[PATCH v7 0/4] use more system keyrings to verify arm64 and s390 kexec kernel image signature

[PATCH v7 0/4] use more system keyrings to verify arm64 and s390 kexec kernel image signature

[Coiby Xu]

Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7". This happens because arm64 uses
only the primary keyring i.e. the .builtin_trusted_keys keyring that
contains only kernel built-in keys to verify the kexec kernel image. MOK
keys are loaded into the .platform keyring or/and .machine keyring. The
.machine keyring is linked to the secondary keyring i.e.
.secondary_trusted_keys keyring when the end-user chooses to trust MOK
keys. The platform keyring is exclusively used for kexec kernel image
verification and .secondary_trusted_keys together with
.builtin_trusted_keys are the system trusted keyrings. So obviously
there is no reason to not use .secondary_trusted_keys or .platform
keyring for kernel image signature verification. 

Similarly, s390 only uses platform keyring for kernel image signature
verification and built-in keys and secondary keyring are not used.

This patch set allows arm64 and s390 to use more system keyrings
including the .secondary_trusted_keys and .platform keyring to verify
kexec kernel image signature as x86 does.

The 3rd arm64 patch depends on the first two patches. The 4th s390 patch
can be applied independently.

v7:
 - drop the Fixes tag for the 2nd patch and add patch prerequisites
   [Baoquan]
 - improve cover letter

v6:
 - integrate the first three patches of "[PATCH 0/4] Unifrom keyring
   support across architectures and functions" from Michal [1]
 - improve commit message [Baoquan, Michal]
 - directly assign kexec_kernel_verify_pe_sig to
   kexec_file_ops->verify_sig [Michal]

v5:
 - improve commit message [Baoquan]

v4:
 - fix commit reference format issue and other checkpatch.pl warnings [Baoquan]

v3:
 - s/arch_kexec_kernel_verify_pe_sig/kexec_kernel_verify_pe_sig [Eric]
 - clean up arch_kexec_kernel_verify_sig [Eric]

v2:
 - only x86_64 and arm64 need to enable PE file signature check [Dave]

[1] https://lore.kernel.org/lkml/cover.1644953683.git.msuchanek@suse.de/

Coiby Xu (3):
  kexec: clean up arch_kexec_kernel_verify_sig
  kexec, KEYS: make the code in bzImage64_verify_sig generic
  arm64: kexec_file: use more system keyrings to verify kernel image
    signature

Michal Suchanek (1):
  kexec, KEYS, s390: Make use of built-in and secondary keyring for
    signature verification

 arch/arm64/kernel/kexec_image.c       | 11 +-----
 arch/s390/kernel/machine_kexec_file.c | 18 +++++++---
 arch/x86/kernel/kexec-bzimage64.c     | 20 +----------
 include/linux/kexec.h                 |  7 ++--
 kernel/kexec_file.c                   | 51 ++++++++++++++++-----------
 5 files changed, 50 insertions(+), 57 deletions(-)

-- 
2.35.3


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 0/4] use more system keyrings to verify arm64 and s390 kexec kernel image signature

[Coiby Xu]

Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7". This happens because arm64 uses
only the primary keyring i.e. the .builtin_trusted_keys keyring that
contains only kernel built-in keys to verify the kexec kernel image. MOK
keys are loaded into the .platform keyring or/and .machine keyring. The
.machine keyring is linked to the secondary keyring i.e.
.secondary_trusted_keys keyring when the end-user chooses to trust MOK
keys. The platform keyring is exclusively used for kexec kernel image
verification and .secondary_trusted_keys together with
.builtin_trusted_keys are the system trusted keyrings. So obviously
there is no reason to not use .secondary_trusted_keys or .platform
keyring for kernel image signature verification. 

Similarly, s390 only uses platform keyring for kernel image signature
verification and built-in keys and secondary keyring are not used.

This patch set allows arm64 and s390 to use more system keyrings
including the .secondary_trusted_keys and .platform keyring to verify
kexec kernel image signature as x86 does.

The 3rd arm64 patch depends on the first two patches. The 4th s390 patch
can be applied independently.

v7:
 - drop the Fixes tag for the 2nd patch and add patch prerequisites
   [Baoquan]
 - improve cover letter

v6:
 - integrate the first three patches of "[PATCH 0/4] Unifrom keyring
   support across architectures and functions" from Michal [1]
 - improve commit message [Baoquan, Michal]
 - directly assign kexec_kernel_verify_pe_sig to
   kexec_file_ops->verify_sig [Michal]

v5:
 - improve commit message [Baoquan]

v4:
 - fix commit reference format issue and other checkpatch.pl warnings [Baoquan]

v3:
 - s/arch_kexec_kernel_verify_pe_sig/kexec_kernel_verify_pe_sig [Eric]
 - clean up arch_kexec_kernel_verify_sig [Eric]

v2:
 - only x86_64 and arm64 need to enable PE file signature check [Dave]

[1] https://lore.kernel.org/lkml/cover.1644953683.git.msuchanek at suse.de/

Coiby Xu (3):
  kexec: clean up arch_kexec_kernel_verify_sig
  kexec, KEYS: make the code in bzImage64_verify_sig generic
  arm64: kexec_file: use more system keyrings to verify kernel image
    signature

Michal Suchanek (1):
  kexec, KEYS, s390: Make use of built-in and secondary keyring for
    signature verification

 arch/arm64/kernel/kexec_image.c       | 11 +-----
 arch/s390/kernel/machine_kexec_file.c | 18 +++++++---
 arch/x86/kernel/kexec-bzimage64.c     | 20 +----------
 include/linux/kexec.h                 |  7 ++--
 kernel/kexec_file.c                   | 51 ++++++++++++++++-----------
 5 files changed, 50 insertions(+), 57 deletions(-)

-- 
2.35.3

[PATCH v7 1/4] kexec: clean up arch_kexec_kernel_verify_sig

[Coiby Xu]

Currently there is no arch-specific implementation of
arch_kexec_kernel_verify_sig. Even if we want to add an implementation
for an architecture in the future, we can simply use "(struct
kexec_file_ops*)->verify_sig". So clean it up.

Note this patch is needed by later patches so Cc it to the stable tree
as well.

Cc: stable@vger.kernel.org
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 include/linux/kexec.h |  4 ----
 kernel/kexec_file.c   | 34 +++++++++++++---------------------
 2 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 58d1b58a971e..413235c6c797 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -202,10 +202,6 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
 				 const Elf_Shdr *relsec,
 				 const Elf_Shdr *symtab);
 int arch_kimage_file_post_load_cleanup(struct kimage *image);
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-				 unsigned long buf_len);
-#endif
 int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 8347fc158d2b..3720435807eb 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -89,25 +89,6 @@ int __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
 	return kexec_image_post_load_cleanup_default(image);
 }
 
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
-					  unsigned long buf_len)
-{
-	if (!image->fops || !image->fops->verify_sig) {
-		pr_debug("kernel loader does not support signature verification.\n");
-		return -EKEYREJECTED;
-	}
-
-	return image->fops->verify_sig(buf, buf_len);
-}
-
-int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-					unsigned long buf_len)
-{
-	return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
 /*
  * arch_kexec_apply_relocations_add - apply relocations of type RELA
  * @pi:		Purgatory to be relocated.
@@ -184,13 +165,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+		unsigned long buf_len)
+{
+	if (!image->fops || !image->fops->verify_sig) {
+		pr_debug("kernel loader does not support signature verification.\n");
+		return -EKEYREJECTED;
+	}
+
+	return image->fops->verify_sig(buf, buf_len);
+}
+
 static int
 kimage_validate_signature(struct kimage *image)
 {
 	int ret;
 
-	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
-					   image->kernel_buf_len);
+	ret = kexec_image_verify_sig(image, image->kernel_buf,
+			image->kernel_buf_len);
 	if (ret) {
 
 		if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
-- 
2.35.3

[PATCH v7 1/4] kexec: clean up arch_kexec_kernel_verify_sig

[Coiby Xu]

Currently there is no arch-specific implementation of
arch_kexec_kernel_verify_sig. Even if we want to add an implementation
for an architecture in the future, we can simply use "(struct
kexec_file_ops*)->verify_sig". So clean it up.

