Re: [Ksummit-discuss] Last minute nominations: mcgrof and toshi

[Jason Cooper <jason@lakedaemon.net>]

Morning Andy,

On Mon, Aug 01, 2016 at 04:45:20PM -0700, Andy Lutomirski wrote:
> On Aug 1, 2016 4:30 PM, "Jason Cooper" <jason@lakedaemon.net> wrote:
> > On Mon, Aug 01, 2016 at 04:13:50PM -0700, Andy Lutomirski wrote:
> > > On Aug 1, 2016 4:04 PM, "Jason Cooper" <jason@lakedaemon.net> wrote:
...
> > > > Assuming Andy's lightweight signature scheme, it would probably be best
> > > > to do a lookup based on the sha256 hash of the file.  Then pathnames
> > > > don't matter, and bad files don't even get to the signature checking
> > > > code.
> > > >
> > >
> > > I'm not sure I understand what you mean.  What table would we look the hash
> > > up in?  What are we finding in that table?
> >
> > From the other subthread:
> >
> > > Then, to verify a signature, the kernel hashes the blob, generates its
> > > own linux_blob_signed_data, memcmps it to the one that Kyle signed
> > > (and rejects if they differ *at all*), and then verifies the
> > > signature.  (Do not try to be clever and parse the supplied
> > > linux_blob_signed_data -- there is a long and storied history of
> > > equivalent ideas being implemented incorrectly, and I can dig out
> > > literature references if you really want.  Just generate your own and
> > > memcmp it, which leaves no room for ambiguity.)
> > >
> >
> > So, I'm suggesting that when "the kernel hashes the blob", it use that
> > hash to locate *which* "Kyle-signed" linux_blob_signed_data it needs to
> > compare against.  That's all, just removing the filename from the
> > equation. :-)
> 
> So Kyle would generate a list of signatures indexed by the blob's hash
> instead of generating things like "iwlwifi-whatever.ucode.sig"?  Seems
> okay.  It'll keep the existing hooks working, I think.  Of course, we still
> need to check the "iwlwifi-whatever.ucode" bit to confirm that it matches
> Kyle's signed data.

Right.  That's where it may be better to use a version string, say the
sha1 from linux-firmware.git, or the upstream version number.  However,
that route means we can't easily 'build our own linux_blob_signed_data
and do a memcmp.' since userspace may not have that info handy.

It's almost as if we need some *unsigned* attributes that are purely
informative.  So we can dump a message in the logs:

  Loaded /lib/firmware/intel/iwlwifi-whatever.ucode., signature match for 'iwlwifi-20160711.ucode', signed by "Intel, Corp" RSA4096 key with
keyid <sha256>.

The first path is the actual location and name of the file, and the
second is the filename attribute that is a hint, but we don't depend on
it for matching or verification.

thx,

Jason.