* [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
@ 2019-01-21 9:59 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: jwboyer, Kairui Song, ebiggers, dyoung, nayna, kexec, jmorris,
zohar, dhowells, keyrings, linux-integrity, dwmw2, bauerman,
serge
This patch series adds a .platform_trusted_keys in system_keyring as the
reference to .platform keyring in integrity subsystem, when platform
keyring is being initialized it will be updated, so it will be
accessable for verifying PE signed kernel image.
This patch series let kexec_file_load use platform keyring as fall
back if it failed to verify the image against secondary keyring,
so the actually PE signature verify process will use keys provides
by firmware.
After this patch kexec_file_load will be able to verify a signed PE
bzImage using keys in platform keyring.
Tested in a VM with locally signed kernel with pesign and imported the
cert to EFI's MokList variable.
To test this patch series on latest kernel, you need to ensure this commit
is applied as there is an regression bug in sanity_check_segment_list():
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=993a110319a4a60aadbd02f6defdebe048f7773b
Update from V4:
- Drop ifdef in security/integrity/digsig.c to make code clearer
- Fix a potential issue, set_platform_trusted_keys should not be
called when keyring initialization failed
Update from V3:
- Tweak and simplify commit message as suggested by Mimi Zohar
Update from V2:
- Use IS_ENABLED in kexec_file_load to judge if platform_trusted_keys
should be used for verifying image as suggested by Mimi Zohar
Update from V1:
- Make platform_trusted_keys static, and update commit message as suggested
by Mimi Zohar
- Always check if platform keyring is initialized before use it
Kairui Song (2):
integrity, KEYS: add a reference to platform keyring
kexec, KEYS: Make use of platform keyring for signature verify
arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
certs/system_keyring.c | 22 +++++++++++++++++++++-
include/keys/system_keyring.h | 9 +++++++++
include/linux/verification.h | 1 +
security/integrity/digsig.c | 3 +++
5 files changed, 44 insertions(+), 4 deletions(-)
--
2.20.1
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
@ 2019-01-21 9:59 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, zohar,
bauerman, ebiggers, nayna, dyoung, linux-integrity, kexec,
Kairui Song
This patch series adds a .platform_trusted_keys in system_keyring as the
reference to .platform keyring in integrity subsystem, when platform
keyring is being initialized it will be updated, so it will be
accessable for verifying PE signed kernel image.
This patch series let kexec_file_load use platform keyring as fall
back if it failed to verify the image against secondary keyring,
so the actually PE signature verify process will use keys provides
by firmware.
After this patch kexec_file_load will be able to verify a signed PE
bzImage using keys in platform keyring.
Tested in a VM with locally signed kernel with pesign and imported the
cert to EFI's MokList variable.
To test this patch series on latest kernel, you need to ensure this commit
is applied as there is an regression bug in sanity_check_segment_list():
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=993a110319a4a60aadbd02f6defdebe048f7773b
Update from V4:
- Drop ifdef in security/integrity/digsig.c to make code clearer
- Fix a potential issue, set_platform_trusted_keys should not be
called when keyring initialization failed
Update from V3:
- Tweak and simplify commit message as suggested by Mimi Zohar
Update from V2:
- Use IS_ENABLED in kexec_file_load to judge if platform_trusted_keys
should be used for verifying image as suggested by Mimi Zohar
Update from V1:
- Make platform_trusted_keys static, and update commit message as suggested
by Mimi Zohar
- Always check if platform keyring is initialized before use it
Kairui Song (2):
integrity, KEYS: add a reference to platform keyring
kexec, KEYS: Make use of platform keyring for signature verify
arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
certs/system_keyring.c | 22 +++++++++++++++++++++-
include/keys/system_keyring.h | 9 +++++++++
include/linux/verification.h | 1 +
security/integrity/digsig.c | 3 +++
5 files changed, 44 insertions(+), 4 deletions(-)
--
2.20.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH v5 1/2] integrity, KEYS: add a reference to platform keyring
2019-01-21 9:59 ` Kairui Song
(?)
@ 2019-01-21 9:59 ` Kairui Song
-1 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, zohar,
bauerman, ebiggers, nayna, dyoung, linux-integrity, kexec,
Kairui Song
commit 9dc92c45177a ('integrity: Define a trusted platform keyring')
introduced a .platform keyring for storing preboot keys, used for
verifying kernel images' signature. Currently only IMA-appraisal is able
to use the keyring to verify kernel images that have their signature
stored in xattr.
This patch exposes the .platform keyring, making it
accessible for verifying PE signed kernel images as well.
Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Kairui Song <kasong@redhat.com>
---
certs/system_keyring.c | 9 +++++++++
include/keys/system_keyring.h | 9 +++++++++
security/integrity/digsig.c | 3 +++
3 files changed, 21 insertions(+)
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 81728717523d..4690ef9cda8a 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys;
#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
static struct key *secondary_trusted_keys;
#endif
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+static struct key *platform_trusted_keys;
+#endif
extern __initconst const u8 system_certificate_list[];
extern __initconst const unsigned long system_certificate_list_size;
@@ -265,4 +268,10 @@ int verify_pkcs7_signature(const void *data, size_t len,
}
EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+void __init set_platform_trusted_keys(struct key *keyring) {
+ platform_trusted_keys = keyring;
+}
+#endif
+
#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 359c2f936004..df766ef8f03c 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -61,5 +61,14 @@ static inline struct key *get_ima_blacklist_keyring(void)
}
#endif /* CONFIG_IMA_BLACKLIST_KEYRING */
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+
+extern void __init set_platform_trusted_keys(struct key* keyring);
+
+#else
+
+static inline void set_platform_trusted_keys(struct key* keyring) { };
+
+#endif /* CONFIG_INTEGRITY_PLATFORM_KEYRING */
#endif /* _KEYS_SYSTEM_KEYRING_H */
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index f45d6edecf99..e19c2eb72c51 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -87,6 +87,9 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
pr_info("Can't allocate %s keyring (%d)\n",
keyring_name[id], err);
keyring[id] = NULL;
+ } else {
+ if (id = INTEGRITY_KEYRING_PLATFORM)
+ set_platform_trusted_keys(keyring[id]);
}
return err;
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v5 1/2] integrity, KEYS: add a reference to platform keyring
@ 2019-01-21 9:59 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: jwboyer, Kairui Song, ebiggers, dyoung, nayna, kexec, jmorris,
zohar, dhowells, keyrings, linux-integrity, dwmw2, bauerman,
serge
commit 9dc92c45177a ('integrity: Define a trusted platform keyring')
introduced a .platform keyring for storing preboot keys, used for
verifying kernel images' signature. Currently only IMA-appraisal is able
to use the keyring to verify kernel images that have their signature
stored in xattr.
