Re: [yocto-patches] [meta-security][PATCH] dm-verity: add PKCS#7 root hash signature support
Ahmad Fatoum <[email protected]>
| Newsgroups | org.yoctoproject.lists.yocto-patches |
|---|---|
| Message-ID | <[email protected]> |
Hello Ayoub, On 4/24/26 1:53 PM, Ayoub Zaki wrote: > On 4/24/26 09:19, Ahmad Fatoum wrote: >> Frankly, I don't see how for signed FIT configurations this offers a >> security >> benefit. >> > > > You're right about the RAM symmetry STRICT_KERNEL_RWX IOMMU don't really > help once you've granted the attacker DMA or JTAG. > > There's a also other cases where the patch could help and it doesn't > need RAM tampering. where root hash comes from the kernel cmdline via a > unsigned Bootloader enviroments. The security of any such system is not salvageable. An attacker just needs to stick an init=/bin/sh there, they wouldn't even bother to compute any dm-verity hashes. > An attacker could tamper the env > offline with their own root hash and craft a matching rootfs. Sure, an attacker could also just tamper with the initramfs itself to mount the rootfs without any dm-verity at all.. > Even the secure boot chain is not interupted, dm-verity happily sets up > against the attacker's hash and mounts their rootfs. > > With CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG the kernel refuses an unsigned > hash regardless of where it came from (enforcment via dm_verity > require_signatures=1 should be set) > So defense in depth not a replacement for hardware mitigations. I just want to avoid that we give users a false sense of security. > I can reframe the threat model in a v3 an maybe drops the RAM arguments. Yes, please. CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG has its place for sure, but not for protecting against DMA attacks or an insecurely configured bootloader. Please keep me in the loop for later series. Cheers, Ahmad -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |