Security
Inline encryption support for block devices
In a combined storage and filesystem session at LSFMM 2017, Ted Ts'o led a discussion of support for inline cryptographic engines (ICEs) that are being used in mobile phones. A number of hacks have been made over the last few years by Android device makers for Linux support of these engines to encrypting filesystem data, but Ts'o would like to create something that can go into the mainline kernel. He was looking for thoughts on how to make that happen.
Doing AES encryption on the ARM cores that are used in mobile phones is fairly power hungry, so manufacturers are increasingly turning to ICE devices to encrypt the data on the device. These ICE devices sit between the CPU and the flash storage; the CPU must provide a key ID to them in order to use them. So there is a need to tell the engine which key to use for an I/O request. In the future, Ts'o said, the keys themselves may come from a secure element, such that the CPU and kernel will not have access to them at all.
Qualcomm has been trying to get support for ICE devices upstream for some time, but the code is "rather unspeakable". It blindly assumes an ext4 filesystem and roots through private pointers to access inode structures in order to associate key IDs with I/O requests. The Qualcomm code is not what is in the Pixel phones, he was quick to note; Qualcomm started with the Pixel code and "did horrible things to it".
His goal is to find upstream-acceptable changes to support ICE. A "nice to have" would be a way for him to remove the hacks in the ext4 and f2fs filesystems, as well, and add a filesystem and block encryption mechanism that does not require a device-mapper layer. For the desktop and server case, having a device-mapper layer makes it easier for users, he said, but with hardware crypto, there's no reason to have one.
Ts'o proposed adding a 32-bit key ID field to struct bio, which is what Universal Flash Storage (UFS) has. Key IDs are integer values that refer to keys that have been stored into "slots" in ICE device. He believes that most ICE devices will have far fewer slots than 32 bits will allow, though.
James Bottomley suggested using the Data Integrity Field and Data Integrity Extensions (DIF/DIX) support for the key IDs. Martin Petersen said there is a union that holds DIF/DIX or copy offload information; another field could be added for the key ID. Ts'o said he would look into that.
There will also be a need for a key slot manager of some kind. Since there will be a limited number of key slots for an ICE device, there can only be that many BIOs with different key IDs in flight at any given time. So the device will need to request a key slot, which might block if there are none available. The slots will need to be reference counted; they would be incremented when a BIO with an ID is submitted and decremented when it completes.
All of the key slot management would be hidden from the filesystem. The drivers will manage the slots, but the filesystem will need to identify the key that goes with a particular request. It is important that two BIOs with different keys do not get merged. David Howells asked about superblock encryption and whether mount() needs to know about keys, but Ts'o said that the metadata for the ext4 and f2fs filesystems is not encrypted on Android devices. There is some rough prototype code that Michael Halcrow has been working on that should come out soon, Ts'o said.
In something of a side note, he also mentioned that right now filesystem encryption on desktops or servers uses a per-process or per-session key ring. Users can set and remove their own keys from those rings, but that doesn't work for hardware devices because there is no concept of a key owner. Once a key gets into an ICE device, there are no further checks and anyone can use the key. It is the host operating system that allows or prevents access to files using the Unix permissions.
It would be useful to have a kind of global key ring for software crypto that could be used like an ICE device, he said. Keys would be added or removed only by root, but once they are added, those keys can be used by anyone on the system. Someone in the audience asked about containers where there may be multiple "root" users due to user namespaces. Ts'o said he hadn't thought about it. Someone suggested tying the key ring to the user namespace where they were created, so a global key ring created by root in a container would only be accessible to other users in that container/namespace.
Brief items
Garrett: A new Shim review process
Matthew Garrett announces a new, hopefully more efficient process for reviewing bootloaders to be used with Shim in UEFI secure boot systems. "To that end, we're adopting a new model. A mailing list has been created at shim-review@lists.freedesktop.org, and members of this list will review submissions and provide a recommendation to Microsoft on whether these should be signed or not."