This patch exposes the .platform keyring, making it
accessible for verifying PE signed kernel images as well.
Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Kairui Song <kasong@redhat.com>
---
certs/system_keyring.c | 9 +++++++++
include/keys/system_keyring.h | 9 +++++++++
security/integrity/digsig.c | 3 +++
3 files changed, 21 insertions(+)
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 81728717523d..4690ef9cda8a 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys;
#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
static struct key *secondary_trusted_keys;
#endif
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+static struct key *platform_trusted_keys;
+#endif
extern __initconst const u8 system_certificate_list[];
extern __initconst const unsigned long system_certificate_list_size;
@@ -265,4 +268,10 @@ int verify_pkcs7_signature(const void *data, size_t len,
}
EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+void __init set_platform_trusted_keys(struct key *keyring) {
+ platform_trusted_keys = keyring;
+}
+#endif
+
#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 359c2f936004..df766ef8f03c 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -61,5 +61,14 @@ static inline struct key *get_ima_blacklist_keyring(void)
}
#endif /* CONFIG_IMA_BLACKLIST_KEYRING */
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+
+extern void __init set_platform_trusted_keys(struct key* keyring);
+
+#else
+
+static inline void set_platform_trusted_keys(struct key* keyring) { };
+
+#endif /* CONFIG_INTEGRITY_PLATFORM_KEYRING */
#endif /* _KEYS_SYSTEM_KEYRING_H */
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index f45d6edecf99..e19c2eb72c51 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -87,6 +87,9 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
pr_info("Can't allocate %s keyring (%d)\n",
keyring_name[id], err);
keyring[id] = NULL;
+ } else {
+ if (id == INTEGRITY_KEYRING_PLATFORM)
+ set_platform_trusted_keys(keyring[id]);
}
return err;
--
2.20.1
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v5 1/2] integrity, KEYS: add a reference to platform keyring
@ 2019-01-21 9:59 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, zohar,
bauerman, ebiggers, nayna, dyoung, linux-integrity, kexec,
Kairui Song
commit 9dc92c45177a ('integrity: Define a trusted platform keyring')
introduced a .platform keyring for storing preboot keys, used for
verifying kernel images' signature. Currently only IMA-appraisal is able
to use the keyring to verify kernel images that have their signature
stored in xattr.
This patch exposes the .platform keyring, making it
accessible for verifying PE signed kernel images as well.
Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Kairui Song <kasong@redhat.com>
---
certs/system_keyring.c | 9 +++++++++
include/keys/system_keyring.h | 9 +++++++++
security/integrity/digsig.c | 3 +++
3 files changed, 21 insertions(+)
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 81728717523d..4690ef9cda8a 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys;
#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
static struct key *secondary_trusted_keys;
#endif
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+static struct key *platform_trusted_keys;
+#endif
extern __initconst const u8 system_certificate_list[];
extern __initconst const unsigned long system_certificate_list_size;
@@ -265,4 +268,10 @@ int verify_pkcs7_signature(const void *data, size_t len,
}
EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+void __init set_platform_trusted_keys(struct key *keyring) {
+ platform_trusted_keys = keyring;
+}
+#endif
+
#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 359c2f936004..df766ef8f03c 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -61,5 +61,14 @@ static inline struct key *get_ima_blacklist_keyring(void)
}
#endif /* CONFIG_IMA_BLACKLIST_KEYRING */
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+
+extern void __init set_platform_trusted_keys(struct key* keyring);
+
+#else
+
+static inline void set_platform_trusted_keys(struct key* keyring) { };
+
+#endif /* CONFIG_INTEGRITY_PLATFORM_KEYRING */
#endif /* _KEYS_SYSTEM_KEYRING_H */
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index f45d6edecf99..e19c2eb72c51 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -87,6 +87,9 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
pr_info("Can't allocate %s keyring (%d)\n",
keyring_name[id], err);
keyring[id] = NULL;
+ } else {
+ if (id == INTEGRITY_KEYRING_PLATFORM)
+ set_platform_trusted_keys(keyring[id]);
}
return err;
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH v5 1/2] integrity, KEYS: add a reference to platform keyring
2019-01-21 9:59 ` Kairui Song
(?)
@ 2019-01-22 15:37 ` Mimi Zohar
-1 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-22 15:37 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, bauerman,
ebiggers, nayna, dyoung, linux-integrity, kexec
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> commit 9dc92c45177a ('integrity: Define a trusted platform keyring')
> introduced a .platform keyring for storing preboot keys, used for
> verifying kernel images' signature. Currently only IMA-appraisal is able
> to use the keyring to verify kernel images that have their signature
> stored in xattr.
>
> This patch exposes the .platform keyring, making it
> accessible for verifying PE signed kernel images as well.
