Project Description

The keys in db or mok can be used to verify boot loader and kernel binary for booting. But upstream kernel doesn't trust them for enrolling to trusted keyring because they are enrolled outside the boundaries of kernel. Which means that IMA can not use db/mok keys for verification.

Currently if users/partners want to enroll their keys to the kernel trusted keyring, the user key must be signed by kernel's build-in key. But SUSE will not sign any user key. In upstream, there have some known technologies against this situation:

  • CONFIGSYSTEMEXTRA_CERTIFICATE Reserve a space in kernel binary for enrolling user's key.

  • MokListTrustedRT A new MOK variable be introduced. User can use this variable to tell shim and kernel that the keys in MOK can be trusted by kernel. Which means keys will be enrolled to trusted keyring.

Goal for this Hackweek

Find a good way for SLE/openSUSE user for enrolling their key to trust keyring in kernel. IMA should also trust those keys.

Resources

kernel, shim, mokutil

Looking for hackers with the skills:

security shim kernel mok

This project is part of:

Hack Week 21

Activity

  • about 2 months ago: joeyli started this project.
  • about 2 months ago: jzerebecki liked this project.
  • about 2 months ago: joeyli added keyword "security" to this project.
  • about 2 months ago: joeyli added keyword "shim" to this project.
  • about 2 months ago: joeyli added keyword "kernel" to this project.
  • about 2 months ago: joeyli added keyword "mok" to this project.
  • about 2 months ago: joeyli originated this project.

  • Comments

    Similar Projects

    Explore Crev as collaborative code audit by pperego

    Project Description

    Crev [1] is a collabo...


    Learn more about Application Security (AppSec) Open Source Tools and Testing Techniques by heidi.bronson

    [comment]: # (Please use the project descriptio...


    Model checking the BPF verifier by shunghsiyu

    Project Description

    BPF verifier plays a ...


    rust security reviews and cargo-crev by jzerebecki

    [comment]: # (Please use the project descriptio...


    Kanidm - Modern Opensource Identity Management by firstyear

    Project Description

    Kanidm is a identity ma...


    Nanos Unikernel by rpalethorpe

    Project Description

    Nanos is a "unikernel...


    mac80211_hwsim tool by cfconrad

    Project Description

    Write a userland tool...


    early stage kdump support by mbrugger

    [comment]: # (Please use the project descriptio...


    generic zswap dedup by ailiopoulos

    [comment]: # (Please use the project descriptio...


    Rust in linux kernel by dsterba

    [comment]: # (Please use the project descriptio...