Security updates
Alert summary March 16, 2017 to March 22, 2017
| Dist. | ID | Release | Package | Date |
|---|---|---|---|---|
| Arch Linux | ASA-201703-15 | firefox | 2017-03-20 | |
| Arch Linux | ASA-201703-17 | irssi | 2017-03-21 | |
| Arch Linux | ASA-201703-13 | linux-zen | 2017-03-16 | |
| Arch Linux | ASA-201703-16 | mbedtls | 2017-03-20 | |
| Arch Linux | ASA-201703-14 | wordpress | 2017-03-18 | |
| CentOS | CESA-2017:0558 | C7 | firefox | 2017-03-20 |
| CentOS | CESA-2017:0559 | C6 | openjpeg | 2017-03-20 |
| CentOS | CESA-2017:0498 | C5 | thunderbird | 2017-03-15 |
| CentOS | CESA-2017:0498 | C6 | thunderbird | 2017-03-15 |
| CentOS | CESA-2017:0498 | C7 | thunderbird | 2017-03-15 |
| CentOS | CESA-2017:0527 | C6 | tomcat6 | 2017-03-17 |
| Debian | DLA-859-1 | LTS | calibre | 2017-03-17 |
| Debian | DLA-863-1 | LTS | deluge | 2017-03-19 |
| Debian | DSA-3812-1 | stable | ioquake3 | 2017-03-18 |
| Debian | DLA-857-1 | LTS | libdatetime-timezone-perl | 2017-03-16 |
| Debian | DLA-861-1 | LTS | r-base | 2017-03-17 |
| Debian | DSA-3813-1 | stable | r-base | 2017-03-19 |
| Debian | DSA-3796-2 | stable | sitesummary | 2017-03-20 |
| Debian | DLA-856-1 | LTS | tzdata | 2017-03-16 |
| Debian | DLA-858-1 | LTS | wireshark | 2017-03-17 |
| Debian | DSA-3811-1 | stable | wireshark | 2017-03-18 |
| Debian | DLA-860-1 | LTS | wordpress | 2017-03-17 |
| Fedora | FEDORA-2017-da9d0f0dc0 | F24 | R | 2017-03-21 |
| Fedora | FEDORA-2017-ae18216e75 | F25 | R | 2017-03-21 |
| Fedora | FEDORA-2017-2258cfb450 | F24 | ettercap | 2017-03-15 |
| Fedora | FEDORA-2017-e8460ebed6 | F24 | icoutils | 2017-03-16 |
| Fedora | FEDORA-2017-0e9ad12958 | F25 | icoutils | 2017-03-16 |
| Fedora | FEDORA-2017-c1bec8972c | F24 | jasper | 2017-03-21 |
| Fedora | FEDORA-2017-3dba8a70ce | F25 | jasper | 2017-03-15 |
| Fedora | FEDORA-2017-9d06448c3e | F24 | knot-resolver | 2017-03-21 |
| Fedora | FEDORA-2017-df53d02da7 | F25 | knot-resolver | 2017-03-21 |
| Fedora | FEDORA-2017-b59943dcae | F25 | qbittorrent | 2017-03-15 |
| Fedora | FEDORA-2017-62ac1230f7 | F24 | qemu | 2017-03-21 |
| Fedora | FEDORA-2017-31b976672b | F25 | qemu | 2017-03-18 |
| Fedora | FEDORA-2017-534e23bad9 | F25 | rabbitmq-server | 2017-03-20 |
| Fedora | FEDORA-2017-da9d0f0dc0 | F24 | rkward | 2017-03-21 |
| Fedora | FEDORA-2017-ae18216e75 | F25 | rkward | 2017-03-21 |
| Fedora | FEDORA-2017-788129b61c | F24 | rpm-ostree | 2017-03-21 |
| Fedora | FEDORA-2017-003fa5648c | F25 | rpm-ostree | 2017-03-21 |
| Fedora | FEDORA-2017-da9d0f0dc0 | F24 | rpy | 2017-03-21 |
| Fedora | FEDORA-2017-ae18216e75 | F25 | rpy | 2017-03-21 |
| Fedora | FEDORA-2017-6558bc25bc | F24 | sscg | 2017-03-17 |
| Fedora | FEDORA-2017-19b5c9f1c6 | F25 | sscg | 2017-03-17 |
| Fedora | FEDORA-2017-936a79ee30 | F24 | tcpreplay | 2017-03-16 |
| Fedora | FEDORA-2017-dc1828d4f9 | F25 | tcpreplay | 2017-03-15 |
| Fedora | FEDORA-2017-783e8fa63e | F24 | w3m | 2017-03-21 |
| Fedora | FEDORA-2017-3d16d348eb | F25 | xen | 2017-03-21 |
| Gentoo | 201703-02 | adobe-flash | 2017-03-19 | |
| Gentoo | 201703-01 | openoffice-bin | 2017-03-19 | |
| Gentoo | 201703-03 | putty | 2017-03-19 | |
| Mageia | MGASA-2017-0077 | 5 | wavpack | 2017-03-17 |
| openSUSE | openSUSE-SU-2017:0740-1 | Chromium | 2017-03-18 | |