>
> Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Kairui Song <kasong@redhat.com>
Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> certs/system_keyring.c | 9 +++++++++
> include/keys/system_keyring.h | 9 +++++++++
> security/integrity/digsig.c | 3 +++
> 3 files changed, 21 insertions(+)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 81728717523d..4690ef9cda8a 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys;
> #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
> static struct key *secondary_trusted_keys;
> #endif
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +static struct key *platform_trusted_keys;
> +#endif
>
> extern __initconst const u8 system_certificate_list[];
> extern __initconst const unsigned long system_certificate_list_size;
> @@ -265,4 +268,10 @@ int verify_pkcs7_signature(const void *data, size_t len,
> }
> EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
>
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +void __init set_platform_trusted_keys(struct key *keyring) {
> + platform_trusted_keys = keyring;
> +}
> +#endif
> +
> #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
> diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
> index 359c2f936004..df766ef8f03c 100644
> --- a/include/keys/system_keyring.h
> +++ b/include/keys/system_keyring.h
> @@ -61,5 +61,14 @@ static inline struct key *get_ima_blacklist_keyring(void)
> }
> #endif /* CONFIG_IMA_BLACKLIST_KEYRING */
>
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +
> +extern void __init set_platform_trusted_keys(struct key* keyring);
> +
> +#else
> +
> +static inline void set_platform_trusted_keys(struct key* keyring) { };
> +
> +#endif /* CONFIG_INTEGRITY_PLATFORM_KEYRING */
>
> #endif /* _KEYS_SYSTEM_KEYRING_H */
> diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
> index f45d6edecf99..e19c2eb72c51 100644
> --- a/security/integrity/digsig.c
> +++ b/security/integrity/digsig.c
> @@ -87,6 +87,9 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
> pr_info("Can't allocate %s keyring (%d)\n",
> keyring_name[id], err);
> keyring[id] = NULL;
> + } else {
> + if (id = INTEGRITY_KEYRING_PLATFORM)
> + set_platform_trusted_keys(keyring[id]);
> }
>
> return err;
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH v5 1/2] integrity, KEYS: add a reference to platform keyring
@ 2019-01-22 15:37 ` Mimi Zohar
0 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-22 15:37 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: jwboyer, ebiggers, dyoung, nayna, kexec, jmorris, dhowells,
keyrings, linux-integrity, dwmw2, bauerman, serge
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> commit 9dc92c45177a ('integrity: Define a trusted platform keyring')
> introduced a .platform keyring for storing preboot keys, used for
> verifying kernel images' signature. Currently only IMA-appraisal is able
> to use the keyring to verify kernel images that have their signature
> stored in xattr.
>
> This patch exposes the .platform keyring, making it
> accessible for verifying PE signed kernel images as well.
>
> Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Kairui Song <kasong@redhat.com>
Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> certs/system_keyring.c | 9 +++++++++
> include/keys/system_keyring.h | 9 +++++++++
> security/integrity/digsig.c | 3 +++
> 3 files changed, 21 insertions(+)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 81728717523d..4690ef9cda8a 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys;
> #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
> static struct key *secondary_trusted_keys;
> #endif
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +static struct key *platform_trusted_keys;
> +#endif
>
> extern __initconst const u8 system_certificate_list[];
> extern __initconst const unsigned long system_certificate_list_size;
> @@ -265,4 +268,10 @@ int verify_pkcs7_signature(const void *data, size_t len,
> }
> EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
>
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +void __init set_platform_trusted_keys(struct key *keyring) {
> + platform_trusted_keys = keyring;
> +}
> +#endif
> +
> #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
> diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
> index 359c2f936004..df766ef8f03c 100644
> --- a/include/keys/system_keyring.h
> +++ b/include/keys/system_keyring.h
> @@ -61,5 +61,14 @@ static inline struct key *get_ima_blacklist_keyring(void)
> }
> #endif /* CONFIG_IMA_BLACKLIST_KEYRING */
>
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +
> +extern void __init set_platform_trusted_keys(struct key* keyring);
> +
> +#else
> +
> +static inline void set_platform_trusted_keys(struct key* keyring) { };
> +
> +#endif /* CONFIG_INTEGRITY_PLATFORM_KEYRING */
>
> #endif /* _KEYS_SYSTEM_KEYRING_H */
> diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
> index f45d6edecf99..e19c2eb72c51 100644
> --- a/security/integrity/digsig.c
> +++ b/security/integrity/digsig.c
> @@ -87,6 +87,9 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
> pr_info("Can't allocate %s keyring (%d)\n",
> keyring_name[id], err);
> keyring[id] = NULL;
> + } else {
> + if (id == INTEGRITY_KEYRING_PLATFORM)
> + set_platform_trusted_keys(keyring[id]);
> }
>
> return err;
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH v5 1/2] integrity, KEYS: add a reference to platform keyring
@ 2019-01-22 15:37 ` Mimi Zohar
0 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-22 15:37 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, bauerman,
ebiggers, nayna, dyoung, linux-integrity, kexec
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> commit 9dc92c45177a ('integrity: Define a trusted platform keyring')
> introduced a .platform keyring for storing preboot keys, used for
> verifying kernel images' signature. Currently only IMA-appraisal is able
> to use the keyring to verify kernel images that have their signature
> stored in xattr.
>
> This patch exposes the .platform keyring, making it
> accessible for verifying PE signed kernel images as well.
>
> Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Kairui Song <kasong@redhat.com>
Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> certs/system_keyring.c | 9 +++++++++
> include/keys/system_keyring.h | 9 +++++++++
> security/integrity/digsig.c | 3 +++
> 3 files changed, 21 insertions(+)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 81728717523d..4690ef9cda8a 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys;
> #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
> static struct key *secondary_trusted_keys;
> #endif
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +static struct key *platform_trusted_keys;
> +#endif
>
> extern __initconst const u8 system_certificate_list[];
> extern __initconst const unsigned long system_certificate_list_size;
> @@ -265,4 +268,10 @@ int verify_pkcs7_signature(const void *data, size_t len,
> }
> EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
>
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +void __init set_platform_trusted_keys(struct key *keyring) {
> + platform_trusted_keys = keyring;
> +}
> +#endif
> +
> #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
> diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
> index 359c2f936004..df766ef8f03c 100644
> --- a/include/keys/system_keyring.h
> +++ b/include/keys/system_keyring.h
> @@ -61,5 +61,14 @@ static inline struct key *get_ima_blacklist_keyring(void)
> }
> #endif /* CONFIG_IMA_BLACKLIST_KEYRING */
>
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> +
> +extern void __init set_platform_trusted_keys(struct key* keyring);
> +
> +#else
> +
> +static inline void set_platform_trusted_keys(struct key* keyring) { };
> +
> +#endif /* CONFIG_INTEGRITY_PLATFORM_KEYRING */
>
> #endif /* _KEYS_SYSTEM_KEYRING_H */
> diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
> index f45d6edecf99..e19c2eb72c51 100644
> --- a/security/integrity/digsig.c
> +++ b/security/integrity/digsig.c
> @@ -87,6 +87,9 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
> pr_info("Can't allocate %s keyring (%d)\n",
> keyring_name[id], err);
> keyring[id] = NULL;
> + } else {
> + if (id == INTEGRITY_KEYRING_PLATFORM)
> + set_platform_trusted_keys(keyring[id]);
> }
>
> return err;
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
2019-01-21 9:59 ` Kairui Song
(?)
