- Arch-general - lists.archlinux.org

Re: Kernel with IMA and "better" secure boot / MOK support
by Johan Dahlberg 26 Sep '24

26 Sep '24

On 2024-09-26 16:52, simon-b(a)murena.io wrote: > Hi, > Hi, thanks for replying! Just to avoid any confusion, the setup I'm using already works the way I want, I'm just hoping to find a way to avoid custom kernels. > you can add public keys to the kernel keyring which are stored in a > hardware store (e.g. the UEFI key database). [0] This is mostly what I've been doing, using mokutil to store the mok cert in an efivar with shim. shim then pulls them in to the MokListRT efivar, which the kernel then validates against (if I understood it all correctly). But that is only as long as IMA is enabled in the kernel.. without IMA the .machine keyring never gets populated. The MOK keys will however end up in the .platform keyring even without IMA, but it will not trust them since they're not part of the chain the kernel trusts (.builtin_trusted_keys, or .secondary_trusted_keys). One would need to add one's own CA cert in the kernel build (and sign the modules with the same CA to make this work, I think. Documentation has left me a bit confused on this. > > You can also sign the modules with a MOK. [1] > I've also tried to do this, adding my MOK cert next to the Database cert from the UEFI secure boot setup, and then signing the the modules with the corresponding key. But the kernel still didn't want to trust this cert. Again I assume because the kernels chain of trust requires the MOK cert to come from the same CA as one of the .builtin_trusted_keys. Arch uses auto-generated keys on their kernel builds, so this can't work as far as I understand. And even they signed with their own keys, I'd need to sign my modules with the same key as them, which obviously wouldn't be possible. Perhaps there are facilities in the kernel I'm unaware of here but it seems to me the only way for a user to validate out-of-tree module signatures are with MOKs. Which is why I started thinking maybe there needs to be another official kernel that supports this. > Since I don't use external modules, I have not tested any of these > methods. Any modules that comes with the kernel will always pass validation and load since they share the same auto-generated key/cert. > > I am not sure how you use the IMA (e.g. wether you verify the PCR10 > from a TPM2), but an alternative could be > > a dm-verity signed root-fs, e.g. created with verity-squash-root [2]. > I believe the more advanced features of IMA are not needed in this scenario. In the case of being able to validate out-of-tree modules against MOK signatures all that is needed is CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT (as far as I can tell at least). > Best, > > Simon > > [0] > https://www.kernel.org/doc/html/v6.11/admin-guide/module-signing.html > > [1] > > https://gist.github.com/lijikun/22be09ec9b178e745758a29c7a147cc9 > > [2] > > https://aur.archlinux.org/packages/verity-squash-root > Regards, Johan > September 26, 2024 at 12:09 PM, "Johan Dahlberg" <joda(a)nejomi.net> > wrote: > >> For the last couple of years I've been rolling my own kernels on a >> couple of machines in order to have better support for secure boot >> and especially mok keys. This has been necessary for being able to >> boot with lockdown=confidentiality/integrity and still be able to >> load any signed out-of-tree (dkms) modules. The official kernels in >> arch is built without IMA support as it would break the ability to >> kexec to another kernel when secure boot is on (since the kernels >> are built with auto-generated keys, they would fail validation). >> There are some bug reports on the subject, see [1] and [2]. >> >> How I'm validating signed out-of-tree modules goes as following: >> >> - uefi to setup mode >> >> - create my own EFI keys, and enroll them >> >> - roll my own uki kernel (built with IMA) and sign it and it's >> modules and any out-of-tree modules >> >> - set uefi to boot shim.efi, which then calls grubx64.efi (which is >> just a renamed systemd-boot in my case) >> >> - shim passes on mok keys >> >> - systemd-boot boots the kernel with lockdown=confidentiality >> >> - kernel adds the keys passed from shim to the (.machine) keyring >> and successfully loads any modules signed with a key listed in mok >> >> It's been a while since I set it up so I might have misremembered >> some step there. >> >> Anyway to my question, since the situation with kexec and IMA is >> probably not going to change, and since there probably (?) are more >> people out there who would like to use the whole secure boot chain >> with MOKs and all, perhaps it would be possible to discuss providing >> another official kernel which is built to support the above >> scenario? I'm not too deep into the arch dev system and tools, but >> considering what I'm doing - just pulling the PKGBUILD and doing >> some minimal changes to the config and then building it, it seems it >> would not add too much of a maintenance overhead. >> >> Perhaps there are other ways of achieving the same results that I'm >> not aware of.. if so I'm curious to hear about it. Mostly I'm just >> trying to get out of having to use custom kernels. :-) >> >> Thanks for reading, >> >> Johan >> >> [1] https://bugs.archlinux.org/task/75102 >> >> [2] https://bugs.archlinux.org/task/75041

