4 ms·

Not a problem if everyone used Linux. (Sarcasm intended: no workable binary signing)

e12e 7y ago
You're right, but there is signing of kernel and modules now, via secure boot, eg: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Kernel_Administration_Guide/sect-signing-kernel-modules-for-secure-boot.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... I'm not sure about binaries in general - having secure boot as an anchor at least makes the exercise less futile - but there an interesting point brought up here: https://stackoverflow.com/questions/1732927/signed-executables-under-linux https://stackoverflow.com/questions/1732927/signed-executabl... Dynamic linker, dynamic libraries and dlopen. I see solaris has elfsign - and it appears to be in OpenSolaris too: https://github.com/joyent/illumos-joyent/blob/master/usr/src/cmd/cmd-crypto/elfsign/elfsign.c https://github.com/joyent/illumos-joyent/blob/master/usr/src... Not sure if it would work on Linux - and you'd might want to prevent running unsigned binaries. Not sure if that's a thing on OpenSolaris. Still, being able to verify a binary might help with handling random downloads, I suppose.
- badrabbit 7y ago
  Yeah, module signing but not turned on by any distro. I can't even imagine not having driver signing on windows in 2020. There is IMA in Linux too. Even package signing barely started catching up in the last few years on most non-mainstream distros. It's practically unthinkable to have script signing too.
  - e12e 7y ago
    AFAIK it's on by default in Ubuntu? > Modules built and shipped by Canonical with the official kernels are signed by the Canonical UEFI key and as such, are trusted. Custom-built modules will require the user to take the necessary steps to sign the modules before they loading them is allowed by the kernel. https://wiki.ubuntu.com/UEFI/SecureBoot https://wiki.ubuntu.com/UEFI/SecureBoot

e12e 7y ago

You're right, but there is signing of kernel and modules now, via secure boot, eg: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Kernel_Administration_Guide/sect-signing-kernel-modules-for-secure-boot.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... I'm not sure about binaries in general - having secure boot as an anchor at least makes the exercise less futile - but there an interesting point brought up here: https://stackoverflow.com/questions/1732927/signed-executables-under-linux https://stackoverflow.com/questions/1732927/signed-executabl... Dynamic linker, dynamic libraries and dlopen. I see solaris has elfsign - and it appears to be in OpenSolaris too: https://github.com/joyent/illumos-joyent/blob/master/usr/src/cmd/cmd-crypto/elfsign/elfsign.c https://github.com/joyent/illumos-joyent/blob/master/usr/src... Not sure if it would work on Linux - and you'd might want to prevent running unsigned binaries. Not sure if that's a thing on OpenSolaris. Still, being able to verify a binary might help with handling random downloads, I suppose.

badrabbit 7y ago
Yeah, module signing but not turned on by any distro. I can't even imagine not having driver signing on windows in 2020. There is IMA in Linux too. Even package signing barely started catching up in the last few years on most non-mainstream distros. It's practically unthinkable to have script signing too.
- e12e 7y ago
  AFAIK it's on by default in Ubuntu? > Modules built and shipped by Canonical with the official kernels are signed by the Canonical UEFI key and as such, are trusted. Custom-built modules will require the user to take the necessary steps to sign the modules before they loading them is allowed by the kernel. https://wiki.ubuntu.com/UEFI/SecureBoot https://wiki.ubuntu.com/UEFI/SecureBoot