[LU-1354] PGP Sign RPM's

• Status: Open
• Project: Lustre
• Affects Version/s: Lustre 2.7.0, Lustre 2.5.5
• Type: New Feature
• Priority: Minor
• Reporter: Michael Di Domenico
• Assignee: Oleg Drokin
• Resolution: Unresolved
• Labels: mq115

Description

The current RHEL RPM's as delievered by whamcould are not signed with a PKI certificate. It would be beneficial if Whamcloud could sign the RPM's with PKI to verify that Whamcloud is in fact the author of the RPM's.

Comments

[Brian Murrell (Inactive)]

We certainly could create a GPG key and sign our RPMs with it. It would be a key with likely no web of trust to it from you though so how much would you really trust it?

[Michael Di Domenico]

Well some trust is better then no trust, eh? But it does provide someone an ability to verify that the packages were created by a specific person and that the packages have not been altered down the chain.

http://docs.redhat.com/docs/en-US/Red_Hat_Network_Satellite/5.3/html/Deployment_Guide/satops-rpm-building.html

as long as the passphrase is safe and the whamcloud servers remain protected, I should be able to sign-off to an auditor that the software I downloaded did in fact come from and was produced by Whamcloud. The only other way I can make that claim with any real distinction would be to have a (silver, non-r/w) CD mailed from whamcloud to me.

[Andreas Dilger]

There are several people (myself, Brian Murrell, maybe Oleg) on the HPDD team that have well-known keys that could sign an RPM-signing key.

[Marcin Dulak]

It would be valuable to have the RPMS finally signed - also in order to use them properly with configuration management tools like Puppet, etc.

[Nathaniel Clark]

If we're going to sign rpms, we should also consider signing the modules so they will work in a FIPS enabled kernel.

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations

https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html

 

[Gerrit Updater]

Nathaniel Clark ([e-mail]) uploaded a new patch: https://review.whamcloud.com/34132
Subject: LU-1354 build: Sign kernel modules during build
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: a51e35b679049fbe1e358dd98b3158df0f5abd25

[Nathaniel Clark]

After further investigation. The module signing / cert management is as follows:

1. During the kernel build, a unique pub/priv key is generated (using info in kernelsource/x509.genkey):

   kernelsource/signing_key.{x509,priv}
   

1. All certificates in kernel source dir (files with the .x509 extension) are signed with the per-kernel key and included in the default trust chain.
2. All kernel modules are signed with the signing_key and thus any module signed with those would also be acceptable.

NOTE:
CentOS does not sign any of the provided kmod-* packaged modules.

[Aurelien Degremont (Inactive)]

Is there any news on this topic ?

[James McKenna]

Bumping this topic. Any news?

[James A Simmons]

Sigh. The latest Ubuntu enforces this now

[ 4874.368433] Lockdown: insmod: unsigned module loading is restricted; see man kernel_lockdown.7

[Aurelien Degremont (Inactive)]

By latest, do you mean latest kernel for Ubuntu 20.04 LTS, or kernel on latest Ubuntu 21.04 ?