Note this patch is needed by later patches so Cc it to the stable tree
as well.

Cc: stable@vger.kernel.org
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 include/linux/kexec.h |  4 ----
 kernel/kexec_file.c   | 34 +++++++++++++---------------------
 2 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 58d1b58a971e..413235c6c797 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -202,10 +202,6 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
 				 const Elf_Shdr *relsec,
 				 const Elf_Shdr *symtab);
 int arch_kimage_file_post_load_cleanup(struct kimage *image);
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-				 unsigned long buf_len);
-#endif
 int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 8347fc158d2b..3720435807eb 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -89,25 +89,6 @@ int __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
 	return kexec_image_post_load_cleanup_default(image);
 }
 
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
-					  unsigned long buf_len)
-{
-	if (!image->fops || !image->fops->verify_sig) {
-		pr_debug("kernel loader does not support signature verification.\n");
-		return -EKEYREJECTED;
-	}
-
-	return image->fops->verify_sig(buf, buf_len);
-}
-
-int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-					unsigned long buf_len)
-{
-	return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
 /*
  * arch_kexec_apply_relocations_add - apply relocations of type RELA
  * @pi:		Purgatory to be relocated.
@@ -184,13 +165,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+		unsigned long buf_len)
+{
+	if (!image->fops || !image->fops->verify_sig) {
+		pr_debug("kernel loader does not support signature verification.\n");
+		return -EKEYREJECTED;
+	}
+
+	return image->fops->verify_sig(buf, buf_len);
+}
+
 static int
 kimage_validate_signature(struct kimage *image)
 {
 	int ret;
 
-	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
-					   image->kernel_buf_len);
+	ret = kexec_image_verify_sig(image, image->kernel_buf,
+			image->kernel_buf_len);
 	if (ret) {
 
 		if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
-- 
2.35.3


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 1/4] kexec: clean up arch_kexec_kernel_verify_sig

[Coiby Xu]

Currently there is no arch-specific implementation of
arch_kexec_kernel_verify_sig. Even if we want to add an implementation
for an architecture in the future, we can simply use "(struct
kexec_file_ops*)->verify_sig". So clean it up.

Note this patch is needed by later patches so Cc it to the stable tree
as well.

Cc: stable at vger.kernel.org
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 include/linux/kexec.h |  4 ----
 kernel/kexec_file.c   | 34 +++++++++++++---------------------
 2 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 58d1b58a971e..413235c6c797 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -202,10 +202,6 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
 				 const Elf_Shdr *relsec,
 				 const Elf_Shdr *symtab);
 int arch_kimage_file_post_load_cleanup(struct kimage *image);
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-				 unsigned long buf_len);
-#endif
 int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 8347fc158d2b..3720435807eb 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -89,25 +89,6 @@ int __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
 	return kexec_image_post_load_cleanup_default(image);
 }
 
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
-					  unsigned long buf_len)
-{
-	if (!image->fops || !image->fops->verify_sig) {
-		pr_debug("kernel loader does not support signature verification.\n");
-		return -EKEYREJECTED;
-	}
-
-	return image->fops->verify_sig(buf, buf_len);
-}
-
-int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-					unsigned long buf_len)
-{
-	return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
 /*
  * arch_kexec_apply_relocations_add - apply relocations of type RELA
  * @pi:		Purgatory to be relocated.
@@ -184,13 +165,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+		unsigned long buf_len)
+{
+	if (!image->fops || !image->fops->verify_sig) {
+		pr_debug("kernel loader does not support signature verification.\n");
+		return -EKEYREJECTED;
+	}
+
+	return image->fops->verify_sig(buf, buf_len);
+}
+
 static int
 kimage_validate_signature(struct kimage *image)
 {
 	int ret;
 
-	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
-					   image->kernel_buf_len);
+	ret = kexec_image_verify_sig(image, image->kernel_buf,
+			image->kernel_buf_len);
 	if (ret) {
 
 		if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
-- 
2.35.3

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
signature verify") adds platform keyring support on x86 kexec but not
arm64.

The code in bzImage64_verify_sig makes use of system keyrings including
.buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
verify signed kernel image as PE file. Make it generic so both x86_64
and arm64 can use it.

