Re: [PATCH v2] builddeb: Support signing kernels with the module signing key
- To: James Bottomley <James.Bottomley@hansenpartnership.com>
- Cc: Matthew Wilcox <willy@infradead.org>, Julian Andres Klode <julian.klode@canonical.com>, Ben Hutchings <ben@decadent.org.uk>, linux-efi <linux-efi@vger.kernel.org>, Linux Kbuild mailing list <linux-kbuild@vger.kernel.org>, efi@lists.einval.com, Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, David Howells <dhowells@redhat.com>, keyrings@vger.kernel.org, David Woodhouse <dwmw2@infradead.org>, debian-kernel <debian-kernel@lists.debian.org>
- Subject: Re: [PATCH v2] builddeb: Support signing kernels with the module signing key
- From: Masahiro Yamada <masahiroy@kernel.org>
- Date: Thu, 10 Feb 2022 08:04:06 +0900
- Message-id: <[🔎] CAK7LNASNFnARmhJ0ik3uCiasuTDGgi9PtEgi7m+EPgHtK0-t5Q@mail.gmail.com>
- In-reply-to: <[🔎] 3d76ff7aab8cdc134aebf16af66582849bd53156.camel@HansenPartnership.com>
- References: <20211218031122.4117631-1-willy@infradead.org> <CAK7LNAQUChvX3NoukBnjBfJJGu+a96pfbM--xHEHOygWPgE9eA@mail.gmail.com> <YdSOV7LL0vWCMcWl@casper.infradead.org> <[🔎] CAK7LNAQgixJSnDUMfjc+tg90oMdVoh+i5faEn-rqgmHR3Bk6dQ@mail.gmail.com> <[🔎] 20220208110122.2z4cmbqexmnxuxld@jak-t480s> <[🔎] YgJrypdQium7AcWV@casper.infradead.org> <[🔎] 3d76ff7aab8cdc134aebf16af66582849bd53156.camel@HansenPartnership.com>
On Wed, Feb 9, 2022 at 10:21 PM James Bottomley
<James.Bottomley@hansenpartnership.com> wrote:
>
> On Tue, 2022-02-08 at 13:10 +0000, Matthew Wilcox wrote:
> > On Tue, Feb 08, 2022 at 12:01:22PM +0100, Julian Andres Klode wrote:
> > > It's worth pointing out that in Ubuntu, the generated MOK key
> > > is for module signing only (extended key usage
> > > 1.3.6.1.4.1.2312.16.1.2), kernels signed with it will NOT be
> > > bootable.
> >
> > Why should these be separate keys? There's no meaningful security
> > boundary between a kernel module and the ernel itself; a kernel
> > modulecan, for example, write to CR3, and that's game over for
> > any pretence at separation.
>
> It's standard practice for any automated build private key to be
> destroyed immediately to preserve security. Thus the modules get
> signed with a per kernel ephemeral build key but the MoK key is a long
> term key with a special signing infrastructure, usually burned into the
> distro version of shim. The kernel signing key usually has to be long
> term because you want shim to boot multiple kernels otherwise upgrading
> becomes a nightmare.
Fully agreed.
--
Best Regards
Masahiro Yamada
Reply to: