[RFC] Kdump with signed images

[Eric W. Biederman]

Matthew Garrett <mjg at redhat.com> writes:

> On Tue, Oct 23, 2012 at 10:59:20AM -0400, Vivek Goyal wrote:
>
>> But what about creation of a new program which can call kexec_load()
>> and execute an unsigned kernel. Doesn't look like that will be
>> prevented using IMA.
>
> Right. Trusting userspace would require a new system call that passes in 
> a signature of the userspace binary, and the kernel would then have to 
> verify the ELF object in memory in order to ensure that it 
> matches the signature. Verifying that the copy on the filesystem is 
> unmodified isn't adequate - an attacker could simply have paused the 
> process and injected code. 

Verifying the copy on the filesystem at exec time is perfectly adequate
for gating extra permissions.  Certainly that is the model everywhere
else in the signed key chain.

Where IMA falls short is there is no offline signing capability in IMA
itself.  I think EVM may fix that.

> Realistically, the only solution here is for 
> the kernel to verify that the kernel it's about to boot is signed and 
> for it not to take any untrusted executable code from userspace.

Hogwash.  The kernel verifing a signature of /sbin/kexec at exec time is
perfectly reasonable, and realistic.  In fact finding a way to trust
small bits of userspace even if root is compromised seems a far superior
model to simply solving the signing problem for /sbin/kexec.

Although I do admit some part of the kexec process will need to verify
keys on the images we decide to boot.

Eric