I am trying to use certificate chain verification in Linux kernel.

The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA.

For this purpose I have used the scripts shown in create local CA and create IMA key as a basis. Of course I have adapted content of the genkey files to match my needs (key length, CN, ...)

The credentials created by these scripts are:

Root CA:

  • ima-local-ca.pem: Private key used to sign keys
  • ima-local-ca.x509: Self signed public key to be compiled into Linux kernel.

IMA key:

  • privkey_ima.pem: Private key used to create file signatures
  • x509_ima.der: Certificate with public key signed by root CA. Used to be loaded into keyring "_ima" for IMA signature verification.

The idea is that I want to use only keys that are signed by the root CA certificate compiled into the kernel.

I have seen functionality in keyctl to add restrictions to a keyring requiring keys to be signed by another key or any key in another keyring. With this approach I assume I have to add another keyring holding the root certificate and add such a restriction to "_ima" keyring.

Unfortunately this is only available from Kernel v4.12 onwards while I have to use a version that is older than that.

What was the proper way to enforce verification of the certificate chain in kernel versions prior to 4.12?

For my purpose it doesn't matter if faulty keys can be loaded into the keyring as long as validating a signature with that key will fail.

A solution allowing the usage of intermediate CA as well would be prefered.


You must log in to answer this question.

Browse other questions tagged .