March 2017 - openSUSE Security - openSUSE Mailing Lists

Re: [opensuse-security] signing custom kernel for secure boot
by Malte Gell 04 Apr '17

04 Apr '17

Am 30.03.2017 um 15:48 schrieb jsegitz(a)suse.de: > On Wed, Mar 29, 2017 at 09:19:42PM +0200, Malte Gell wrote: >> And, do I understand correctly, MokManager.efi is signed with the >> Microsoft KEK and writes my user key into the UEFI db key store? Thus, >> MokManager.efi is a way to get user keys into UEFI db? > > yes, with MokManager you can enroll your own keys Oh, is MokManager able to enroll new PK and KEK keys? That would be awesome, some mainboards have no EFI GUI for doing that and my Asrock only has a broken test PK..... :-( thanks Malte -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] signing custom kernel for secure boot
by Malte Gell 29 Mar '17

29 Mar '17

Hi there, to bring pain to a new level I play with secure boot and want to get a custom kernel run with secure boot. I read the SUSE how to from there: https://en.opensuse.org/openSUSE:UEFI#Booting_a_custom_kernel But, I am a bit confused, this guides signs vmlinuz, but not a single module!? Don´t the kernel modules need to be signed as well? Or is there some magic that applies the vmlinuz signature automatically to all modules?! Last, there is a UEFI boot entry "opensuse-trusted" (or similar), I guess this is meant to use with secure boot / shim? regards -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 2

Re: [opensuse-security] signing custom kernel for secure boot
by Malte Gell 29 Mar '17

29 Mar '17

Am 29.03.2017 um 18:14 schrieb jsegitz(a)suse.de: > On Wed, Mar 29, 2017 at 01:04:46PM +0200, Malte Gell wrote: >> to bring pain to a new level I play with secure boot and want to get a >> custom kernel run with secure boot. I read the SUSE how to from there: >> >> https://en.opensuse.org/openSUSE:UEFI#Booting_a_custom_kernel >> >> But, I am a bit confused, this guides signs vmlinuz, but not a single >> module!? >> Don´t the kernel modules need to be signed as well? > For openSUSE kernels module loading is not restricted (for SLES it is) Ok. I think this is no problem, there still is MODULE_SIG_FORCE to care for signed modules. And, do I understand correctly, MokManager.efi is signed with the Microsoft KEK and writes my user key into the UEFI db key store? Thus, MokManager.efi is a way to get user keys into UEFI db? thanks -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] SUSE kernel security features vs vanilla
by Malte Gell 28 Mar '17

28 Mar '17

Just out of curiousity, do SUSE kernel have security specific patches / features, the vanilla kernel does not have? regards m -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 4

[opensuse-security] SUSEfirewall udp broadcast
by Malte Gell 24 Mar '17

24 Mar '17

In order to allow UDP broadcast with the SUSEfirewall, is it enough to add e.g. BROADCAST="123,456" to the rules or is there more to add? I ask, because in my set UDP broadcast may have been dropped, despite using BROADCAST="123".... thanksx -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

4 8

[opensuse-security] Question on a seccheck mail
by Werner Flamme 13 Mar '17

13 Mar '17

Hi list, seccheck sent me a mail from a SLES 12 SP 1. I do not understand what the mail should tell me. Subject: *** SECURITY information for <hostname> *** Content (one line): <hostname> : Mar 12 08:09:24 : root : problem with defaults entries ; TTY=unknown ; PWD=/ ; <hostname> ist just the placeholder for the real hostname :) What does "problem with defaults entries" mean? Puzzled Werner --

2 2