| openSUSE | openSUSE-SU-2017:0738-1 | 42.1 42.2 | Chromium | 2017-03-18 |
| openSUSE | openSUSE-SU-2017:0708-1 | 42.1 | dracut | 2017-03-16 |
| openSUSE | openSUSE-SU-2017:0765-1 | 42.1 42.2 | firefox | 2017-03-21 |
| openSUSE | openSUSE-SU-2017:0739-1 | irssi | 2017-03-18 | |
| openSUSE | openSUSE-SU-2017:0737-1 | 42.1 42.2 | irssi | 2017-03-18 |
| openSUSE | openSUSE-SU-2017:0792-1 | mbedtls | 2017-03-22 | |
| openSUSE | openSUSE-SU-2017:0790-1 | 42.1 42.2 | mbedtls | 2017-03-22 |
| openSUSE | openSUSE-SU-2017:0741-1 | 42.1 42.2 | putty | 2017-03-19 |
| openSUSE | openSUSE-SU-2017:0707-1 | 42.2 | qemu | 2017-03-16 |
| openSUSE | openSUSE-SU-2017:0742-1 | 42.1 42.2 | roundcubemail | 2017-03-19 |
| Oracle | ELSA-2017-0558 | OL7 | firefox | 2017-03-17 |
| Oracle | ELSA-2017-0559 | OL6 | openjpeg | 2017-03-19 |
| Oracle | ELSA-2017-0527 | OL6 | tomcat6 | 2017-03-15 |
| Red Hat | RHSA-2017:0725-01 | EL6 | bash | 2017-03-21 |
| Red Hat | RHSA-2017:0654-01 | EL6 | coreutils | 2017-03-21 |
| Red Hat | RHSA-2017:0558-01 | EL7 | firefox | 2017-03-17 |
| Red Hat | RHSA-2017:0680-01 | EL6 | glibc | 2017-03-21 |
| Red Hat | RHSA-2017:0574-01 | EL6 | gnutls | 2017-03-21 |
| Red Hat | RHSA-2017:0817-01 | EL6 | kernel | 2017-03-21 |
| Red Hat | RHSA-2017:0564-01 | EL6 | libguestfs | 2017-03-21 |
| Red Hat | RHSA-2017:0565-01 | EL6 | ocaml | 2017-03-21 |
| Red Hat | RHSA-2017:0559-01 | EL6 | openjpeg | 2017-03-19 |
| Red Hat | RHSA-2017:0641-01 | EL6 | openssh | 2017-03-21 |
| Red Hat | RHSA-2017:0621-01 | EL6 | qemu-kvm | 2017-03-21 |
| Red Hat | RHSA-2017:0794-01 | EL6 | quagga | 2017-03-21 |
| Red Hat | RHSA-2017:0533-01 | OSP5.0/EL6 | rabbitmq-server | 2017-03-15 |
| Red Hat | RHSA-2017:0662-01 | EL6 | samba | 2017-03-21 |
| Red Hat | RHSA-2017:0744-01 | EL6 | samba4 | 2017-03-21 |
| Red Hat | RHSA-2017:0698-01 | EL6 | subscription-manager | 2017-03-21 |
| Red Hat | RHSA-2017:0630-01 | EL6 | tigervnc | 2017-03-21 |
| Red Hat | RHSA-2017:0631-01 | EL6 | wireshark | 2017-03-21 |
| Scientific Linux | SLSA-2017:0558-1 | SL7 | firefox | 2017-03-20 |
| Scientific Linux | SLSA-2017:0559-1 | SL6 | openjpeg | 2017-03-20 |
| Slackware | SSA:2017-074-01 | pidgin | 2017-03-15 | |
| SUSE | SUSE-SU-2017:0732-1 | MGR2.1 MP2.1 OS5 SLE11 | firefox | 2017-03-17 |
| SUSE | SUSE-SU-2017:0714-1 | SLE12 | firefox | 2017-03-17 |
| SUSE | SUSE-SU-2017:0703-1 | SLE12 | flash-player | 2017-03-15 |
| SUSE | SUSE-SU-2017:0718-1 | MGR2.1 MP2.1 OS5 SLE11 | xen | 2017-03-17 |
| Ubuntu | USN-3240-1 | 12.04 14.04 16.04 16.10 | NVIDIA graphics | 2017-03-21 |
| Ubuntu | USN-3239-2 | 12.04 14.04 16.04 | eglibc, glibc | 2017-03-21 |
| Ubuntu | USN-3239-1 | 12.04 14.04 16.04 | eglibc, glibc | 2017-03-20 |
| Ubuntu | USN-3238-1 | 12.04 14.04 16.04 16.10 | firefox | 2017-03-20 |
| Ubuntu | USN-3237-1 | 12.04 14.04 16.04 16.10 | freetype | 2017-03-20 |
| Ubuntu | USN-3183-2 | 12.04 14.04 | gnutls26 | 2017-03-20 |
| Ubuntu | USN-3235-1 | 12.04 14.04 16.04 16.10 | libxml2 | 2017-03-16 |
| Ubuntu | USN-3234-1 | 16.04 | linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon | 2017-03-15 |
| Ubuntu | USN-3234-2 | 14.04 | linux-lts-xenial | 2017-03-15 |
| Ubuntu | USN-3173-2 | 14.04 16.04 16.10 | nvidia-graphics-drivers-375 | 2017-03-21 |
Page editor: Jake Edge
Next page:
Kernel development>>