public inbox for gentoo-dev@lists.gentoo.org
 help / color / mirror / Atom feed
From: Rich Freeman <rich0@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Subject: Re: [gentoo-dev] UEFI secure boot and Gentoo
Date: Fri, 15 Jun 2012 08:45:57 -0400	[thread overview]
Message-ID: <CAGfcS_=rybBHkeuAxF00GJkTVc8YkY1egg2OOBEG4S=MKLegrg@mail.gmail.com> (raw)
In-Reply-To: <4FDB28F5.8080303@gentoo.org>

On Fri, Jun 15, 2012 at 8:22 AM, Luca Barbato <lu_zero@gentoo.org> wrote:
> If we want to try to get serious on 5, we could try to gather the
> hardened/security people across distributions and setup the whole chain
> to be parallel and cut deals with OEM to store this trust-chain keys
> along with MS.

Perhaps.  Since we're only talking about the kernel really and that
doesn't vary as much across distros, we might even be able to get
momentum for it.

You could create a standard "secure kernel" - probably as a patch set
initially but perhaps merged into mainline with a config option that
turns on key verification for loading modules.  Anybody could use that
to secure their own systems by using their own key in the
configuration.  The central body could prepare and sign binaries for
individual distros.  A distro would supply a kernel config file and
patch set and identifier for the upstream kernel to build against.
The central body would audit the patches and config for security,
build the kernel, and sign it, assessing a fee perhaps (likely cheap
for config-only, and expensive for extensive patches).  The costs need
not be all that high - if you assume that vanilla linux with the
config option turned on is good enough then you only have to check
that the option is set, blacklist "bad" settings, and verify patches.
They could revoke certs when security issues are found, by keeping a
history of what configs/versions got signed.

Users could load the signing key of this body into their custom
settings, or OEMs could be persuaded to include it.  The latter would
never be 100% effective unless a court ordered it.

Rich



  reply	other threads:[~2012-06-15 12:46 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-06-15  4:28 [gentoo-dev] UEFI secure boot and Gentoo Greg KH
2012-06-15  4:45 ` Arun Raghavan
2012-06-15  4:56   ` Greg KH
2012-06-15  5:24     ` Arun Raghavan
2012-06-15 21:28       ` Matthew Thode
2012-06-15  5:48     ` Eray Aslan
2012-06-15  7:26     ` Michał Górny
2012-06-15  7:49       ` Florian Philipp
2012-06-15  8:06         ` Richard Farina
2012-06-15  8:24           ` Florian Philipp
2012-06-15 23:59         ` Greg KH
2012-06-16  8:33           ` Florian Philipp
2012-06-16  0:03       ` gregkh
2012-06-15  5:00   ` [gentoo-dev] " Duncan
2012-06-15  5:03   ` [gentoo-dev] " Ben de Groot
2012-06-15  5:08     ` Matthew Finkel
2012-06-15  5:24     ` Arun Raghavan
2012-06-15  7:12       ` Ben de Groot
2012-06-15  7:58         ` Richard Farina
2012-06-15  8:37           ` Florian Philipp
2012-06-15 11:32             ` Walter Dnes
2012-06-15 12:01               ` Rich Freeman
2012-06-15 12:48                 ` Florian Philipp
2012-06-16  9:22                 ` Maxim Kammerer
2012-06-17 17:03                   ` Greg KH
2012-06-17 19:22                     ` Maxim Kammerer
2012-06-15 10:50           ` Ben de Groot
2012-06-16  0:02     ` Greg KH
2012-06-15  4:45 ` Greg KH
2012-06-15  5:48   ` Philip Webb
2012-06-16  0:01     ` Greg KH
2012-06-16  3:18       ` Philip Webb
2012-06-15 21:35   ` Matthew Thode
2012-06-16  0:00     ` Greg KH
2012-06-15  4:50 ` [gentoo-dev] " Duncan
2012-06-15  5:01   ` Matthew Finkel
2012-06-15  7:54   ` Florian Philipp
2012-06-15 12:28     ` Walter Dnes
2012-06-15 12:55       ` Florian Philipp
2012-06-16 23:37         ` Steev Klimaszewski
2012-06-17 16:58           ` Greg KH
2012-06-17 17:24             ` Dale
2012-06-16 17:51     ` Michał Górny
2012-06-17  9:20       ` Florian Philipp
2012-06-17 15:51         ` Michał Górny
2012-06-17 16:55           ` Greg KH
2012-06-17 17:06             ` Michał Górny
2012-06-17 17:17               ` Rich Freeman
2012-06-17 17:28               ` Florian Philipp
2012-06-17 17:56               ` Greg KH
2012-06-17 16:56           ` Matthew Finkel
2012-06-17 17:10             ` Michał Górny
2012-06-17 17:40               ` Florian Philipp
2012-06-17 17:34       ` Sascha Cunz
2012-06-17 17:55         ` Rich Freeman
2012-06-17 18:00         ` Florian Philipp
2012-06-17 18:56           ` Sascha Cunz
2012-06-17 19:20             ` Graham Murray
2012-06-17 20:30             ` Florian Philipp
2012-06-17 23:07               ` Rich Freeman
2012-06-22  6:42                 ` George Prowse
2012-06-15  4:57 ` [gentoo-dev] " Chí-Thanh Christopher Nguyễn
2012-06-15 12:18   ` Luca Barbato
2012-06-15 12:33     ` Rich Freeman
2012-06-15 23:56   ` Greg KH
2012-06-16  6:30     ` Michał Górny
2012-06-15 10:14 ` Rich Freeman
2012-06-15 11:26   ` Florian Philipp
2012-06-15 12:22   ` Luca Barbato
2012-06-15 12:45     ` Rich Freeman [this message]
2012-06-15 15:46   ` G.Wolfe Woodbury
2012-06-15 23:55   ` Greg KH
2012-06-16  0:41     ` Rich Freeman
2012-06-16  3:49       ` Greg KH
2012-06-16 23:52 ` Matthew Summers
2012-06-17  0:23   ` [gentoo-dev] " Duncan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAGfcS_=rybBHkeuAxF00GJkTVc8YkY1egg2OOBEG4S=MKLegrg@mail.gmail.com' \
    --to=rich0@gentoo.org \
    --cc=gentoo-dev@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox