Re: [PATCH 0/3] KEXEC_SIG with appended signature

On Mon, Nov 15, 2021 at 06:53:53PM -0500, Nayna wrote:

On 11/12/21 03:30, Michal Suchánek wrote:

quoted

Hello,

On Thu, Nov 11, 2021 at 05:26:41PM -0500, Nayna wrote:

quoted

On 11/8/21 07:05, Michal Suchánek wrote:

quoted

Hello,

quoted

quoted

quoted

The other part is that distributions apply 'lockdown' patches that change
the security policy depending on secure boot status which were rejected
by upstream which only hook into the _SIG options, and not into the IMA_
options. Of course, I expect this to change when the IMA options are
universally available across architectures and the support picked up by
distributions.

Which brings the third point: IMA features vary across architectures,
and KEXEC_SIG is more common than IMA_KEXEC.

config/arm64/default:CONFIG_HAVE_IMA_KEXEC=y
config/ppc64le/default:CONFIG_HAVE_IMA_KEXEC=y

config/arm64/default:CONFIG_KEXEC_SIG=y
config/s390x/default:CONFIG_KEXEC_SIG=y
config/x86_64/default:CONFIG_KEXEC_SIG=y

KEXEC_SIG makes it much easier to get uniform features across
architectures.

Architectures use KEXEC_SIG vs IMA_KEXEC based on their requirement.
IMA_KEXEC is for the kernel images signed using sign-file (appended
signatures, not PECOFF), provides measurement along with verification, and

That's certainly not the case. S390 uses appended signatures with
KEXEC_SIG, arm64 uses PECOFF with both KEXEC_SIG and IMA_KEXEC.

Yes, S390 uses appended signature, but they also do not support
measurements.

On the other hand for arm64/x86, PECOFF works only with KEXEC_SIG. Look at
the KEXEC_IMAGE_VERIFY_SIG config dependencies in arch/arm64/Kconfig and
KEXEC_BZIMAGE_VERIFY_SIG config dependencies in arch/x86/Kconfig. Now, if
KEXEC_SIG is not enabled, then IMA appraisal policies are enforced if secure
boot is enabled, refer to security/integrity/ima_efi.c . IMA would fail
verification if kernel is not signed with module sig appended signatures or
signature verification fails.

In short, IMA is used to enforce the existence of a policy if secure boot is
enabled. If they don't support module sig appended signatures, by definition
it fails. Thus PECOFF doesn't work with both KEXEC_SIG and IMA_KEXEC, but
only with KEXEC_SIG.

Then IMA_KEXEC is a no-go. It is not supported on all architectures and
it principially cannot be supported because it does not support PECOFF
which is needed to boot the kernel on EFI platforms. To get feature
parity across architectures KEXEC_SIG is required.

quoted

quoted

is tied to secureboot state of the system at boot time.

In distrubutions it's also the case with KEXEC_SIG, it's only upstream
where this is different. I don't know why Linux upstream has rejected
this support for KEXEC_SIG.

Anyway, sounds like the difference is that IMA provides measurement but
if you don't use it it does not makes any difference except more comlex
code.

I am unsure what do you mean by "complex code" here. Can you please
elaborate ? IMA policies support for secureboot already exists and can be
used as it is without adding any extra work as in
arch/powerpc/kernel/ima_arch.c.

The code exists but using it to replace KEXEC_SIG also requires
understanding the code and the implications of using it. At a glance the
IMA codebase is much bigger and more convoluted compared to KEXEC_SIG
and MODULE_SIG.

Thanks

Michal