@ 2019-01-21 9:59 ` Kairui Song
-1 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, zohar,
bauerman, ebiggers, nayna, dyoung, linux-integrity, kexec,
Kairui Song
This patch let kexec_file_load makes use of .platform keyring as fall
back if it failed to verify a PE signed image against secondary or
builtin key ring, make it possible to verify kernel image signed with
preboot keys as well.
This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
should verify the signature using platform keyring. Also, decrease
the error message log level when verification failed with -ENOKEY,
so that if called tried multiple time with different keyring it
won't generate extra noises.
Signed-off-by: Kairui Song <kasong@redhat.com>
---
arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
certs/system_keyring.c | 13 ++++++++++++-
include/linux/verification.h | 1 +
3 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 7d97e432cbbc..2c007abd3d40 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
{
- return verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_SECONDARY_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
+ int ret;
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ if (ret = -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ return ret;
}
#endif
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 4690ef9cda8a..7085c286f4bd 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
#else
trusted_keys = builtin_trusted_keys;
#endif
+ } else if (trusted_keys = VERIFY_USE_PLATFORM_KEYRING) {
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+ trusted_keys = platform_trusted_keys;
+#else
+ trusted_keys = NULL;
+#endif
+ if (!trusted_keys) {
+ ret = -ENOKEY;
+ pr_devel("PKCS#7 platform keyring is not available\n");
+ goto error;
+ }
}
ret = pkcs7_validate_trust(pkcs7, trusted_keys);
if (ret < 0) {
if (ret = -ENOKEY)
- pr_err("PKCS#7 signature not signed with a trusted key\n");
+ pr_devel("PKCS#7 signature not signed with a trusted key\n");
goto error;
}
diff --git a/include/linux/verification.h b/include/linux/verification.h
index cfa4730d607a..018fb5f13d44 100644
--- a/include/linux/verification.h
+++ b/include/linux/verification.h
@@ -17,6 +17,7 @@
* should be used.
*/
#define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
+#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
/*
* The use to which an asymmetric key is being put.
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
@ 2019-01-21 9:59 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: jwboyer, Kairui Song, ebiggers, dyoung, nayna, kexec, jmorris,
zohar, dhowells, keyrings, linux-integrity, dwmw2, bauerman,
serge
This patch let kexec_file_load makes use of .platform keyring as fall
back if it failed to verify a PE signed image against secondary or
builtin key ring, make it possible to verify kernel image signed with
preboot keys as well.
This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
should verify the signature using platform keyring. Also, decrease
the error message log level when verification failed with -ENOKEY,
so that if called tried multiple time with different keyring it
won't generate extra noises.
Signed-off-by: Kairui Song <kasong@redhat.com>
---
arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
certs/system_keyring.c | 13 ++++++++++++-
include/linux/verification.h | 1 +
3 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 7d97e432cbbc..2c007abd3d40 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
{
- return verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_SECONDARY_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
+ int ret;
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ return ret;
}
#endif
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 4690ef9cda8a..7085c286f4bd 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
#else
trusted_keys = builtin_trusted_keys;
#endif
+ } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+ trusted_keys = platform_trusted_keys;
+#else
+ trusted_keys = NULL;
+#endif
+ if (!trusted_keys) {
+ ret = -ENOKEY;
+ pr_devel("PKCS#7 platform keyring is not available\n");
+ goto error;
+ }
}
ret = pkcs7_validate_trust(pkcs7, trusted_keys);
if (ret < 0) {
if (ret == -ENOKEY)
- pr_err("PKCS#7 signature not signed with a trusted key\n");
+ pr_devel("PKCS#7 signature not signed with a trusted key\n");
goto error;
}
diff --git a/include/linux/verification.h b/include/linux/verification.h
index cfa4730d607a..018fb5f13d44 100644
--- a/include/linux/verification.h
+++ b/include/linux/verification.h
@@ -17,6 +17,7 @@
* should be used.
*/
#define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
+#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
/*
* The use to which an asymmetric key is being put.
--
2.20.1
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
@ 2019-01-21 9:59 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 9:59 UTC (permalink / raw)
To: linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, zohar,
bauerman, ebiggers, nayna, dyoung, linux-integrity, kexec,
Kairui Song
This patch let kexec_file_load makes use of .platform keyring as fall
back if it failed to verify a PE signed image against secondary or
builtin key ring, make it possible to verify kernel image signed with
preboot keys as well.
This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
should verify the signature using platform keyring. Also, decrease
the error message log level when verification failed with -ENOKEY,
so that if called tried multiple time with different keyring it
won't generate extra noises.
Signed-off-by: Kairui Song <kasong@redhat.com>
---
arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
certs/system_keyring.c | 13 ++++++++++++-
include/linux/verification.h | 1 +
3 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 7d97e432cbbc..2c007abd3d40 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
{
- return verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_SECONDARY_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
+ int ret;
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ return ret;
}
#endif
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 4690ef9cda8a..7085c286f4bd 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
#else
trusted_keys = builtin_trusted_keys;
#endif
+ } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+ trusted_keys = platform_trusted_keys;
+#else
+ trusted_keys = NULL;
+#endif
+ if (!trusted_keys) {
+ ret = -ENOKEY;
+ pr_devel("PKCS#7 platform keyring is not available\n");
+ goto error;
+ }
}
ret = pkcs7_validate_trust(pkcs7, trusted_keys);
if (ret < 0) {
if (ret == -ENOKEY)
- pr_err("PKCS#7 signature not signed with a trusted key\n");
+ pr_devel("PKCS#7 signature not signed with a trusted key\n");
goto error;
}
diff --git a/include/linux/verification.h b/include/linux/verification.h
index cfa4730d607a..018fb5f13d44 100644
--- a/include/linux/verification.h
+++ b/include/linux/verification.h
@@ -17,6 +17,7 @@
* should be used.
