4 ms·

If it’s all in software but the kernel has lower privileges, I’m curious how they’ll be able to update it? And if there is an API to update via the kernel, what

If it’s all in software but the kernel has lower privileges, I’m curious how they’ll be able to update it? And if there is an API to update via the kernel, what’s stopping a push via a malicious source pretending to be Apple?

saagarjha 2y ago
I don't think it is accurate to say that the kernel has lower privileges. It's just something the kernel isn't allowed to do, while the exclave has a list of things it isn't allowed to do. Also exclaves are shipped with normal software updates (verified by the boot chain, not the kernel).
brookst 2y ago
Less than entirely confident stab (someone please correct if I get this wrong): - Exclave exposes a small set of functions that kernel may call for sensitive operations - One of those is “update exclave”. The input to this is a blob signed with Apple’s private key. - Exclave verifies signature, so a compromised kernel and push a malicious update How the exclave gets Apple’s public key is a little opaque to me. One way would be to have the exclave have its own (per device or per global version) private key, but client side private keys are very high risk. Alternatively, perhaps some elaborate set of baked-in public keys for Apple and a way to validate a CRL?
- MBCook 2y ago
  I would think the Secure Enclave would handle such things. That said I’m not sure what you or GP mean by “update exclave”. It’s just part of the kernel binary loaded up at system start. Wouldn’t it be updated the same way the rest of the kernel is, probably requiring a restart?
  - brookst 2y ago
    No, because that way a rogue kernel could overwrite the exclave itself and the next reboot would be insecure. You can’t trust a low-trust environment to update a high-trust environment.
    - MBCook 2y ago
      Is that why everything is cryptographically secured in the boot chain? To ensure only trusted code is loaded?
      - kennysoona 2y ago
        Exactly.

saagarjha 2y ago

I don't think it is accurate to say that the kernel has lower privileges. It's just something the kernel isn't allowed to do, while the exclave has a list of things it isn't allowed to do. Also exclaves are shipped with normal software updates (verified by the boot chain, not the kernel).

brookst 2y ago

Less than entirely confident stab (someone please correct if I get this wrong): - Exclave exposes a small set of functions that kernel may call for sensitive operations - One of those is “update exclave”. The input to this is a blob signed with Apple’s private key. - Exclave verifies signature, so a compromised kernel and push a malicious update How the exclave gets Apple’s public key is a little opaque to me. One way would be to have the exclave have its own (per device or per global version) private key, but client side private keys are very high risk. Alternatively, perhaps some elaborate set of baked-in public keys for Apple and a way to validate a CRL?

MBCook 2y ago
I would think the Secure Enclave would handle such things. That said I’m not sure what you or GP mean by “update exclave”. It’s just part of the kernel binary loaded up at system start. Wouldn’t it be updated the same way the rest of the kernel is, probably requiring a restart?
- brookst 2y ago
  No, because that way a rogue kernel could overwrite the exclave itself and the next reboot would be insecure. You can’t trust a low-trust environment to update a high-trust environment.
  - MBCook 2y ago
    Is that why everything is cryptographically secured in the boot chain? To ensure only trusted code is loaded?
    - kennysoona 2y ago
      Exactly.