| |||||||||||||
KS2012: Module signingKS2012: Module signingPosted Sep 7, 2012 5:58 UTC (Fri) by alonz (subscriber, #815)Parent article: KS2012: Module signing For binary modules, such as the NVIDIA graphics drivers, users would have to add the NVIDIA public key to the kernel ring, Peter Jones said. And has anyone proposed a secure method to do this magic? Just permitting the user (or even root) to add arbitrary public keys to the kernel key ring would basically compromise the entire mechanism – it allows the user to load any code (as the key can be one he has just generated on the spot to sign his malware). Of course, the issue only arises in the full secure-boot scenario, so maybe there we would just block the adding of additional public keys (and thus totally block binary modules).
(Log in to post comments)
KS2012: Module signing Posted Sep 7, 2012 8:32 UTC (Fri) by justincormack (subscriber, #70439) [Link]
You can add the keys at kernel build time I guess. Will not help if you want to add a new module vendor. Presumably a signed module could also add new keys, allowing a chain of trust though.
KS2012: Module signing Posted Sep 8, 2012 12:35 UTC (Sat) by hmh (subscriber, #3838) [Link]
I sure hope you can constrain keys to modules. One should be able to tell the kernel that the nVidia key can only sign the nVidia module, and to refuse anything else it signed...
I am using nVidia only as an example.
KS2012: Module signing Posted Sep 11, 2012 13:21 UTC (Tue) by njwhite (subscriber, #51848) [Link]
> One should be able to tell the kernel that the nVidia key can only sign the nVidia module, and to refuse anything else it signed...
Couldn't a compromised / hostile nVidia just creat a module that was called nvidia.ko, but did *bad thing*? Presumably one can't specify the allowed interfaces a module may use in advance.
Or am I misunderstanding you?
KS2012: Module signing Posted Sep 14, 2012 23:19 UTC (Fri) by dashesy (subscriber, #74652) [Link]
nVidia already signs its kernels for other OS, so what is the harm in asking them also sign the Linux version.
KS2012: Module signing Posted Sep 7, 2012 9:52 UTC (Fri) by juliank (subscriber, #45896) [Link]
Given that the nvidia drivers won't work in secure boot as Matthew Garret's patch set disables the relevant access in secure boot environments, there's not much point in thinking about this, right? Because if you don't have secure boot, you don't really need to have signed modules.
|
|||||||||||||