*/
#define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
+#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
/*
* The use to which an asymmetric key is being put.
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
2019-01-21 9:59 ` Kairui Song
(?)
@ 2019-01-22 15:37 ` Mimi Zohar
-1 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-22 15:37 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, bauerman,
ebiggers, nayna, dyoung, linux-integrity, kexec
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> This patch let kexec_file_load makes use of .platform keyring as fall
> back if it failed to verify a PE signed image against secondary or
> builtin key ring, make it possible to verify kernel image signed with
> preboot keys as well.
>
> This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
> VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
> should verify the signature using platform keyring. Also, decrease
> the error message log level when verification failed with -ENOKEY,
> so that if called tried multiple time with different keyring it
> won't generate extra noises.
>
> Signed-off-by: Kairui Song <kasong@redhat.com>
Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 13 ++++++++++++-
> include/linux/verification.h | 1 +
> 3 files changed, 23 insertions(+), 4 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 7d97e432cbbc..2c007abd3d40 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> {
> - return verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> + int ret;
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret = -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> }
> #endif
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 4690ef9cda8a..7085c286f4bd 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
> #else
> trusted_keys = builtin_trusted_keys;
> #endif
> + } else if (trusted_keys = VERIFY_USE_PLATFORM_KEYRING) {
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> + trusted_keys = platform_trusted_keys;
> +#else
> + trusted_keys = NULL;
> +#endif
> + if (!trusted_keys) {
> + ret = -ENOKEY;
> + pr_devel("PKCS#7 platform keyring is not available\n");
> + goto error;
> + }
> }
> ret = pkcs7_validate_trust(pkcs7, trusted_keys);
> if (ret < 0) {
> if (ret = -ENOKEY)
> - pr_err("PKCS#7 signature not signed with a trusted key\n");
> + pr_devel("PKCS#7 signature not signed with a trusted key\n");
> goto error;
> }
>
> diff --git a/include/linux/verification.h b/include/linux/verification.h
> index cfa4730d607a..018fb5f13d44 100644
> --- a/include/linux/verification.h
> +++ b/include/linux/verification.h
> @@ -17,6 +17,7 @@
> * should be used.
> */
> #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
>
> /*
> * The use to which an asymmetric key is being put.
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
@ 2019-01-22 15:37 ` Mimi Zohar
0 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-22 15:37 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: jwboyer, ebiggers, dyoung, nayna, kexec, jmorris, dhowells,
keyrings, linux-integrity, dwmw2, bauerman, serge
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> This patch let kexec_file_load makes use of .platform keyring as fall
> back if it failed to verify a PE signed image against secondary or
> builtin key ring, make it possible to verify kernel image signed with
> preboot keys as well.
>
> This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
> VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
> should verify the signature using platform keyring. Also, decrease
> the error message log level when verification failed with -ENOKEY,
> so that if called tried multiple time with different keyring it
> won't generate extra noises.
>
> Signed-off-by: Kairui Song <kasong@redhat.com>
Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 13 ++++++++++++-
> include/linux/verification.h | 1 +
> 3 files changed, 23 insertions(+), 4 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 7d97e432cbbc..2c007abd3d40 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> {
> - return verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> + int ret;
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> }
> #endif
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 4690ef9cda8a..7085c286f4bd 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
> #else
> trusted_keys = builtin_trusted_keys;
> #endif
> + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> + trusted_keys = platform_trusted_keys;
> +#else
> + trusted_keys = NULL;
> +#endif
> + if (!trusted_keys) {
> + ret = -ENOKEY;
> + pr_devel("PKCS#7 platform keyring is not available\n");
> + goto error;
> + }
> }
> ret = pkcs7_validate_trust(pkcs7, trusted_keys);
> if (ret < 0) {
> if (ret == -ENOKEY)
> - pr_err("PKCS#7 signature not signed with a trusted key\n");
> + pr_devel("PKCS#7 signature not signed with a trusted key\n");
> goto error;
> }
>
> diff --git a/include/linux/verification.h b/include/linux/verification.h
> index cfa4730d607a..018fb5f13d44 100644
> --- a/include/linux/verification.h
> +++ b/include/linux/verification.h
> @@ -17,6 +17,7 @@
> * should be used.
> */
> #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
>
> /*
> * The use to which an asymmetric key is being put.
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
@ 2019-01-22 15:37 ` Mimi Zohar
0 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-22 15:37 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, bauerman,
ebiggers, nayna, dyoung, linux-integrity, kexec
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> This patch let kexec_file_load makes use of .platform keyring as fall
> back if it failed to verify a PE signed image against secondary or
> builtin key ring, make it possible to verify kernel image signed with
> preboot keys as well.
>
> This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
> VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
> should verify the signature using platform keyring. Also, decrease
> the error message log level when verification failed with -ENOKEY,
> so that if called tried multiple time with different keyring it
> won't generate extra noises.
>
> Signed-off-by: Kairui Song <kasong@redhat.com>
Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 13 ++++++++++++-
> include/linux/verification.h | 1 +
> 3 files changed, 23 insertions(+), 4 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 7d97e432cbbc..2c007abd3d40 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> {
> - return verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> + int ret;
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> }
> #endif
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 4690ef9cda8a..7085c286f4bd 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
> #else
> trusted_keys = builtin_trusted_keys;
> #endif
> + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> + trusted_keys = platform_trusted_keys;
> +#else
> + trusted_keys = NULL;
> +#endif
> + if (!trusted_keys) {
> + ret = -ENOKEY;
> + pr_devel("PKCS#7 platform keyring is not available\n");
> + goto error;
> + }
> }
> ret = pkcs7_validate_trust(pkcs7, trusted_keys);
> if (ret < 0) {
> if (ret == -ENOKEY)
> - pr_err("PKCS#7 signature not signed with a trusted key\n");
> + pr_devel("PKCS#7 signature not signed with a trusted key\n");
> goto error;
> }
>
> diff --git a/include/linux/verification.h b/include/linux/verification.h
> index cfa4730d607a..018fb5f13d44 100644
> --- a/include/linux/verification.h
> +++ b/include/linux/verification.h
> @@ -17,6 +17,7 @@
> * should be used.