1 0

Re: strange Adwaita tray icon difficulties
by Abraham S.A.H. 26 Sep '24

26 Sep '24

Sep 26, 2024, 07:26 by daniel.ranc(a)telecom-sudparis.eu: > > Abraham, > > Thank you for this rant which i would have been too shy to write > myself on the list, but i am completely with you on that issue. I > would even add that major applications such as Thunderbird are, > at times, subject to very strange bugs and behaviors related to > "new features to make it slick", slickness in which i am not > interested at all, so that i always install Seamonkey as plan B. > > I relate these problems to project governance issues rather than > budget problems (which they are constantly invoking). Sad. > > Copy to my friend Tarus, who's involved in Open Source matters. > > Cheers > Daniel > > ps. i confess between us that the dinosaur that i am uses FVWM :-) > > > On 26/09/2024 03:02, Abraham S.A.H. wrote: > >> I have bitten by that too, on three systems that I maintain. Even on >> the one which uses Xfce desktop. This random breaking changes to GTK >> and Gnome related stuff is disrespectful to users. And the usuall >> answer is that “If you don’t like it, use something else!”; but they >> are damn everywhere. Gtk used to be the goto universal toolkit on >> GNU/Linux platform that everyone would use to make his/her app; now >> they are maintaining and developing it only for Gnome and Adwaita >> adhering apps. Anything based on GTK keeps not fitting in any other >> DE or any machine that Gnome project doesn’t like or care to support. >> >> And worst is, that any complaint anywhere usually results in aggressive >> or hostile responses. >> >> >> -- >> Best Regards, >> Abraham >> Sent with Tutanota; >> https://tuta.com >> Well, as far as I know, Gnome is one of the most sponsored Free Software projects. And The most sponsored open source desktop environment. And developers are mainly employees of the sponsers (mostly by Red Hat). It's often claimed that Gnome is a community project. Compare it with Emacs, which has about 19 mailing lists; one of them being the development mailing list (emacs-devel) that all development discussions happen openly there. And one can submit his/her patch or code to be included in Emacs! — and unlike Gnome, they even don't scream being a community software project. Actually, many of Emacs features are from the free volunteers that donated their code; just through this mailing list. In contrast, in Gnome, even major bug reports get closed as not planned or not supported, or that it’s not a bug in Gnome software, because you installed that package from your distro rather than Flatpak, or you installed that extension from AUR instead of web interface. And basically, there is no easy way for user-developers to change GTK or Gnome DE out of what Gnome project foresees. If a feature is not planned you are not allowed to implement it, even with two or three developers. — Well, seems fair, since you just implement it, but they have to maintain it. All that aside, Gnome project has its board and its developers and sponsors, and they have the right to decide about the direction. All okay. Problem arises when you have to pull in gtk4 and gtk3 packages only for installing ‘ibus’! Now, that one is ridiculous. And that is my whole point; gtk is everywhere because it was there from when none of these were an issue. -- Best Regards, Abraham Sent with Tutanota; https://tuta.com

1 0

Kernel with IMA and "better" secure boot / MOK support
by Johan Dahlberg 26 Sep '24

