Matthew Garrett <mjg at redhat.com> writes: > On Tue, Oct 23, 2012 at 10:59:20AM -0400, Vivek Goyal wrote: > >> But what about creation of a new program which can call kexec_load() >> and execute an unsigned kernel. Doesn't look like that will be >> prevented using IMA. > > Right. Trusting userspace would require a new system call that passes in > a signature of the userspace binary, and the kernel would then have to > verify the ELF object in memory in order to ensure that it > matches the signature. Verifying that the copy on the filesystem is > unmodified isn't adequate - an attacker could simply have paused the > process and injected code. Verifying the copy on the filesystem at exec time is perfectly adequate for gating extra permissions. Certainly that is the model everywhere else in the signed key chain. Where IMA falls short is there is no offline signing capability in IMA itself. I think EVM may fix that. > Realistically, the only solution here is for > the kernel to verify that the kernel it's about to boot is signed and > for it not to take any untrusted executable code from userspace. Hogwash. The kernel verifing a signature of /sbin/kexec at exec time is perfectly reasonable, and realistic. In fact finding a way to trust small bits of userspace even if root is compromised seems a far superior model to simply solving the signing problem for /sbin/kexec. Although I do admit some part of the kexec process will need to verify keys on the images we decide to boot. Eric
