Enable signature verification of kexec kernel and use new Mariner Trusted Base CA in trusted keyring

[christopherco]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Currently, kexec and features that utilize kexec like kdump are blocked from executing due to IMA apprasial runtime policies introduced in this commit 3e0884c . However, since we utilize Secure Boot PE verification of the kernel, the expectation should be that our official signed kernels are verified by a key that is trusted in the kernel's trusted keyring.
So this change enables signature verification of kexec kernel, utilizing PE file signature verification method to verify the kernel is signed by an x.509 cert in the kernel keyring, and append our updated Azure Linux (aka Mariner) Trusted Base CA into the kernel's trusted keyring.

Signed-off-by: Chris Co [email protected]

Does this affect the toolchain?

YES

Associated issues

• https://microsoft.visualstudio.com/OS/_queries/edit/54615562

Test Methodology

• Pipeline build id: 672815

root [ /home/azureuser ]# keyctl show %:.builtin_trusted_keys
Keyring
 461486341 ---lswrv      0     0  keyring: .builtin_trusted_keys
 827138104 ---lswrv      0     0   \_ asymmetric: Build time autogenerated kernel key: 7089ab4c0b7d02e48af80578b97416fde41f6a3d
 338913632 ---lswrv      0     0   \_ asymmetric: Microsoft Corporation: Mariner Trusted Base RSA Code Signing CA: 7554b15f7d70fcf08db90faa6a75c1beb48a7e5c
 486285024 ---lswrv      0     0   \_ asymmetric: Microsoft Corporation: Mariner Secure Boot(Production Signing): b42d6b9e2809b7b9097cff9e9b0194b86e80bf95

[rlmenge]

Added new commit to replace the old key completely rather than appending to it.

Verification steps:
New BuddyBuild with removing the old key

Tests performed

• copied kernel-6.6.57.1-3 rpm from buddybuild to both arm and x86
• copied an unsigned vmlinuz-6.6.35.1-5.azl3 and a signed arm vmlinuz-6.6.57.1-3.azl3 and a signed x86 vmlinuz-6.6.57.1-1000.azl3
• installed "kexec-tools" and "keyutils"
• confirmed only 2 keys in keyring: autogenerated and Mariner Trusted Base RSA
• confirmed can only kexec --load the signed image

x86 test - local hyperv VM

Arm64 test - Cobalt100 Azure VM

[rlmenge]

Kconfig

[rlmenge]

Kconfig

Only available on x86: https://github.com/microsoft/CBL-Mariner-Linux-Kernel/blob/rolling-lts/mariner-3/6.6.57.1/arch/x86/Kconfig#L2038
Requires that signatures ALWAYS be checked. KEXEC_SIG only checks when a signature is present

(Note not supported on arm64: https://github.com/microsoft/CBL-Mariner-Linux-Kernel/blob/rolling-lts/mariner-3/6.6.57.1/arch/arm64/Kconfig)

[rlmenge]

Clarification: for this PR we are simply enabling kexec signature validation as an option and not forcing for now

[rlmenge]

Kconfig

[rlmenge]

Kconfig

[rlmenge]

The new .pem is aligned with the changes in the upcoming Shim 15.8 release: #10995

And the required updates to our pipeline: https://dev.azure.com/mariner-org/mariner/_git/CBL-Mariner-Pipelines/pullRequest/21027#1732229328

Approving as the initial changes look good but will get more eyes as I also updated the key in this PR :)