Security News > 2021 > June > Report picks holes in the Linux kernel release signing process

A report looking into the security of the Linux kernel's release signing process has highlighted a range of areas for improvement, from failing to mandate the use of hardware security keys for authentication to use of static keys for SSH access.

The most severe issue noted, though only rated as a medium on a scale from informational at the bottom to high at the top, was that developers who are able to commit code directly to the Linux kernel repositories were not mandated to use hardware security keys - making any breach of their personal systems, as in the 2011 attack, considerably more serious.

"Alice is a Linux kernel maintainer who stores private key material on a user-accessible block device," the report explained as an example of how the issue could be exploited.

Developers who are able to commit code directly to the Linux kernel repositories were not mandated to use hardware security keys - making any breach of their personal systems, as in the 2011 attack, considerably more serious.

"Even those who have adopted hardware security devices may not be fully protected, however."The Linux Foundation recommends that kernel developers use smart cards, specifically Nitrokeys, to secure their private key material," the report found.

Recommendations made in the report include: updating and improving the documentation; mandating the use of smart cards which require physical interaction in order to validate each operation; the development and release of tooling for comparing kernel releases with the content of a tagged GitHub release as a means of checking for unauthorised changes; and adding a means of enforcing expected-identity signatures on commits to key repositories.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/06/24/report_picks_holes_in_the/