project: Incomplete Status in linux package in Ubuntu: Incomplete Bug description: == Comment: #2 - Daniel John Axtens - 2020-11-05 20:15:10 == This is the kernel side of changes needed for LPAR/guest secure boot. Because Ubuntu keeps its kernels so wonderfully up to date, I don't think there are any extra patches you need to pick up. (I'll double- check against the 21.04 tree once my git pulls finish!) However, we potentially need some configuration changes to make sure kexec-ing into a crashdump kernel still works. Because Lockdown requires that kexec kernels are signed by a key trusted by IMA, the public key for used for signing the kdump kernel needs to be in the IMA keyring or the platform keyring. For host secure boot (and in the UEFI case), it's loaded into the platform keyring. But in the case of guest secure boot with static keys, it's not loaded into the platform keyring so it needs to be loaded into the IMA keyring. This is easy enough to do. Firstly, load the Secure Boot CA into the .primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS property. We assume the key used to sign the kernel is signed by this CA. Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the .primary_trusted_keys keyring to be loaded into the IMA keyring. Then set IMA_X509_PATH to provide a path to the signing key on installed file system. (It may also be possible to do this step in userspace, so long as the CA is trusted by the kernel.) Then that key will be loaded into the .ima keyring at boot and be used to appraise the kexec kernel for crashdumps. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1903288] Comment bridged from LTC Bugzilla
--- Comment From daniel.axte...@ibm.com 2020-11-12 01:12 EDT---
Hi,
So, here are what I believe are the relevant kernel changes.
Firstly, there is a common core with the support for OpenPower/PowerNV
Secure Boot - LP#1866909 and friends. This covers things like securing
kexec under lockdown, and all went in for 20.04.
For this iteration of LPAR/KVM guest secure boot - which is supporting
only static keys - we just need an additional patch to detect the
slightly different Device Tree properties that are used to indicate
guest vs host secure boot. This is commit 61f879d97ce4
("powerpc/pseries: Detect secure and trusted boot state of the system.")
which went into 5.9.
Kind regards,
Daniel
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1903288
Title:
Power guest secure boot with static keys: kernel portion
Status in The Ubuntu-power-systems project:
Confirmed
Status in linux package in Ubuntu:
New
Bug description:
== Comment: #2 - Daniel John Axtens - 2020-11-05
20:15:10 ==
This is the kernel side of changes needed for LPAR/guest secure boot.
Because Ubuntu keeps its kernels so wonderfully up to date, I don't
think there are any extra patches you need to pick up. (I'll double-
check against the 21.04 tree once my git pulls finish!)
However, we potentially need some configuration changes to make sure
kexec-ing into a crashdump kernel still works.
Because Lockdown requires that kexec kernels are signed by a key
trusted by IMA, the public key for used for signing the kdump kernel
needs to be in the IMA keyring or the platform keyring. For host
secure boot (and in the UEFI case), it's loaded into the platform
keyring. But in the case of guest secure boot with static keys, it's
not loaded into the platform keyring so it needs to be loaded into the
IMA keyring.
This is easy enough to do. Firstly, load the Secure Boot CA into the
.primary_trusted_keys keyring via the CONFIG_SYSTEM_TRUSTED_KEYS
property. We assume the key used to sign the kernel is signed by this
CA.
Then, enable IMA_LOAD_X509, which allows certificates signed by a key on the
.primary_trusted_keys keyring to be loaded into the IMA keyring. Then set
IMA_X509_PATH to provide a path to the signing key on installed file system.
(It may also be possible to do this step in userspace, so long as the CA is
trusted by the kernel.)
Then that key will be loaded into the .ima keyring at boot and be used to
appraise the kexec kernel for crashdumps.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-power-systems/+bug/1903288/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