Note this patch is needed by a later patch so Cc it to the stable tree
as well.

Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
 include/linux/kexec.h             |  7 +++++++
 kernel/kexec_file.c               | 17 +++++++++++++++++
 3 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 170d0fd68b1f..f299b48f9c9f 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -17,7 +17,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/efi.h>
-#include <linux/verification.h>
 
 #include <asm/bootparam.h>
 #include <asm/setup.h>
@@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
 	return 0;
 }
 
-#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
-{
-	int ret;
-
-	ret = verify_pefile_signature(kernel, kernel_len,
-				      VERIFY_USE_SECONDARY_KEYRING,
-				      VERIFYING_KEXEC_PE_SIGNATURE);
-	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
-		ret = verify_pefile_signature(kernel, kernel_len,
-					      VERIFY_USE_PLATFORM_KEYRING,
-					      VERIFYING_KEXEC_PE_SIGNATURE);
-	}
-	return ret;
-}
-#endif
-
 const struct kexec_file_ops kexec_bzImage64_ops = {
 	.probe = bzImage64_probe,
 	.load = bzImage64_load,
 	.cleanup = bzImage64_cleanup,
 #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-	.verify_sig = bzImage64_verify_sig,
+	.verify_sig = kexec_kernel_verify_pe_sig,
 #endif
 };
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 413235c6c797..da83abfc628b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -19,6 +19,7 @@
 #include <asm/io.h>
 
 #include <uapi/linux/kexec.h>
+#include <linux/verification.h>
 
 /* Location of a reserved region to hold the crash kernel.
  */
@@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
 				 const Elf_Shdr *relsec,
 				 const Elf_Shdr *symtab);
 int arch_kimage_file_post_load_cleanup(struct kimage *image);
+#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel,
+				    unsigned long kernel_len);
+#endif
+#endif
 int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 3720435807eb..754885b96aab 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
+{
+	int ret;
+
+	ret = verify_pefile_signature(kernel, kernel_len,
+				      VERIFY_USE_SECONDARY_KEYRING,
+				      VERIFYING_KEXEC_PE_SIGNATURE);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+		ret = verify_pefile_signature(kernel, kernel_len,
+					      VERIFY_USE_PLATFORM_KEYRING,
+					      VERIFYING_KEXEC_PE_SIGNATURE);
+	}
+	return ret;
+}
+#endif
+
 static int kexec_image_verify_sig(struct kimage *image, void *buf,
 		unsigned long buf_len)
 {
-- 
2.35.3

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
signature verify") adds platform keyring support on x86 kexec but not
arm64.

The code in bzImage64_verify_sig makes use of system keyrings including
.buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
verify signed kernel image as PE file. Make it generic so both x86_64
and arm64 can use it.

Note this patch is needed by a later patch so Cc it to the stable tree
as well.

Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
 include/linux/kexec.h             |  7 +++++++
 kernel/kexec_file.c               | 17 +++++++++++++++++
 3 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 170d0fd68b1f..f299b48f9c9f 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -17,7 +17,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/efi.h>
-#include <linux/verification.h>
 
 #include <asm/bootparam.h>
 #include <asm/setup.h>
@@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
 	return 0;
 }
 
-#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
-{
-	int ret;
-
-	ret = verify_pefile_signature(kernel, kernel_len,
-				      VERIFY_USE_SECONDARY_KEYRING,
-				      VERIFYING_KEXEC_PE_SIGNATURE);
-	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
-		ret = verify_pefile_signature(kernel, kernel_len,
-					      VERIFY_USE_PLATFORM_KEYRING,
-					      VERIFYING_KEXEC_PE_SIGNATURE);
-	}
-	return ret;
-}
-#endif
-
 const struct kexec_file_ops kexec_bzImage64_ops = {
 	.probe = bzImage64_probe,
 	.load = bzImage64_load,
 	.cleanup = bzImage64_cleanup,
 #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-	.verify_sig = bzImage64_verify_sig,
+	.verify_sig = kexec_kernel_verify_pe_sig,
 #endif
 };
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 413235c6c797..da83abfc628b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -19,6 +19,7 @@
 #include <asm/io.h>
 
 #include <uapi/linux/kexec.h>
+#include <linux/verification.h>
 
 /* Location of a reserved region to hold the crash kernel.
  */
@@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
 				 const Elf_Shdr *relsec,
 				 const Elf_Shdr *symtab);
 int arch_kimage_file_post_load_cleanup(struct kimage *image);
+#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel,
+				    unsigned long kernel_len);
+#endif
+#endif
 int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 3720435807eb..754885b96aab 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
+{
+	int ret;
+
+	ret = verify_pefile_signature(kernel, kernel_len,
+				      VERIFY_USE_SECONDARY_KEYRING,
+				      VERIFYING_KEXEC_PE_SIGNATURE);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+		ret = verify_pefile_signature(kernel, kernel_len,
+					      VERIFY_USE_PLATFORM_KEYRING,
+					      VERIFYING_KEXEC_PE_SIGNATURE);
+	}
+	return ret;
+}
+#endif
+
 static int kexec_image_verify_sig(struct kimage *image, void *buf,
 		unsigned long buf_len)
 {
-- 
2.35.3


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
signature verify") adds platform keyring support on x86 kexec but not
arm64.

The code in bzImage64_verify_sig makes use of system keyrings including
.buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
verify signed kernel image as PE file. Make it generic so both x86_64
and arm64 can use it.

Note this patch is needed by a later patch so Cc it to the stable tree
as well.

Cc: kexec at lists.infradead.org
Cc: keyrings at vger.kernel.org
Cc: linux-security-module at vger.kernel.org
Cc: stable at vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
 include/linux/kexec.h             |  7 +++++++
 kernel/kexec_file.c               | 17 +++++++++++++++++
 3 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 170d0fd68b1f..f299b48f9c9f 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -17,7 +17,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/efi.h>
-#include <linux/verification.h>
 
 #include <asm/bootparam.h>
 #include <asm/setup.h>
@@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
 	return 0;
 }
 
-#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
-{
-	int ret;
-
-	ret = verify_pefile_signature(kernel, kernel_len,
-				      VERIFY_USE_SECONDARY_KEYRING,
-				      VERIFYING_KEXEC_PE_SIGNATURE);
-	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
-		ret = verify_pefile_signature(kernel, kernel_len,
-					      VERIFY_USE_PLATFORM_KEYRING,
-					      VERIFYING_KEXEC_PE_SIGNATURE);
-	}
-	return ret;
-}
-#endif
-
 const struct kexec_file_ops kexec_bzImage64_ops = {
 	.probe = bzImage64_probe,
 	.load = bzImage64_load,
 	.cleanup = bzImage64_cleanup,
 #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-	.verify_sig = bzImage64_verify_sig,
+	.verify_sig = kexec_kernel_verify_pe_sig,
 #endif
 };
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 413235c6c797..da83abfc628b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -19,6 +19,7 @@
 #include <asm/io.h>
 
 #include <uapi/linux/kexec.h>
+#include <linux/verification.h>
 
 /* Location of a reserved region to hold the crash kernel.
  */
@@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
 				 const Elf_Shdr *relsec,
 				 const Elf_Shdr *symtab);
 int arch_kimage_file_post_load_cleanup(struct kimage *image);
+#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel,
+				    unsigned long kernel_len);
+#endif
+#endif
 int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 3720435807eb..754885b96aab 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
+{
+	int ret;
+
+	ret = verify_pefile_signature(kernel, kernel_len,
+				      VERIFY_USE_SECONDARY_KEYRING,
+				      VERIFYING_KEXEC_PE_SIGNATURE);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+		ret = verify_pefile_signature(kernel, kernel_len,
+					      VERIFY_USE_PLATFORM_KEYRING,
+					      VERIFYING_KEXEC_PE_SIGNATURE);
+	}
+	return ret;
+}
+#endif
+
 static int kexec_image_verify_sig(struct kimage *image, void *buf,
 		unsigned long buf_len)
 {
-- 
2.35.3

[PATCH v7 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature

[Coiby Xu]

Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7".

This happens because image_verify_sig uses only the primary keyring that
contains only kernel built-in keys to verify the kexec image.

