Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4]

[Luis R. Rodriguez]

On Wed, May 20, 2015 at 07:21:00PM +0300, Petko Manolov wrote:
> On 15-05-20 08:56:21, Andy Lutomirski wrote:
> > 
> > Would it make more sense to permit X.509 chains to be loaded into the keyring 
> > instead if we actually need that feature?  IOW, let userspace (or early 
> > initramfs stuff) extend our keyring trust to intermediate certs that validly 
> > chain to already-trusted things?  I think that a reasonable design goal would 
> > be that everything overcomplicated that's involved should be optional, and 
> > moving toward embedding PKCS#7 signatures in the modules themselves does the 
> > other direction?
> 
> This is similar to what i am doing right now - create CA hierarchy so we can 
> have something like:
> 
>                                +-> KeyB
>                                |
> RootCA --->  CertA ---> CertB ---> CertC ---> KeyC
>                     |
>                     +-> CertA' ---> KeyA"

How exactly do you go about uploading CertB to the kernel BTW? And could fw
signing replace that functionality? Keep in mind "fw uploading" should be
rebranded as "system data upload", which is one of the goals I have when
extending the firware_class module.

> The RootCA may be the one whose private key was used to sign the modules and all 
> downstream certificates are either directly signed by it or one of the others.  
> Not all of the infrastructure is in the mainline kernel, but this can easily be 
> rectified.
> 
> Now, as Mimi pointed out this scheme is flawed and should be used with care if 
> at all.  Revoking certificates is always a PITA.  Being valid for one year only 
> adds to the fun.

Freedom of stupidity comes with a cost :)

  Luis
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/