26 Sep '24

For the last couple of years I've been rolling my own kernels on a couple of machines in order to have better support for secure boot and especially mok keys. This has been necessary for being able to boot with lockdown=confidentiality/integrity and still be able to load any signed out-of-tree (dkms) modules. The official kernels in arch is built without IMA support as it would break the ability to kexec to another kernel when secure boot is on (since the kernels are built with auto-generated keys, they would fail validation). There are some bug reports on the subject, see [1] and [2]. How I'm validating signed out-of-tree modules goes as following: - uefi to setup mode - create my own EFI keys, and enroll them - roll my own uki kernel (built with IMA) and sign it and it's modules and any out-of-tree modules - set uefi to boot shim.efi, which then calls grubx64.efi (which is just a renamed systemd-boot in my case) - shim passes on mok keys - systemd-boot boots the kernel with lockdown=confidentiality - kernel adds the keys passed from shim to the (.machine) keyring and successfully loads any modules signed with a key listed in mok It's been a while since I set it up so I might have misremembered some step there. Anyway to my question, since the situation with kexec and IMA is probably not going to change, and since there probably (?) are more people out there who would like to use the whole secure boot chain with MOKs and all, perhaps it would be possible to discuss providing another official kernel which is built to support the above scenario? I'm not too deep into the arch dev system and tools, but considering what I'm doing - just pulling the PKGBUILD and doing some minimal changes to the config and then building it, it seems it would not add too much of a maintenance overhead. Perhaps there are other ways of achieving the same results that I'm not aware of.. if so I'm curious to hear about it. Mostly I'm just trying to get out of having to use custom kernels. :-) Thanks for reading, Johan [1] https://bugs.archlinux.org/task/75102 [2] https://bugs.archlinux.org/task/75041

1 0

strange Adwaita tray icon difficulties
by Daniel Ranc 26 Sep '24

26 Sep '24

Dear all, I am experiencing some strangeness with the Adwaita tray icons of VLC and volumeicon. They disappeared from the tray around this summer (unfortunately no precise data here) and I needed to revert to the latest working package adwaita-icon-theme-41.0-1-any.pkg.tar.zst for those icons to work again. My environment is using stalonetray and a very simple window manager (no Gnome, no KDE whatsoever). Are others impacted as well ? Any clue how to get back on track ? Interestingly last week some apps suddenly showed completely black windows: simple-scan and pavucontrol, and i had to revert to older packages to make them work again. Are those phenomena related? Thanks for any help. Daniel

6 9

lightdm login loop with systemd-homed
by Abraham S.A.H. 26 Sep '24

26 Sep '24

It seems that from systemd 256 onwards, lightdm cannot properly log into homed user accounts. At least in X sessions. It keeps in a loop of "getting password --> (trying to) logging in --> black journaled screen --> getting back to the first step asking for password again" It can't read ~/.Xauthority, tries to find it at /.Xauthority instead. lightdm unit logs says: ~~~ Error writing X authority: Failed to open X authority /.Xauthority: Permission denied ~~~ It doesn't seem to be related to https://wiki.archlinux.org/title/LightDM#Infinite_login_loop Also, there's an open issue related to this in lightdm's github repository Is there anyone who is experiencing the same issue? -- Best Regards, Abraham Sent with Tutanota; https://tuta.com

3 6

mkarchroot fails with "Permission denied" error during pacman sync (maybe alpm download user related?)
by Henning 25 Sep '24

25 Sep '24

Hi, I hope this is (one) of the correct places to request some help. I followd this Wiki article (https://wiki.archlinux.org/title/DeveloperWiki:Building_in_a_clean_chroot) and failed on the classical way and I have no clue why :-) I add some example output on the buttom. Maybe related. The "arch machine" with this error is a VM, running via incus on an arch host. The VM use ext4, the host btrfs. On the arch host itself, the command work as expected. Only inside the VM it fails. If I comment out "DownloadUser = alpm" in /etc/pacman.conf, it works. But this is also enabled on the (working) host, without any problems. (same default pacman.conf) Thanks Henning ################################################################### [henning@archlinux ~]$ sudo rm -rf test/ [henning@archlinux ~]$ mkdir test [henning@archlinux ~]$ mkarchroot test/root base-devel ==> Creating install root at /home/henning/test/root ==> Installing packages to /home/henning/test/root :: Synchronizing package databases... error: could not open file /home/henning/test/root/var/lib/pacman/sync/download-AIUAX3/core.db.part: Permission denied error: failed to setup a download payload for core.db error: failed to synchronize all databases (failed to retrieve some files) ==> ERROR: Failed to install packages to new root ==> ERROR: Failed to install all packages

