From: Mimi Zohar <zohar@linux.ibm.com> To: Nayna Jain <nayna@linux.ibm.com>, linuxppc-dev@ozlabs.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Michael Ellerman <mpe@ellerman.id.au>, Benjamin Herrenschmidt <benh@kernel.crashing.org>, Paul Mackerras <paulus@samba.org>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, Jeremy Kerr <jk@ozlabs.org>, Matthew Garret <matthew.garret@nebula.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Claudio Carvalho <cclaudio@linux.ibm.com>, George Wilson <gcwilson@linux.ibm.com>, Elaine Palmer <erpalmer@us.ibm.com>, Eric Ricther <erichte@linux.ibm.com>, "Oliver O'Halloran" <oohall@gmail.com> Subject: Re: [PATCH v3 4/4] powerpc: load firmware trusted keys/hashes into kernel keyring Date: Tue, 03 Sep 2019 18:54:51 -0400 [thread overview] Message-ID: <1567551291.4937.8.camel@linux.ibm.com> (raw) In-Reply-To: <1566825818-9731-5-git-send-email-nayna@linux.ibm.com> On Mon, 2019-08-26 at 09:23 -0400, Nayna Jain wrote: > The keys used to verify the Host OS kernel are managed by firmware as > secure variables. This patch loads the verification keys into the .platform > keyring and revocation hashes into .blacklist keyring. This enables > verification and loading of the kernels signed by the boot time keys which > are trusted by firmware. > > Signed-off-by: Nayna Jain <nayna@linux.ibm.com> Feel free to add my tag after addressing the formatting issues. Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> > diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/integrity/platform_certs/load_powerpc.c > new file mode 100644 > index 000000000000..359d5063d4da > --- /dev/null > +++ b/security/integrity/platform_certs/load_powerpc.c > @@ -0,0 +1,88 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * Copyright (C) 2019 IBM Corporation > + * Author: Nayna Jain <nayna@linux.ibm.com> > + * > + * - loads keys and hashes stored and controlled by the firmware. > + */ > +#include <linux/kernel.h> > +#include <linux/sched.h> > +#include <linux/cred.h> > +#include <linux/err.h> > +#include <linux/slab.h> > +#include <asm/secboot.h> > +#include <asm/secvar.h> > +#include "keyring_handler.h" > + > +/* > + * Get a certificate list blob from the named secure variable. > + */ > +static __init void *get_cert_list(u8 *key, unsigned long keylen, uint64_t *size) > +{ > + int rc; > + void *db; > + > + rc = secvar_ops->get(key, keylen, NULL, size); > + if (rc) { > + pr_err("Couldn't get size: %d\n", rc); > + return NULL; > + } > + > + db = kmalloc(*size, GFP_KERNEL); > + if (!db) > + return NULL; > + > + rc = secvar_ops->get(key, keylen, db, size); > + if (rc) { > + kfree(db); > + pr_err("Error reading db var: %d\n", rc); > + return NULL; > + } > + > + return db; > +} > + > +/* > + * Load the certs contained in the keys databases into the platform trusted > + * keyring and the blacklisted X.509 cert SHA256 hashes into the blacklist > + * keyring. > + */ > +static int __init load_powerpc_certs(void) > +{ > + void *db = NULL, *dbx = NULL; > + uint64_t dbsize = 0, dbxsize = 0; > + int rc = 0; > + > + if (!secvar_ops) > + return -ENODEV; > + > + /* Get db, and dbx. They might not exist, so it isn't > + * an error if we can't get them. > + */ > + db = get_cert_list("db", 3, &dbsize); > + if (!db) { > + pr_err("Couldn't get db list from firmware\n"); > + } else { > + rc = parse_efi_signature_list("powerpc:db", > + db, dbsize, get_handler_for_db); > + if (rc) > + pr_err("Couldn't parse db signatures: %d\n", > + rc); There's no need to split this line. > + kfree(db); > + } > + > + dbx = get_cert_list("dbx", 3, &dbxsize); > + if (!dbx) { > + pr_info("Couldn't get dbx list from firmware\n"); > + } else { > + rc = parse_efi_signature_list("powerpc:dbx", > + dbx, dbxsize, > + get_handler_for_dbx); Formatting of this line is off. > + if (rc) > + pr_err("Couldn't parse dbx signatures: %d\n", rc); > + kfree(dbx); > + } > + > + return rc; > +} > +late_initcall(load_powerpc_certs);
WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com> To: Nayna Jain <nayna@linux.ibm.com>, linuxppc-dev@ozlabs.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>, Eric Ricther <erichte@linux.ibm.com>, linux-kernel@vger.kernel.org, Claudio Carvalho <cclaudio@linux.ibm.com>, Matthew Garret <matthew.garret@nebula.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Paul Mackerras <paulus@samba.org>, Jeremy Kerr <jk@ozlabs.org>, Elaine Palmer <erpalmer@us.ibm.com>, Oliver O'Halloran <oohall@gmail.com>, George Wilson <gcwilson@linux.ibm.com> Subject: Re: [PATCH v3 4/4] powerpc: load firmware trusted keys/hashes into kernel keyring Date: Tue, 03 Sep 2019 18:54:51 -0400 [thread overview] Message-ID: <1567551291.4937.8.camel@linux.ibm.com> (raw) In-Reply-To: <1566825818-9731-5-git-send-email-nayna@linux.ibm.com> On Mon, 2019-08-26 at 09:23 -0400, Nayna Jain wrote: > The keys used to verify the Host OS kernel are managed by firmware as > secure variables. This patch loads the verification keys into the .platform > keyring and revocation hashes into .blacklist keyring. This enables > verification and loading of the kernels signed by the boot time keys which > are trusted by firmware. > > Signed-off-by: Nayna Jain <nayna@linux.ibm.com> Feel free to add my tag after addressing the formatting issues. Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> > diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/integrity/platform_certs/load_powerpc.c > new file mode 100644 > index 000000000000..359d5063d4da > --- /dev/null > +++ b/security/integrity/platform_certs/load_powerpc.c > @@ -0,0 +1,88 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * Copyright (C) 2019 IBM Corporation > + * Author: Nayna Jain <nayna@linux.ibm.com> > + * > + * - loads keys and hashes stored and controlled by the firmware. > + */ > +#include <linux/kernel.h> > +#include <linux/sched.h> > +#include <linux/cred.h> > +#include <linux/err.h> > +#include <linux/slab.h> > +#include <asm/secboot.h> > +#include <asm/secvar.h> > +#include "keyring_handler.h" > + > +/* > + * Get a certificate list blob from the named secure variable. > + */ > +static __init void *get_cert_list(u8 *key, unsigned long keylen, uint64_t *size) > +{ > + int rc; > + void *db; > + > + rc = secvar_ops->get(key, keylen, NULL, size); > + if (rc) { > + pr_err("Couldn't get size: %d\n", rc); > + return NULL; > + } > + > + db = kmalloc(*size, GFP_KERNEL); > + if (!db) > + return NULL; > + > + rc = secvar_ops->get(key, keylen, db, size); > + if (rc) { > + kfree(db); > + pr_err("Error reading db var: %d\n", rc); > + return NULL; > + } > + > + return db; > +} > + > +/* > + * Load the certs contained in the keys databases into the platform trusted > + * keyring and the blacklisted X.509 cert SHA256 hashes into the blacklist > + * keyring. > + */ > +static int __init load_powerpc_certs(void) > +{ > + void *db = NULL, *dbx = NULL; > + uint64_t dbsize = 0, dbxsize = 0; > + int rc = 0; > + > + if (!secvar_ops) > + return -ENODEV; > + > + /* Get db, and dbx. They might not exist, so it isn't > + * an error if we can't get them. > + */ > + db = get_cert_list("db", 3, &dbsize); > + if (!db) { > + pr_err("Couldn't get db list from firmware\n"); > + } else { > + rc = parse_efi_signature_list("powerpc:db", > + db, dbsize, get_handler_for_db); > + if (rc) > + pr_err("Couldn't parse db signatures: %d\n", > + rc); There's no need to split this line. > + kfree(db); > + } > + > + dbx = get_cert_list("dbx", 3, &dbxsize); > + if (!dbx) { > + pr_info("Couldn't get dbx list from firmware\n"); > + } else { > + rc = parse_efi_signature_list("powerpc:dbx", > + dbx, dbxsize, > + get_handler_for_dbx); Formatting of this line is off. > + if (rc) > + pr_err("Couldn't parse dbx signatures: %d\n", rc); > + kfree(dbx); > + } > + > + return rc; > +} > +late_initcall(load_powerpc_certs);
next prev parent reply other threads:[~2019-09-03 22:55 UTC|newest] Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-08-26 13:23 [PATCH v3 0/4] powerpc: expose secure variables to the kernel and userspace Nayna Jain 2019-08-26 13:23 ` Nayna Jain 2019-08-26 13:23 ` [PATCH v3 1/4] powerpc/powernv: Add OPAL API interface to access secure variable Nayna Jain 2019-08-26 13:23 ` Nayna Jain 2019-08-26 13:23 ` [PATCH v3 2/4] powerpc: expose secure variables to userspace via sysfs Nayna Jain 2019-08-26 13:23 ` Nayna Jain 2019-08-26 14:01 ` Greg Kroah-Hartman 2019-08-26 14:01 ` Greg Kroah-Hartman 2019-08-26 14:12 ` Nayna 2019-08-26 14:12 ` Nayna 2019-08-26 15:01 ` [PATCH] sysfs: add BIN_ATTR_WO() macro Greg Kroah-Hartman 2019-08-26 15:01 ` Greg Kroah-Hartman 2019-09-03 3:37 ` Michael Ellerman 2019-09-03 3:37 ` Michael Ellerman 2019-09-04 11:36 ` Greg Kroah-Hartman 2019-09-04 11:36 ` Greg Kroah-Hartman 2019-10-01 18:08 ` Nayna 2019-10-01 18:16 ` Greg Kroah-Hartman 2019-10-01 18:55 ` Nayna 2019-08-26 14:56 ` [PATCH v3 2/4] powerpc: expose secure variables to userspace via sysfs Greg Kroah-Hartman 2019-08-26 14:56 ` Greg Kroah-Hartman 2019-08-26 15:46 ` Nayna 2019-08-26 15:46 ` Nayna 2019-08-26 15:57 ` Greg Kroah-Hartman 2019-08-26 15:57 ` Greg Kroah-Hartman 2019-08-26 13:23 ` [PATCH v3 3/4] x86/efi: move common keyring handler functions to new file Nayna Jain 2019-08-26 13:23 ` Nayna Jain 2019-09-02 11:55 ` Michael Ellerman 2019-09-02 11:55 ` Michael Ellerman 2019-09-03 22:51 ` Mimi Zohar 2019-09-03 22:51 ` Mimi Zohar 2019-09-05 3:59 ` Michael Ellerman 2019-09-05 3:59 ` Michael Ellerman 2019-08-26 13:23 ` [PATCH v3 4/4] powerpc: load firmware trusted keys/hashes into kernel keyring Nayna Jain 2019-08-26 13:23 ` Nayna Jain 2019-09-03 22:54 ` Mimi Zohar [this message] 2019-09-03 22:54 ` Mimi Zohar
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1567551291.4937.8.camel@linux.ibm.com \ --to=zohar@linux.ibm.com \ --cc=ard.biesheuvel@linaro.org \ --cc=benh@kernel.crashing.org \ --cc=cclaudio@linux.ibm.com \ --cc=erichte@linux.ibm.com \ --cc=erpalmer@us.ibm.com \ --cc=gcwilson@linux.ibm.com \ --cc=gregkh@linuxfoundation.org \ --cc=jk@ozlabs.org \ --cc=linux-efi@vger.kernel.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linuxppc-dev@ozlabs.org \ --cc=matthew.garret@nebula.com \ --cc=mpe@ellerman.id.au \ --cc=nayna@linux.ibm.com \ --cc=oohall@gmail.com \ --cc=paulus@samba.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.