On Mon, Oct 11, 2021 at 12:02:35PM +0200, Ahmad Fatoum wrote: > The two existing trusted key sources don't make use of the kernel RNG, > but instead let the hardware doing the sealing/unsealing also > generate the random key material. However, Users may want to place "Users" -> "users" > less trust into the quality of the trust source's random number > generator and instead use the kernel entropy pool, which can be > seeded from multiple entropy sources. > > Make this possible by adding a new trusted.kernel_rng parameter, > that will force use of the kernel RNG. In its absence, it's up > to the trust source to decide, which random numbers to use, > maintaining the existing behavior. > > Suggested-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx> > Acked-by: Sumit Garg <sumit.garg@xxxxxxxxxx> > Reviewed-by: David Gstir <david@xxxxxxxxxxxxx> > Tested-By: Tim Harvey <tharvey@xxxxxxxxxxxxx> > Signed-off-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx> > --- > To: James Bottomley <jejb@xxxxxxxxxxxxx> > To: Jarkko Sakkinen <jarkko@xxxxxxxxxx> > To: Mimi Zohar <zohar@xxxxxxxxxxxxx> > To: David Howells <dhowells@xxxxxxxxxx> > Cc: James Morris <jmorris@xxxxxxxxx> > Cc: "Serge E. Hallyn" <serge@xxxxxxxxxx> > Cc: "Horia Geantă" <horia.geanta@xxxxxxx> > Cc: Aymen Sghaier <aymen.sghaier@xxxxxxx> > Cc: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> > Cc: "David S. Miller" <davem@xxxxxxxxxxxxx> > Cc: Udit Agarwal <udit.agarwal@xxxxxxx> > Cc: Jan Luebbe <j.luebbe@xxxxxxxxxxxxxx> > Cc: Eric Biggers <ebiggers@xxxxxxxxxx> > Cc: David Gstir <david@xxxxxxxxxxxxx> > Cc: Richard Weinberger <richard@xxxxxx> > Cc: Franck LENORMAND <franck.lenormand@xxxxxxx> > Cc: Sumit Garg <sumit.garg@xxxxxxxxxx> > Cc: keyrings@xxxxxxxxxxxxxxx > Cc: linux-crypto@xxxxxxxxxxxxxxx > Cc: linux-integrity@xxxxxxxxxxxxxxx > Cc: linux-kernel@xxxxxxxxxxxxxxx > Cc: linux-security-module@xxxxxxxxxxxxxxx > --- > Documentation/admin-guide/kernel-parameters.txt | 7 ++++++- > Documentation/security/keys/trusted-encrypted.rst | 20 +++++++++------- > security/keys/trusted-keys/trusted_core.c | 17 +++++++++++++- > 3 files changed, 35 insertions(+), 9 deletions(-) > > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt > index 43dc35fe5bc0..d5969452f063 100644 > --- a/Documentation/admin-guide/kernel-parameters.txt > +++ b/Documentation/admin-guide/kernel-parameters.txt > @@ -5772,6 +5772,13 @@ > first trust source as a backend which is initialized > successfully during iteration. > > + trusted.kernel_rng = [KEYS] > + Format: <bool> > + When set to true (1), the kernel random number pool > + is used to generate key material for trusted keys. > + The default is to leave the RNG's choice to each > + individual trust source. > + > tsc= Disable clocksource stability checks for TSC. > Format: <string> > [x86] reliable: mark tsc clocksource as reliable, this > diff --git a/Documentation/security/keys/trusted-encrypted.rst b/Documentation/security/keys/trusted-encrypted.rst > index 80d5a5af62a1..1d4b4b8f12f0 100644 > --- a/Documentation/security/keys/trusted-encrypted.rst > +++ b/Documentation/security/keys/trusted-encrypted.rst > @@ -87,22 +87,26 @@ Key Generation > Trusted Keys > ------------ > > -New keys are created from random numbers generated in the trust source. They > -are encrypted/decrypted using a child key in the storage key hierarchy. > -Encryption and decryption of the child key must be protected by a strong > -access control policy within the trust source. > +New keys are created from random numbers. They are encrypted/decrypted using > +a child key in the storage key hierarchy. Encryption and decryption of the > +child key must be protected by a strong access control policy within the > +trust source. The random number generator in use differs according to the > +selected trust source: > > - * TPM (hardware device) based RNG > + * TPM: hardware device based RNG > > - Strength of random numbers may vary from one device manufacturer to > - another. > + Keys are generated within the TPM. Strength of random numbers may vary > + from one device manufacturer to another. > > - * TEE (OP-TEE based on Arm TrustZone) based RNG > + * TEE: OP-TEE based on Arm TrustZone based RNG > > RNG is customizable as per platform needs. It can either be direct output > from platform specific hardware RNG or a software based Fortuna CSPRNG > which can be seeded via multiple entropy sources. > > +Optionally, users may specify ``trusted.kernel_rng=1`` on the kernel > +command-line to override the used RNG with the kernel's random number pool. > + > Encrypted Keys > -------------- > > diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c > index 8cab69e5d0da..569af9af8df0 100644 > --- a/security/keys/trusted-keys/trusted_core.c > +++ b/security/keys/trusted-keys/trusted_core.c > @@ -16,12 +16,17 @@ > #include <linux/key-type.h> > #include <linux/module.h> > #include <linux/parser.h> > +#include <linux/random.h> > #include <linux/rcupdate.h> > #include <linux/slab.h> > #include <linux/static_call.h> > #include <linux/string.h> > #include <linux/uaccess.h> > > +static bool trusted_kernel_rng; > +module_param_named(kernel_rng, trusted_kernel_rng, bool, 0); > +MODULE_PARM_DESC(kernel_rng, "Generate key material from kernel RNG"); It's not then always kernel RNG, i.e. that is a very misleading name. I'd prefer trusted_rng with string values "kernel", "tee". That makes it explicit what you are using. /Jarkko
