lkml.org 
[lkml]   [2014]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH 0/4] KEYS: validate key trust with owner and builtin keys only
    From
    On 11 June 2014 00:34, Dmitry Kasatkin <dmitry.kasatkin@gmail.com> wrote:
    > On 11 June 2014 00:25, Matthew Garrett <mjg59@srcf.ucam.org> wrote:
    >> On Wed, Jun 11, 2014 at 12:17:53AM +0300, Dmitry Kasatkin wrote:
    >>
    >>> It is probably just a paranoia...
    >>> Kconfig MODULE_SIG_UEFI should tell about threat of loading kernel
    >>> modules from NSA or Lenovo signed by MS or Lenovo keys..
    >>>
    >>> This hole is opened without warning...
    >>
    >> It's not typically a hole. If an attacker has root they can just replace
    >> your bootloader with one signed by a trusted key and then have that
    >> modify the kernel before booting it.
    >>
    >> If you're using a TPM then you can mitigate this, but if you have a TPM
    >> then you're already performing some extra steps during the boot process.
    >> Just add a sysfs knob that lets you drop the db keys and incorporate
    >> that into the TPM management code.
    >>
    >> --
    >> Matthew Garrett | mjg59@srcf.ucam.org
    >
    > I was expecting this boot loader answer.
    >
    > Indeed, if system is design to prevent online modification of bootloader then
    > kernel parameters are protected as well...
    >
    > My statement is still valid. It is a hole...
    >
    > To prevent the hole it should be explained that one might follow
    > certain instructions
    > to take ownership of your PC. Generate your own keys and remove MS and
    > Vendor ones...
    >
    > It is paranoia? May be not.
    >
    > - Dmitry

    I must admit that bootloader replacement is not related to kernel...

    It is just paranoia...

    - dmitry


    \
     
     \ /
      Last update: 2014-06-11 00:01    [W:4.318 / U:1.604 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site