F43 Change Proposal: Debuginfod IMA Verification By Default (self-contained)

Project Discussion Change Proposals
,
1

Debuginfod IMA Verification By Default

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Wiki
Announced

:link: Summary

Enable client-side cryptographic verification of Debuginfod auto-downloaded debugging information and source code by default.

:link: Owner

:link: Detailed Description

Fedora’s Debuginfod clients and servers can take advantage of signed RPMs to provide and verify cryptographic integrity of debuginfo & source code files made available to clients.

Upstream elfutils code has contained all the logic since version 0.192. The Fedora debuginfod servers have made this IMA signature information available for apprx. all RPMS in Fedora 39+. It only needs client side configuration to activate verification.

Activating this requires changing the $DEBUGINFOD_URLS environment variable’s value. This variable is constructed from files in /etc/debuginfod/*.url files. The concrete proposal is to replace the /etc/debuginfod/elfutils.urls file, provided by the elfutils-debuginfod-client subrpm, to the following value:

ima:enforcing https://debuginfod.fedoraproject.org ima:ignore

This will force crypto verification of files downloaded from that server, and let the client reject any unverifiable files. The trailing “ima:ignore” part is for the situation where an end-user might naively append additional debuginfod server URLs to the environment variable, but we don’t want to assert enforcing mode for them.

:link: Feedback

This feature fills a gap identified back when Changes/DebuginfodByDefault arrived during F35.

:link: Benefit to Fedora

The warm fuzzy feeling of more end-user-verifiable security over files they download from Fedora.

:link: Scope

  • Proposal owners: Adjustment to elfutils.spec
  • Other developers: None
  • Release engineering: None, except continuing to publish IMA key certificates in a timely & complete manner in fedora-gpg-keys into /etc/keys/ima/.
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with the Fedora Strategy: ?

:link: Upgrade/compatibility impact

None. With fedora-gpg-keys containing public key signatures for all recent Fedoras, debugging older or newer binaries should also work fine.

:link: How To Test

Set the $DEBUGINFOD_URLS environment variable by hand, or edit the /etc/debuginfod/*.url file(s), to add ima:enforcing in the proper place.

For more diagnostics, set $DEBUGINFOD_VERBOSE to 1.

Use debuginfod-find -v debuginfo $BINARY. Observe successful download.

:link: User Experience

Normally, no observable change at all, assuming that all RPMs distributed from koji continue to be built with IMA per-file signatures.

Should there be unsigned RPMs, or ones whose signatures become invalid due to storage or transmission errors, this will result in user tools treating the debuginfo as unavailable. There may be diagnostics printed. At that point, a user can in principle disable checking manually, download debuginfo by hand (e.g. via debuginfo-install), or grin and bear it.

:link: Dependencies

The fedora-gpg-keys rpm contains the public key certificates against which the client verifies download signatures. The location of these certificates is a compiled-in default into the debuginfod client code (/etc/keys/ima), but may be changed with an environment variable.

Releng/koji need to keep building RPMs for present / future versions of Fedora with IMA signatures attached. Transitions between major-version signing keys should be okay, as long as the fedora-gpg-keys RPM (containing the certificates) gets updated in a timely manner.

:link: Contingency Plan

  • Contingency mechanism: Unroll the elfutils.spec change or hand-edit env. vars.
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change)

:link: Documentation

N/A (not a System Wide Change)

:link: Release Notes

“The debuginfod client tools used to auto-download debuginfo & source code into tools like gdb now cryptographically verify the integrity of the downloaded files from the Fedora debuginfod server.”

Last edited by @amoloney 2025-03-19T18:13:24Z

Last edited by @amoloney 2025-03-19T18:13:24Z

2

How do you feel about the proposal as written?

  • Strongly in favor
  • In favor, with reservations
  • Neutral
  • Opposed, but could be convinced
  • Strongly opposed
0 voters

If you are in favor but have reservations, or are opposed but something could change your mind, please explain in a reply.

We want everyone to be heard, but many posts repeating the same thing actually makes that harder. If you have something new to say, please say it. If, instead, you find someone has already covered what you’d like to express, please simply give that post a :heart: instead of reiterating. You can even do this by email, by replying with the heart emoji or just “+1”. This will make long topics easier to follow.

Please note that this is an advisory “straw poll” meant to gauge sentiment. It isn’t a vote or a scientific survey. See About the Change Proposals category for more about the Change Process and moderation policy.

3

This looks pretty good to me. Is it worth adding a comment (assuming they are allowed) to explain what the ima parts of that mean? Since you specifically mentioned the ima:ignore at the end possibly confusing people. A comment might help.

4

A comment where? Can elaborate in the Changes wiki page. The .url file doesn’t take comments unfortunately. The man debuginfod-client-config (and others) describe the options in more detail.

5

Ah, I was hoping the .url file could have comments in it. ;(
Too bad.

6

'suppose the package could put a /etc/debuginfod/README file in there. but /etc/profile.d/debuginfod.sh, which is the script that loads the .urls file, does xref to the man pages.

7

This change proposal has now been submitted to FESCo with ticket #3382 for voting.

To find out more, please visit our Changes Policy documentation.

8

Wouldn’t this break any third party debuginfod endpoints? I don’t know if we do this for COPR yet, but it would suck if that broke.

9

Neal, not sure break how. IMA enforcement is done by the client, for servers of its choice.

10

Nevermind, I misunderstood how the configuration works. The IMA verification only applies to files downloaded from the Fedora debuginfod server.

1 Like
11

Yeah, that’s why the “ima:ignore” part is at the end of the proposed new default $DEBUGINFOD_URLS. Anything added after that is not ima-enforced (unless changed by another manual ima: directive).