04.03.09
Linux is Getting ‘Built-in’ Tivoization Equivalent
Could this have played a role in Linus’ decision regarding GPLv3?
GPLv3 launch
Summary: TPM in Linux raises important questions about Freedom
A COUPLE of years ago Linus Torvalds wrote “I think Tivoization is *good*,” which led to lengthy discussions.
Yesterday in the IRC channel a fascinating tidbit resurfaced as IBM’s Trusted Computing ambitions for Linux reared their ugly head again. The idea of embedding ‘trusted’ computing in Linux (it is the very opposite of trust) probably involved work from IBM, at least based on some prior reports and the Linux Weather Forecast, which has the following for Linux 2.6.30.
Support for integrity management in the kernel has been merged. This code makes use of the trusted platform module (TPM) built into many systems to ensure that the system’s files (including its executable software) have not been corrupted, maliciously or otherwise.
This can be misused to achieve the very opposite, where “corrupted” means benignly hacked. An older article about this seems innocent enough, but questions may arise, such as: could Linus have known something about TPM when rejecting GPLv3?
“What would this mean to Linux as a Free underlying platform?”“It was one of the main reasons for the rejection in the Linux kernel mailing list,” writes oiaohm. If binaries are changed (or their ‘integrity’ not authenticated), then programs won’t run.
“Problem is, there are devices where TiVo style security is needed,” claims oiaohm, “Like you don’t want people tampering with electronic voting systems.
“As I said, there is good and bad to it. Good for very particular uses. You really do want to be able to inspect the source code of a electronic voting machine to make sure it is not stuffed up. You also don’t want people tampering with it. If you look around, you can find other valid uses of the tech.”
What would this mean to Linux as a Free underlying platform? The GNU/Linux operating system could suffer from this. “Problem is, I would bet almost all the money I have that it will be abused to harm users,” concludes oiaohm. █
Video on Trusted Computing:
NotZed said,
April 3, 2009 at 7:53 am
Personality cults are a big problem in the “open sauce” world – what Linus says many people agree with, with no objective reasoning and an almost religious blindness (there are other examples of this fanboyism, although thankfully I think nobody listens to ESR any more). He has his own agenda, but without an underlying ideology it has no decipherable direction behind it; hence, this isn’t something RMS suffers from – he can be held accountable to the standards he sets himself. These other `leading’ individuals set no standards they are expected to abide by.
The refusal to go to GPL3 is the biggest threat to the future of Linux, but on the other hand it is a fairly insignificant threat to the GNU platform as a whole. I think the kernel developers who keep pushing against it don’t realise what a relatively insignificant (however important) component of an entire operating system their hardware abstraction layer is.
Of course, all of the ‘proprietary’ GNU/Linux vendors love this ‘validation’ software. They’d hate for any of their users to exercise their legal rights to freely modify the software they own even running on their own property. After all, how could they provide the service of support — what these customers have paid for — if they modified it, especially considering these vendors basically paid nothing in the first place (on average) for the software they *sold* to these customers.
David Gerard Reply:
April 3rd, 2009 at 6:07 pm
Uh. It’s so insignificant that I’m using Linux instead of FreeBSD right now precisely because I want my damn hardware to work. The kernel is an amazing thing, it really is. Don’t underestimate it because Linus has annoyed you.
Roy Schestowitz Reply:
April 3rd, 2009 at 6:13 pm
He didn’t annoy me. I even exchanged mail with him.
The post criticises IBM mostly.
Peter said,
April 3, 2009 at 8:46 am
“Problem is, there are devices where TiVo style security is needed,” claims oiaohm, “Like you don’t want people tampering with electronic voting systems.
You don’t need to Tivo-ize an e-voting machine. A voter doesn’t walk into a booth and log-in as a root user. Tivo-ization exists to allow a computer user root access yet still prevent them from changing the software installed on the machine.
Roy Schestowitz Reply:
April 3rd, 2009 at 8:50 am
Yes, but it only says “TiVo style” or “TiVo equivalent”. It’s the basic idea that there will be restriction on modification of programs.
oiaohm Reply:
April 3rd, 2009 at 9:12 am
TiVo style as Roy says to prevent modification. So person transporting machine could not alter it lets say to run a different bit of voting software that was rigged.
TiVo style can prevent you basically starting anything on the machine bar the intended software. So providing a means of anyone with the machine simply tampering. Normally the voter is not the risk. Its people with more time.
TiVo-ization a voting machine is still a good move. Since by blocking alteration of software as root you also block anyone using flawed services to do the same.
Using selinux and other mandatory access controls under linux you can take way root users power to alter the system. Root user on Linux is nothing more than a virtual construct that is optional. TiVo-ization is more than this.
TPM alteration is basically one more step. TPM protects the boot up process preventing tampering to bypass there. So enabling normal secuirty systems in Linux to be turned into fully TiVo-ization systems with no simple by pass.
Peter Reply:
April 3rd, 2009 at 9:38 am
TiVo-ization a voting machine is still a good move.
Generally, I agree with all you say. My disagreement comes with using the term “TiVo-ization” in such a context. The reason being that an e-voting machine is not consumer-owned and controlled. I think saying something like, “Using a TPM on voting machines is still a good move.” is more accurate. The point of the term “TiVo-ization” is to point out when trusted computing has become treacherous – since the TiVo is a consumer product.
oiaohm Reply:
April 4th, 2009 at 8:37 am
I termed it that way mostly for the simple point the same tech is used to do both.
You build a TiVo-ization device or a TPM protected voting machine you are using exactly the same tech no difference.
This is the problem with techs they are double sided. Its making sure they are used for good not evil.