> */
> #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
>
> /*
> * The use to which an asymmetric key is being put.
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
2019-01-21 9:59 ` Kairui Song
(?)
@ 2019-01-23 2:35 ` Dave Young
-1 siblings, 0 replies; 24+ messages in thread
From: Dave Young @ 2019-01-23 2:35 UTC (permalink / raw)
To: Kairui Song
Cc: linux-kernel, dhowells, dwmw2, jwboyer, keyrings, jmorris, serge,
zohar, bauerman, ebiggers, nayna, linux-integrity, kexec
On 01/21/19 at 05:59pm, Kairui Song wrote:
> This patch let kexec_file_load makes use of .platform keyring as fall
> back if it failed to verify a PE signed image against secondary or
> builtin key ring, make it possible to verify kernel image signed with
> preboot keys as well.
>
> This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
> VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
> should verify the signature using platform keyring. Also, decrease
> the error message log level when verification failed with -ENOKEY,
> so that if called tried multiple time with different keyring it
> won't generate extra noises.
>
> Signed-off-by: Kairui Song <kasong@redhat.com>
> ---
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 13 ++++++++++++-
> include/linux/verification.h | 1 +
> 3 files changed, 23 insertions(+), 4 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 7d97e432cbbc..2c007abd3d40 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> {
> - return verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> + int ret;
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret = -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> }
> #endif
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 4690ef9cda8a..7085c286f4bd 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
> #else
> trusted_keys = builtin_trusted_keys;
> #endif
> + } else if (trusted_keys = VERIFY_USE_PLATFORM_KEYRING) {
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> + trusted_keys = platform_trusted_keys;
> +#else
> + trusted_keys = NULL;
> +#endif
> + if (!trusted_keys) {
> + ret = -ENOKEY;
> + pr_devel("PKCS#7 platform keyring is not available\n");
> + goto error;
> + }
> }
> ret = pkcs7_validate_trust(pkcs7, trusted_keys);
> if (ret < 0) {
> if (ret = -ENOKEY)
> - pr_err("PKCS#7 signature not signed with a trusted key\n");
> + pr_devel("PKCS#7 signature not signed with a trusted key\n");
> goto error;
> }
>
> diff --git a/include/linux/verification.h b/include/linux/verification.h
> index cfa4730d607a..018fb5f13d44 100644
> --- a/include/linux/verification.h
> +++ b/include/linux/verification.h
> @@ -17,6 +17,7 @@
> * should be used.
> */
> #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
>
> /*
> * The use to which an asymmetric key is being put.
> --
> 2.20.1
>
For kexec_file part
Acked-by: Dave Young <dyoung@redhat.com>
Thanks
Dave
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
@ 2019-01-23 2:35 ` Dave Young
0 siblings, 0 replies; 24+ messages in thread
From: Dave Young @ 2019-01-23 2:35 UTC (permalink / raw)
To: Kairui Song
Cc: jwboyer, ebiggers, nayna, kexec, linux-kernel, zohar, jmorris,
dhowells, keyrings, linux-integrity, dwmw2, bauerman, serge
On 01/21/19 at 05:59pm, Kairui Song wrote:
> This patch let kexec_file_load makes use of .platform keyring as fall
> back if it failed to verify a PE signed image against secondary or
> builtin key ring, make it possible to verify kernel image signed with
> preboot keys as well.
>
> This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
> VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
> should verify the signature using platform keyring. Also, decrease
> the error message log level when verification failed with -ENOKEY,
> so that if called tried multiple time with different keyring it
> won't generate extra noises.
>
> Signed-off-by: Kairui Song <kasong@redhat.com>
> ---
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 13 ++++++++++++-
> include/linux/verification.h | 1 +
> 3 files changed, 23 insertions(+), 4 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 7d97e432cbbc..2c007abd3d40 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> {
> - return verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> + int ret;
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> }
> #endif
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 4690ef9cda8a..7085c286f4bd 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
> #else
> trusted_keys = builtin_trusted_keys;
> #endif
> + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> + trusted_keys = platform_trusted_keys;
> +#else
> + trusted_keys = NULL;
> +#endif
> + if (!trusted_keys) {
> + ret = -ENOKEY;
> + pr_devel("PKCS#7 platform keyring is not available\n");
> + goto error;
> + }
> }
> ret = pkcs7_validate_trust(pkcs7, trusted_keys);
> if (ret < 0) {
> if (ret == -ENOKEY)
> - pr_err("PKCS#7 signature not signed with a trusted key\n");
> + pr_devel("PKCS#7 signature not signed with a trusted key\n");
> goto error;
> }
>
> diff --git a/include/linux/verification.h b/include/linux/verification.h
> index cfa4730d607a..018fb5f13d44 100644
> --- a/include/linux/verification.h
> +++ b/include/linux/verification.h
> @@ -17,6 +17,7 @@
> * should be used.
> */
> #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
>
> /*
> * The use to which an asymmetric key is being put.
> --
> 2.20.1
>
For kexec_file part
Acked-by: Dave Young <dyoung@redhat.com>
Thanks
Dave
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH v5 2/2] kexec, KEYS: Make use of platform keyring for signature verify
@ 2019-01-23 2:35 ` Dave Young
0 siblings, 0 replies; 24+ messages in thread
From: Dave Young @ 2019-01-23 2:35 UTC (permalink / raw)
To: Kairui Song
Cc: linux-kernel, dhowells, dwmw2, jwboyer, keyrings, jmorris, serge,
zohar, bauerman, ebiggers, nayna, linux-integrity, kexec
On 01/21/19 at 05:59pm, Kairui Song wrote:
> This patch let kexec_file_load makes use of .platform keyring as fall
> back if it failed to verify a PE signed image against secondary or
> builtin key ring, make it possible to verify kernel image signed with
> preboot keys as well.
