Linux 6.4 Allows For Optional CA Enforcement Of The Machine Keyring

[phoronix]

Phoronix: Linux 6.4 Allows For Optional CA Enforcement Of The Machine Keyring

With the Linux 6.4 kernel there is the ability being introduced so that the machine keyring can optionally only store CA-enforced keys...

https://www.phoronix.com/news/Linux-6.4-CA-Enforce-MOK-Keys

[WiR3D]

Can someone please dumb this down for me? Who does this affect and what does this mean for them?

[stormcrow]

Can someone please dumb this down for me? Who does this affect and what does this mean for them?

Part of the secure boot chain of trust. Makes it possible for machine owners that also use their own Certificate Authority to forbid keys not signed by their internal trusted CA key. This is mostly for corporations that have large fleets of Linux machines and need a central point of (internally controlled) trust. It's one extra hurdle to prevent anyone trying to usurp the trusted boot chain from inserting their own shim, kernel, or kernel modules from doing so. Not only would they have to insert their own key into the MOK, but they'd also have to compromise the corporate CA root key which can even be internally created and signed. It requires no external authorities.

This has nothing to do with DRM encryption. It's a security layer to help verify the kernel being booted and any subsequently loaded modules haven't been compromised by someone outside the organization.

Edit to add: This can also be used to forbid Microsoft signed keys or any other external keys regardless of source. Anyone about to go incendiary about Microsoft secure boot conspiracies and CA root authority corporations can save it. You don't like secure boot, big deal. Turn it off. This patch is opt-in anyway. Sane people will evaluate their own options and threat models and act accordingly.

[doublez13]

If I'm understanding this correctly, we'll finally be be to use sbctl to sign modules?

https://github.com/Foxboron/sbctl/issues/52

[WiR3D]

stormcrow thank you!