Project Description
The keys in db or mok can be used to verify boot loader and kernel binary for booting. But upstream kernel doesn't trust them for enrolling to trusted keyring because they are enrolled outside the boundaries of kernel. Which means that IMA can not use db/mok keys for verification.
Currently if users/partners want to enroll their keys to the kernel trusted keyring, the user key must be signed by kernel's build-in key. But SUSE will not sign any user key. In upstream, there have some known technologies against this situation:
CONFIGSYSTEMEXTRA_CERTIFICATE Reserve a space in kernel binary for enrolling user's key.
MokListTrustedRT A new MOK variable be introduced. User can use this variable to tell shim and kernel that the keys in MOK can be trusted by kernel. Which means keys will be enrolled to trusted keyring.
Goal for this Hackweek
Find a good way for SLE/openSUSE user for enrolling their key to trust keyring in kernel. IMA should also trust those keys.
Resources
kernel, shim, mokutil
This project is part of:
Hack Week 21
Activity
Comments
-
7 months ago by jzerebecki | Reply
Thank you, good to know. This would make SecureBoot useful for me. Seems MokListTrustedRT is supported since kernel v5.18-rc1: https://github.com/torvalds/linux/blob/eaa54b1458ca84092e513d554dd6d234245e6bef/security/integrity/platform_certs/machine_keyring.c#L57 And since shim 15.5-rc2: https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
-
7 months ago by joeyli | Reply
My report of hackweek 21 topic in Asia wrap-up meeting: https://mysuse-my.sharepoint.com/:f:/g/personal/jlee_suse_com/Eh9GI6bsNU5IkhsmgSQR17IBFxGK7eXWhxj1_EvCVo80Pg?e=bc2198
-
7 months ago by joeyli | Reply
Video record of presentation in Asia wrap-up meeting: https://mysuse-my.sharepoint.com/:v:/g/personal/jlee_suse_com/EaoOJVtjeORAobvoqg75-D0BBgd9E5xkD6KgDGT226F-Tw?e=ma0tUh
-
Similar Projects
Rancher Token Revoker by mbolot
[comment]: # (Please use the project descriptio...
Run sandboxed Firefox with image and sound inside a container by nguyens
[comment]: # (Please use the project descriptio...
Create tool for managing RPM package signing keys by dheidler
[comment]: # (Please use the project descriptio...
Force USB devices to be read from a virtual machine on a given PC by nguyens
[comment]: # (Please use the project descriptio...
Authenticated hashes for BTRFS by dsterba
Project Description
Implement a checksum ...
drgn: implement crash top-level commands by marxin
Project Description
The goal of the proje...
Explore Steam Deck issues in openSUSE Tumbleweed by tschmitz
[comment]: # (Please use the project descriptio...
How software creation process can save energy and CO2 emissions by acervesato
[comment]: # (Please use the project descriptio...
early stage kdump support by mbrugger
[comment]: # (Please use the project descriptio...