>
> This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
> VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
> should verify the signature using platform keyring. Also, decrease
> the error message log level when verification failed with -ENOKEY,
> so that if called tried multiple time with different keyring it
> won't generate extra noises.
>
> Signed-off-by: Kairui Song <kasong@redhat.com>
> ---
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 13 ++++++++++++-
> include/linux/verification.h | 1 +
> 3 files changed, 23 insertions(+), 4 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 7d97e432cbbc..2c007abd3d40 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -534,9 +534,16 @@ static int bzImage64_cleanup(void *loader_data)
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> {
> - return verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> + int ret;
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> }
> #endif
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 4690ef9cda8a..7085c286f4bd 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
> #else
> trusted_keys = builtin_trusted_keys;
> #endif
> + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
> + trusted_keys = platform_trusted_keys;
> +#else
> + trusted_keys = NULL;
> +#endif
> + if (!trusted_keys) {
> + ret = -ENOKEY;
> + pr_devel("PKCS#7 platform keyring is not available\n");
> + goto error;
> + }
> }
> ret = pkcs7_validate_trust(pkcs7, trusted_keys);
> if (ret < 0) {
> if (ret == -ENOKEY)
> - pr_err("PKCS#7 signature not signed with a trusted key\n");
> + pr_devel("PKCS#7 signature not signed with a trusted key\n");
> goto error;
> }
>
> diff --git a/include/linux/verification.h b/include/linux/verification.h
> index cfa4730d607a..018fb5f13d44 100644
> --- a/include/linux/verification.h
> +++ b/include/linux/verification.h
> @@ -17,6 +17,7 @@
> * should be used.
> */
> #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)
>
> /*
> * The use to which an asymmetric key is being put.
> --
> 2.20.1
>
For kexec_file part
Acked-by: Dave Young <dyoung@redhat.com>
Thanks
Dave
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
2019-01-21 9:59 ` Kairui Song
(?)
@ 2019-01-21 10:03 ` Kairui Song
-1 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 10:03 UTC (permalink / raw)
To: Mimi Zohar
Cc: David Howells, David Woodhouse, jwboyer, keyrings, jmorris,
serge, bauerman, Eric Biggers, nayna, Dave Young,
linux-integrity, kexec, Linux Kernel Mailing List
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="maccentraleurope", Size: 2403 bytes --]
On Mon, Jan 21, 2019 at 6:00 PM Kairui Song <kasong@redhat.com> wrote:
>
> This patch series adds a .platform_trusted_keys in system_keyring as the
> reference to .platform keyring in integrity subsystem, when platform
> keyring is being initialized it will be updated, so it will be
> accessable for verifying PE signed kernel image.
>
> This patch series let kexec_file_load use platform keyring as fall
> back if it failed to verify the image against secondary keyring,
> so the actually PE signature verify process will use keys provides
> by firmware.
>
> After this patch kexec_file_load will be able to verify a signed PE
> bzImage using keys in platform keyring.
>
> Tested in a VM with locally signed kernel with pesign and imported the
> cert to EFI's MokList variable.
>
> To test this patch series on latest kernel, you need to ensure this commit
> is applied as there is an regression bug in sanity_check_segment_list():
>
> https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id™3a110319a4a60aadbd02f6defdebe048f7773b
>
> Update from V4:
> - Drop ifdef in security/integrity/digsig.c to make code clearer
> - Fix a potential issue, set_platform_trusted_keys should not be
> called when keyring initialization failed
>
> Update from V3:
> - Tweak and simplify commit message as suggested by Mimi Zohar
>
> Update from V2:
> - Use IS_ENABLED in kexec_file_load to judge if platform_trusted_keys
> should be used for verifying image as suggested by Mimi Zohar
>
> Update from V1:
> - Make platform_trusted_keys static, and update commit message as suggested
> by Mimi Zohar
> - Always check if platform keyring is initialized before use it
>
> Kairui Song (2):
> integrity, KEYS: add a reference to platform keyring
> kexec, KEYS: Make use of platform keyring for signature verify
>
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 22 +++++++++++++++++++++-
> include/keys/system_keyring.h | 9 +++++++++
> include/linux/verification.h | 1 +
> security/integrity/digsig.c | 3 +++
> 5 files changed, 44 insertions(+), 4 deletions(-)
>
> --
> 2.20.1
>
Hi Mimi,
I've updated the patch series again and as the code changed a bit I
didn't include previous Reviewd-by / Tested-by, it worked with no
problem, could you help have a review again? Thank you.
--
Best Regards,
Kairui Song
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
@ 2019-01-21 10:03 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 10:03 UTC (permalink / raw)
To: Mimi Zohar
Cc: jwboyer, Eric Biggers, Dave Young, nayna, kexec, jmorris,
Linux Kernel Mailing List, David Howells, keyrings,
linux-integrity, David Woodhouse, bauerman, serge
On Mon, Jan 21, 2019 at 6:00 PM Kairui Song <kasong@redhat.com> wrote:
>
> This patch series adds a .platform_trusted_keys in system_keyring as the
> reference to .platform keyring in integrity subsystem, when platform
> keyring is being initialized it will be updated, so it will be
> accessable for verifying PE signed kernel image.
>
> This patch series let kexec_file_load use platform keyring as fall
> back if it failed to verify the image against secondary keyring,
> so the actually PE signature verify process will use keys provides
> by firmware.
>
> After this patch kexec_file_load will be able to verify a signed PE
> bzImage using keys in platform keyring.
>
> Tested in a VM with locally signed kernel with pesign and imported the
> cert to EFI's MokList variable.
