SXE - Package Keying and Manifest

Key Propagation

In order for keys to work as an authentication mechanism, they must be a shared secret between the process, which is executing a given program, and the server, which is doing the authentication.

Here shared secret means that no other process can have the key; but both the client and server of the service must have it.

Achieving this state is not a trivial problem, but when it is achieved it makes authentication secure, simple and fast. No further lookup is required, since possession of the key guarantees authentication.

SXE achieves key propagation by relying on the LIDS kernel patch as modified for Qt Extended.

The client can read its key from /proc/1234/lids_key where 1234 is the Unix pid of that process. Keys are created in these pseudo files when the process is launched, and the kernel enforces that only the process itself (in this case process pid 1234) can read its own key.

This technique means that no LIDS rules are required to protect each key, since it is automatically exclusive to the process. Also problems relating to read only file systems are solved.

The server can read the keys for all processes from /proc/lids/keys. This pseudo file is updated by the kernel will the keys, and the device id and inode number of the binary. The pseudo file is protected by a LIDS MAC rule to prevent untrusted processes from reading it.