[RFC PATCH v2 0/8] Clavis LSM

[Mimi Zohar]

Hi Eric,

On Thu, 2024-05-30 at 18:39 -0600, Eric Snowberg wrote:
> Introduce a new LSM called Clavis (Latin word meaning key).  The motivation
> behind this LSM is to provide access control for system keys.  Before spending
> more time on this LSM, I am sending this as an RFC to start a discussion to see
> if the current direction taken has a possibility of being accepted in the
> future.
> 
> Today the kernel has the following system keyrings: .builtin_trusted_keyring,
> .secondary_trusted_keyring, and the .machine.  It also has the .platform
> keyring which has limited capabilities; it can only be used to verify a kernel
> for kexec.

Please start the cover letter with the problem description/motivation, not the
solution.

>From https://docs.kernel.org/process/submitting-patches.html: 

"Describe your problem. Whether your patch is a one-line bug fix or 5000 lines
of a new feature, there must be an underlying problem that motivated you to do
this work. Convince the reviewer that there is a problem worth fixing and that
it makes sense for them to read past the first paragraph."

For example,

Additional keys not built into the kernel could originally be loaded onto the
.secondary_trusted_keyring *only* if they were signed by a key built into the
kernel or by a key already on the .secondary_trusted_keyring.  The concern for
using the wrong key for signature verification was minimal.  With the ability of
loading Machine Owner Keys(MOK) keys onto the .machine keyring, which is linked
to the .secondary_trusted_keys keyring, key usage is a real concern.

To limit key usage ...

> 
> Today the kernel also tracks key usage for verification done with any of these
> keys. Current verification usage includes: VERIFYING_MODULE_SIGNATURE,
> VERIFYING_FIRMWARE_SIGNATURE, VERIFYING_KEXEC_PE_SIGNATURE,
> VERIFYING_KEY_SIGNATURE, VERIFYING_KEY_SELF_SIGNATURE, and
> VERIFYING_UNSPECIFIED_SIGNATURE. After these usage types were originally
> introduced, most additions have typically used the
> VERIFYING_UNSPECIFIED_SIGNATURE.
> 
> At the moment, besides the usage enforcement for .platform keys, any key
> contained within the system keyrings can be used for any verification
> purpose.  For example, a key that was originally created to sign kernel
> modules could be used for BPF verification.
> 
> This new LSM adds the ability to do access control for all system keys. When
> enabled, only the .builtin_trusted_keys are available for loading kernel
> modules and doing a kexec.  Until an ACL entry is added for a specific key, no
> other system key may be used for any other purpose.

Keys stored on the .builtin_trusted_keys keyring seem to always be permitted,
independent of a Clavis rule, which is fine, but the above paragraph needs to be
re-worded.

> 
> Enabling the LSM is done during initial boot by passing in a single asymmetric
> key id within a new "clavis=" boot param. The asymmetric key id must match one
> already contained within any of the system keyrings.  If a match is found, a
> link is created into the new .clavis keyring.  This key shall be used as the
> root of trust for any keyring ACL updates afterwards.
> 
> On UEFI systems the "clavis" boot param is mirrored into a new UEFI variable
> within the EFI stub code. This variable will persist until the next power on
> reset.  This same type of functionality is done within shim. Since this
> variable is created before ExitBootServices (EBS) it will not have the NVRAM
> bit set, signifying it was created during the Boot Services phase. This is
> being used so the "clavis" boot param can not be changed via kexec, thereby
> preventing a pivot of the root of trust.

Move this paragraph (and patch) to later.  Defining a new UEFI variable makes it
more difficult to test.  Consider defering introducing the new UEFI variable
patch to the end.

> 
> As mentioned earlier, this LSM introduces a new .clavis keyring.  Following
> boot, no new asymmetric keys can be added to this keyring and only the key
> designated via the initial boot param may be used. This LSM can not be started
> at any other point in time.  The .clavis keyring also holds the access control
> list for system keys. A new key type called clavis_key_acl is being introduced.
> This contains the usage followed by the asymmetric key id. To be added to the
> clavis keyring, the clavis_key_acl must be S/MIME signed by the sole asymmetric
> key contained within it. New ACL additions to the .clavis keyring may be added
> at any time.

Ok. To summarize, the Clavis policy rules are loaded at runtime onto the .clavis
keyring.  The Clavis rules must be signed by the key specified on the "clavis="
boot command line.  The only key on the .clavis keyring is the one specified on
the boot command line.

As far as I'm aware, this would be the first time policy rules are stored in a
keyring.

> 
> Currently this LSM does not require new changes or modifications to any user
> space tools.  It also does not have a securityfs interface.  Everything is
> done using the existing keyctl tool through the new .clavis keyring. The
> S/MIME signing can be done with a simple OpenSSL command. If additions or
> updates need to be added in the future, new ACL key types could be created.
> With this approach, maintainability should not be an issue in the future
> if missing items are identified.
> 
> Clavis must be configured at build time with CONFIG_SECURITY_CLAVIS=y. The list
> of security modules enabled by default is set with CONFIG_LSM.  The kernel
> configuration must contain CONFIG_LSM=clavis,[...] with [...] as the list of
> other security modules for the running system.
> 
> For setup and usage instructions, the final patch includes an admin-guide.
> 
> Future enhancements to this LSM could include:
> 
> 1. Subsystems that currently use system keys with
>    VERIFYING_UNSPECIFIED_SIGNATURE could be updated with their specific
>    usage type.  For example, a usage type for IMA, BPF, etc could be
>    added.

Being able to at least limit the key used to verify the IMA policy signature
would be nice to have earlier, rather than later.

> 
> 2. Currently, each clavis_key_acl must be individually signed.  Add the ability
>    to sign multiple clavis_key_acl entries within the same file.
> 
> 3. Currently, this LSM does not place key usage restrictions on the builtin
>    keys for kexec and kernel module verification. This was done to prevent a
>    regression that could  prevent the kernel from booting.  This could be
>    changed if there was a way at compile time to pre-populate the .clavis
>    keyring. This would allow the ephemeral key used to sign the kernel
>    modules to be included within the .clavis keyring, allowing the kernel
>    to boot.

I don't see a problem with trusting the builtin keys.  They should be trusted. 

> 
> 4. UEFI Secure Boot Advanced Targeting (SBAT) support. Since
>    the boot param is mirrored into UEFI before EBS is called,
>    this LSM could be enhanced to not only enforce key usage,
>    but also SBAT levels across kexec.
> 
> 5. Having the ability to allow platform keys to be on par with
>    all other system keys when using this LSM. This would be useful
>    for a user that controls their entire UEFI SB DB key chain and
>    doesn't want to use MOK keys.

Additional comments:

This patch set is dependent on CONFIG_{MODULE, KEXEC}_SIG being enabled:

- with CONFIG_MODULE_SIG_FORCE and CONFIG_KEXEC_SIG_FORCE configured.
- wit sig_enforce specified on the boot command line.
- with either Lockdown or CONFIG_IMA_ARCH_POLICY enforcing kexec/module
signature verification.

Without CONFIG_{MODULE, KEXEC}_SIG enabled and with CONFIG_IMA_ARCH_POLICY
enabled or similar rules, IMA would verify the kexec kernel image and kernel
modules without Clavis enforcement.

Mimi