>
> To test this patch series on latest kernel, you need to ensure this commit
> is applied as there is an regression bug in sanity_check_segment_list():
>
> https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=993a110319a4a60aadbd02f6defdebe048f7773b
>
> Update from V4:
> - Drop ifdef in security/integrity/digsig.c to make code clearer
> - Fix a potential issue, set_platform_trusted_keys should not be
> called when keyring initialization failed
>
> Update from V3:
> - Tweak and simplify commit message as suggested by Mimi Zohar
>
> Update from V2:
> - Use IS_ENABLED in kexec_file_load to judge if platform_trusted_keys
> should be used for verifying image as suggested by Mimi Zohar
>
> Update from V1:
> - Make platform_trusted_keys static, and update commit message as suggested
> by Mimi Zohar
> - Always check if platform keyring is initialized before use it
>
> Kairui Song (2):
> integrity, KEYS: add a reference to platform keyring
> kexec, KEYS: Make use of platform keyring for signature verify
>
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 22 +++++++++++++++++++++-
> include/keys/system_keyring.h | 9 +++++++++
> include/linux/verification.h | 1 +
> security/integrity/digsig.c | 3 +++
> 5 files changed, 44 insertions(+), 4 deletions(-)
>
> --
> 2.20.1
>
Hi Mimi,
I've updated the patch series again and as the code changed a bit I
didn't include previous Reviewd-by / Tested-by, it worked with no
problem, could you help have a review again? Thank you.
--
Best Regards,
Kairui Song
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
@ 2019-01-21 10:03 ` Kairui Song
0 siblings, 0 replies; 24+ messages in thread
From: Kairui Song @ 2019-01-21 10:03 UTC (permalink / raw)
To: Mimi Zohar
Cc: David Howells, David Woodhouse, jwboyer, keyrings, jmorris,
serge, bauerman, Eric Biggers, nayna, Dave Young,
linux-integrity, kexec, Linux Kernel Mailing List
On Mon, Jan 21, 2019 at 6:00 PM Kairui Song <kasong@redhat.com> wrote:
>
> This patch series adds a .platform_trusted_keys in system_keyring as the
> reference to .platform keyring in integrity subsystem, when platform
> keyring is being initialized it will be updated, so it will be
> accessable for verifying PE signed kernel image.
>
> This patch series let kexec_file_load use platform keyring as fall
> back if it failed to verify the image against secondary keyring,
> so the actually PE signature verify process will use keys provides
> by firmware.
>
> After this patch kexec_file_load will be able to verify a signed PE
> bzImage using keys in platform keyring.
>
> Tested in a VM with locally signed kernel with pesign and imported the
> cert to EFI's MokList variable.
>
> To test this patch series on latest kernel, you need to ensure this commit
> is applied as there is an regression bug in sanity_check_segment_list():
>
> https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=993a110319a4a60aadbd02f6defdebe048f7773b
>
> Update from V4:
> - Drop ifdef in security/integrity/digsig.c to make code clearer
> - Fix a potential issue, set_platform_trusted_keys should not be
> called when keyring initialization failed
>
> Update from V3:
> - Tweak and simplify commit message as suggested by Mimi Zohar
>
> Update from V2:
> - Use IS_ENABLED in kexec_file_load to judge if platform_trusted_keys
> should be used for verifying image as suggested by Mimi Zohar
>
> Update from V1:
> - Make platform_trusted_keys static, and update commit message as suggested
> by Mimi Zohar
> - Always check if platform keyring is initialized before use it
>
> Kairui Song (2):
> integrity, KEYS: add a reference to platform keyring
> kexec, KEYS: Make use of platform keyring for signature verify
>
> arch/x86/kernel/kexec-bzimage64.c | 13 ++++++++++---
> certs/system_keyring.c | 22 +++++++++++++++++++++-
> include/keys/system_keyring.h | 9 +++++++++
> include/linux/verification.h | 1 +
> security/integrity/digsig.c | 3 +++
> 5 files changed, 44 insertions(+), 4 deletions(-)
>
> --
> 2.20.1
>
Hi Mimi,
I've updated the patch series again and as the code changed a bit I
didn't include previous Reviewd-by / Tested-by, it worked with no
problem, could you help have a review again? Thank you.
--
Best Regards,
Kairui Song
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
2019-01-21 9:59 ` Kairui Song
(?)
@ 2019-01-23 18:36 ` Mimi Zohar
-1 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-23 18:36 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, bauerman,
ebiggers, nayna, dyoung, linux-integrity, kexec
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> This patch series adds a .platform_trusted_keys in system_keyring as the
> reference to .platform keyring in integrity subsystem, when platform
> keyring is being initialized it will be updated, so it will be
> accessable for verifying PE signed kernel image.
There were some scripts/checkpatch.pl errors/warnings emitted on these
patches. I've fixed them, but in the future please follow the
guidelines in Documentation/process/submitting-patches.rst.
These patches are now queued in the next-integrity branch of
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
Mimi
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
@ 2019-01-23 18:36 ` Mimi Zohar
0 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-23 18:36 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: jwboyer, ebiggers, dyoung, nayna, kexec, jmorris, dhowells,
keyrings, linux-integrity, dwmw2, bauerman, serge
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> This patch series adds a .platform_trusted_keys in system_keyring as the
> reference to .platform keyring in integrity subsystem, when platform
> keyring is being initialized it will be updated, so it will be
> accessable for verifying PE signed kernel image.
There were some scripts/checkpatch.pl errors/warnings emitted on these
patches. I've fixed them, but in the future please follow the
guidelines in Documentation/process/submitting-patches.rst.
These patches are now queued in the next-integrity branch of
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
Mimi
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH v5 0/2] let kexec_file_load use platform keyring to verify the kernel image
@ 2019-01-23 18:36 ` Mimi Zohar
0 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2019-01-23 18:36 UTC (permalink / raw)
To: Kairui Song, linux-kernel
Cc: dhowells, dwmw2, jwboyer, keyrings, jmorris, serge, bauerman,
ebiggers, nayna, dyoung, linux-integrity, kexec
On Mon, 2019-01-21 at 17:59 +0800, Kairui Song wrote:
> This patch series adds a .platform_trusted_keys in system_keyring as the
> reference to .platform keyring in integrity subsystem, when platform
> keyring is being initialized it will be updated, so it will be
> accessable for verifying PE signed kernel image.
There were some scripts/checkpatch.pl errors/warnings emitted on these
patches. I've fixed them, but in the future please follow the
guidelines in Documentation/process/submitting-patches.rst.
These patches are now queued in the next-integrity branch of
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
Mimi
^ permalink raw reply [flat|nested] 24+ messages in thread