3 ms·

> Arch Check out "sbctl" by Foxboron, it's a UEFI key and signature manager [1] that's pretty nice. But other than that I agree with you there, I wish that up

> Arch Check out "sbctl" by Foxboron, it's a UEFI key and signature manager [1] that's pretty nice. But other than that I agree with you there, I wish that upstream kernel builds would be signed by the distro for secureboot usage. Maybe this should be part of the archlinux-keyring package? [1] https://github.com/foxboron/sbctl https://github.com/foxboron/sbctl

vladvasiliu 2y ago
But that relies on having the private key available locally, so it doesn't help with the scenario discussed here. Ideally, you'd want to sign the image on a different machine than the one booting it.
- cookiengineer 2y ago
  True, but that kind of also requires some way of distributing the bootable binaries, e.g. via netboot image via a TFTP server. I usually store these keys on a LUKS encrypted flash drive. Not the best opsec, but at least good enough to prevent this kind of malware from spreading around. Can't update the kernel without the flash drive though :D
  - exceptione 2y ago
    > I usually store these keys on a LUKS encrypted flash drive. Not the best opsec Why would it not be the best opsec? I replied to your other comment suggesting encrypting your local signing keys. I am not sure if I would use a flash drive though, why not just using the local disk?
  - josephcsible 2y ago
    If you have malware running on your system, couldn't it inject its bootkit code into whatever you're about to sign?
- bigfatkitten 2y ago
  I haven't looked into the tooling much, but does it at least support pkcs11? That way you'd at least be able to store the key on a smart card or Yubikey.
  - vladvasiliu 2y ago
    I don't know. I actually asked myself this very thing while typing the above comment, but I'm too busy/lazy to look it up. One issue I can see with this, though, is that if the malware is already present on your system and can run things, nothing would prevent it from hijacking the modules or the boot image before they're signed.
  - tomatocracy 2y ago
    Yes. Edit /etc/dkms/framework.conf, set mok_signing_key to something like "pkcs11:id=%01", and mok_certificate to point to a file containing the certificate. You can extract the certificate using eg "pkcs11-tool -r -y cert -d 01 > .../cert.der".

vladvasiliu 2y ago

But that relies on having the private key available locally, so it doesn't help with the scenario discussed here. Ideally, you'd want to sign the image on a different machine than the one booting it.

cookiengineer 2y ago
True, but that kind of also requires some way of distributing the bootable binaries, e.g. via netboot image via a TFTP server. I usually store these keys on a LUKS encrypted flash drive. Not the best opsec, but at least good enough to prevent this kind of malware from spreading around. Can't update the kernel without the flash drive though :D
- exceptione 2y ago
  > I usually store these keys on a LUKS encrypted flash drive. Not the best opsec Why would it not be the best opsec? I replied to your other comment suggesting encrypting your local signing keys. I am not sure if I would use a flash drive though, why not just using the local disk?
- josephcsible 2y ago
  If you have malware running on your system, couldn't it inject its bootkit code into whatever you're about to sign?
bigfatkitten 2y ago
I haven't looked into the tooling much, but does it at least support pkcs11? That way you'd at least be able to store the key on a smart card or Yubikey.
- vladvasiliu 2y ago
  I don't know. I actually asked myself this very thing while typing the above comment, but I'm too busy/lazy to look it up. One issue I can see with this, though, is that if the malware is already present on your system and can run things, nothing would prevent it from hijacking the modules or the boot image before they're signed.
- tomatocracy 2y ago
  Yes. Edit /etc/dkms/framework.conf, set mok_signing_key to something like "pkcs11:id=%01", and mok_certificate to point to a file containing the certificate. You can extract the certificate using eg "pkcs11-tool -r -y cert -d 01 > .../cert.der".