2 1

dbus-broker-units provides dbus-units
by u34＠net9.cf 25 Sep '24

25 Sep '24

$ pacman -Qi dbus-broker-units | grep Provides Provides : dbus-units Seeing that, I assumed it is enough to have the dbus-broker-units package, without having the dbus-units package. That assumption turns to be wrong. While trying to build a chroot environment, if the dbus-units package can not be obtained, the process fails. :: Retrieving packages... dbus-units-36-4-x86_64.pkg.tar.zst failed to download error: failed retrieving file 'dbus-units-36-4-x86_64.pkg.tar.zst' from the_repo : The requested URL returned error: 404 warning: failed to retrieve some files error: failed to commit transaction (failed to retrieve some files) Errors occurred, no packages were upgraded. ==> ERROR: Failed to install packages to new root ==> ERROR: Failed to install all packages One reason for the explicit search for dbus-units is that systemd explicitly depends on dbus-units. $ pacman -Qi systemd | grep dbus-units Depends On : ... dbus dbus-units ... Am I confused? Why the chroot must have a dbus-units package? -- u34

2 1

mkarchroot and Manual intervention for pacman 7.0.0 and local repositories required
by u34＠net9.cf 24 Sep '24

24 Sep '24

$ pacman -Qo mkarchroot /usr/bin/mkarchroot is owned by devtools 1:1.2.1-1 Referring to https://archlinux.org/news/manual-intervention-for-pacman-700-and-local-rep… and to https://wiki.archlinux.org/title/DeveloperWiki:Building_in_a_clean_chroot#S… with a modified pacman.conf: error: could not open file /home/user/chroot/root/var/lib/pacman/sync/download-o6cp5z/core.db.part: Permission denied error: failed to setup a download payload for core.db error: failed to synchronize all databases (failed to retrieve some files) ==> ERROR: Failed to install packages to new root ==> ERROR: Failed to install all packages The modified pacman.conf is using links created with ln -s /var/lib/pacman/sync/*.db /var/cache/pacman/pkg/ I have also tried the naive approach of --- a/usr/bin/mkarchroot 2024-06-23 21:00:54.158267054 +0000 +++ b/usr/bin/mkarchroot 2024-09-22 19:31:52.984269364 +0000 @@ -73,6 +73,7 @@ [[ -e $working_dir ]] && die "Working directory '%s' already exists" "$working_dir" mkdir -p "$working_dir" +chown :alpm "$working_dir" lock 9 "${working_dir}.lock" "Locking chroot" In addition, the most basic suggestion of https://wiki.archlinux.org/title/DeveloperWiki:Building_in_a_clean_chroot#S… , namely # mkarchroot /home/user/chroot/root base-devel also fails. Though it could be due to a usually working XferCommand in pacman.conf. Does mkarchroot broken? -- u34

2 5

spam on the forum
by funny0facer 22 Sep '24

22 Sep '24

Could someone please ban https://bbs.archlinux.org/profile.php?id=162864 on the forum? This person is posting pictures, I really do not want to see. Thanks

3 5

pacman 7 - why is #ParallelDownloads = 5 commented by default now?
by David C. Rankin 21 Sep '24

21 Sep '24

Devs, As I merged .pacnew changes for pacman.conf, I notice the parallel download option is now commented by default. I left it that way. But why is that now the default after having parallel transfer come in as a new feature a year or two ago? -- David C. Rankin, J.D.,P.E.

2 2