Re: [PATCH v4 0/3] ima: kernel build support for loading the kernel module signing key

[Mimi Zohar]

On Fri, 2021-04-09 at 10:35 -0400, Nayna Jain wrote:
> Kernel modules are currently only signed when CONFIG_MODULE_SIG is enabled.
> The kernel module signing key is a self-signed CA only loaded onto the
> .builtin_trusted_key keyring.  On secure boot enabled systems with an arch
> specific IMA policy enabled, but without MODULE_SIG enabled, kernel modules
> are not signed, nor is the kernel module signing public key loaded onto the
> IMA keyring.
> 
> In order to load the the kernel module signing key onto the IMA trusted
> keyring ('.ima'), the certificate needs to be signed by a CA key either on
> the builtin or secondary keyrings. The original version of this patch set
> created and loaded a kernel-CA key onto the builtin keyring. The kernel-CA
> key signed the kernel module signing key, allowing it to be loaded onto the
> IMA trusted keyring.
> 
> However, missing from this version was support for the kernel-CA to sign the
> hardware token certificate. Adding that support would add additional
> complexity.
> 
> Since the kernel module signing key is embedded into the Linux kernel at
> build time, instead of creating and loading a kernel-CA onto the builtin
> trusted keyring, this version makes an exception and allows the 
> self-signed kernel module signing key to be loaded directly onto the 
> trusted IMA keyring.

Thanks,  Nayna.

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git 
next-integrity

Mimi