This patch allows to verify arm64 kernel image signature using not only
.builtin_trusted_keys but also .platform and .secondary_trusted_keys
keyring.

Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
Acked-by: Baoquan He <bhe@redhat.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Co-developed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/arm64/kernel/kexec_image.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index 9ec34690e255..5ed6a585f21f 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -14,7 +14,6 @@
 #include <linux/kexec.h>
 #include <linux/pe.h>
 #include <linux/string.h>
-#include <linux/verification.h>
 #include <asm/byteorder.h>
 #include <asm/cpufeature.h>
 #include <asm/image.h>
@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
 	return NULL;
 }
 
-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
-{
-	return verify_pefile_signature(kernel, kernel_len, NULL,
-				       VERIFYING_KEXEC_PE_SIGNATURE);
-}
-#endif
-
 const struct kexec_file_ops kexec_image_ops = {
 	.probe = image_probe,
 	.load = image_load,
 #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-	.verify_sig = image_verify_sig,
+	.verify_sig = kexec_kernel_verify_pe_sig,
 #endif
 };
-- 
2.35.3

[PATCH v7 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature

[Coiby Xu]

Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7".

This happens because image_verify_sig uses only the primary keyring that
contains only kernel built-in keys to verify the kexec image.

This patch allows to verify arm64 kernel image signature using not only
.builtin_trusted_keys but also .platform and .secondary_trusted_keys
keyring.

Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
Acked-by: Baoquan He <bhe@redhat.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Co-developed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/arm64/kernel/kexec_image.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index 9ec34690e255..5ed6a585f21f 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -14,7 +14,6 @@
 #include <linux/kexec.h>
 #include <linux/pe.h>
 #include <linux/string.h>
-#include <linux/verification.h>
 #include <asm/byteorder.h>
 #include <asm/cpufeature.h>
 #include <asm/image.h>
@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
 	return NULL;
 }
 
-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
-{
-	return verify_pefile_signature(kernel, kernel_len, NULL,
-				       VERIFYING_KEXEC_PE_SIGNATURE);
-}
-#endif
-
 const struct kexec_file_ops kexec_image_ops = {
 	.probe = image_probe,
 	.load = image_load,
 #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-	.verify_sig = image_verify_sig,
+	.verify_sig = kexec_kernel_verify_pe_sig,
 #endif
 };
-- 
2.35.3


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature

[Coiby Xu]

Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7".

This happens because image_verify_sig uses only the primary keyring that
contains only kernel built-in keys to verify the kexec image.

This patch allows to verify arm64 kernel image signature using not only
.builtin_trusted_keys but also .platform and .secondary_trusted_keys
keyring.

Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
Cc: stable at vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Cc: stable at vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
Acked-by: Baoquan He <bhe@redhat.com>
Cc: kexec at lists.infradead.org
Cc: keyrings at vger.kernel.org
Cc: linux-security-module at vger.kernel.org
Co-developed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/arm64/kernel/kexec_image.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index 9ec34690e255..5ed6a585f21f 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -14,7 +14,6 @@
 #include <linux/kexec.h>
 #include <linux/pe.h>
 #include <linux/string.h>
-#include <linux/verification.h>
 #include <asm/byteorder.h>
 #include <asm/cpufeature.h>
 #include <asm/image.h>
@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
 	return NULL;
 }
 
-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
-{
-	return verify_pefile_signature(kernel, kernel_len, NULL,
-				       VERIFYING_KEXEC_PE_SIGNATURE);
-}
-#endif
-
 const struct kexec_file_ops kexec_image_ops = {
 	.probe = image_probe,
 	.load = image_load,
 #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-	.verify_sig = image_verify_sig,
+	.verify_sig = kexec_kernel_verify_pe_sig,
 #endif
 };
-- 
2.35.3

[PATCH v7 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification

[Coiby Xu]

From: Michal Suchanek <msuchanek@suse.de>

commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
adds support for KEXEC_SIG verification with keys from platform keyring
but the built-in keys and secondary keyring are not used.

Add support for the built-in keys and secondary keyring as x86 does.

Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
Cc: stable@vger.kernel.org
Cc: Philipp Rudo <prudo@linux.ibm.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
index 8f43575a4dd3..fc6d5f58debe 100644
--- a/arch/s390/kernel/machine_kexec_file.c
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -31,6 +31,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
 	const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;
 	struct module_signature *ms;
 	unsigned long sig_len;
+	int ret;
 
 	/* Skip signature verification when not secure IPLed. */
 	if (!ipl_secure_flag)
@@ -65,11 +66,18 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
 		return -EBADMSG;
 	}
 
-	return verify_pkcs7_signature(kernel, kernel_len,
-				      kernel + kernel_len, sig_len,
-				      VERIFY_USE_PLATFORM_KEYRING,
-				      VERIFYING_MODULE_SIGNATURE,
-				      NULL, NULL);
+	ret = verify_pkcs7_signature(kernel, kernel_len,
+				     kernel + kernel_len, sig_len,
+				     VERIFY_USE_SECONDARY_KEYRING,
+				     VERIFYING_MODULE_SIGNATURE,
+				     NULL, NULL);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
+		ret = verify_pkcs7_signature(kernel, kernel_len,
+					     kernel + kernel_len, sig_len,
+					     VERIFY_USE_PLATFORM_KEYRING,
+					     VERIFYING_MODULE_SIGNATURE,
+					     NULL, NULL);
+	return ret;
 }
 #endif /* CONFIG_KEXEC_SIG */
 
-- 
2.35.3

[PATCH v7 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification

[Coiby Xu]

From: Michal Suchanek <msuchanek@suse.de>

commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
adds support for KEXEC_SIG verification with keys from platform keyring
but the built-in keys and secondary keyring are not used.

Add support for the built-in keys and secondary keyring as x86 does.

Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
Cc: stable@vger.kernel.org
Cc: Philipp Rudo <prudo@linux.ibm.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
index 8f43575a4dd3..fc6d5f58debe 100644
--- a/arch/s390/kernel/machine_kexec_file.c
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -31,6 +31,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
 	const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;
 	struct module_signature *ms;
 	unsigned long sig_len;
+	int ret;
 
 	/* Skip signature verification when not secure IPLed. */
 	if (!ipl_secure_flag)
@@ -65,11 +66,18 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
 		return -EBADMSG;
 	}
 
-	return verify_pkcs7_signature(kernel, kernel_len,
-				      kernel + kernel_len, sig_len,
-				      VERIFY_USE_PLATFORM_KEYRING,
-				      VERIFYING_MODULE_SIGNATURE,
-				      NULL, NULL);
+	ret = verify_pkcs7_signature(kernel, kernel_len,
+				     kernel + kernel_len, sig_len,
+				     VERIFY_USE_SECONDARY_KEYRING,
+				     VERIFYING_MODULE_SIGNATURE,
+				     NULL, NULL);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
+		ret = verify_pkcs7_signature(kernel, kernel_len,
+					     kernel + kernel_len, sig_len,
+					     VERIFY_USE_PLATFORM_KEYRING,
+					     VERIFYING_MODULE_SIGNATURE,
+					     NULL, NULL);
+	return ret;
 }
 #endif /* CONFIG_KEXEC_SIG */
 
-- 
2.35.3


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification

[Coiby Xu]

From: Michal Suchanek <msuchanek@suse.de>

commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
adds support for KEXEC_SIG verification with keys from platform keyring
but the built-in keys and secondary keyring are not used.

Add support for the built-in keys and secondary keyring as x86 does.

Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
Cc: stable at vger.kernel.org
Cc: Philipp Rudo <prudo@linux.ibm.com>
Cc: kexec at lists.infradead.org
Cc: keyrings at vger.kernel.org
Cc: linux-security-module at vger.kernel.org
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
 arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
index 8f43575a4dd3..fc6d5f58debe 100644
--- a/arch/s390/kernel/machine_kexec_file.c
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -31,6 +31,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
 	const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;
 	struct module_signature *ms;
 	unsigned long sig_len;
+	int ret;
 
 	/* Skip signature verification when not secure IPLed. */
 	if (!ipl_secure_flag)
@@ -65,11 +66,18 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
 		return -EBADMSG;
 	}
 
-	return verify_pkcs7_signature(kernel, kernel_len,
-				      kernel + kernel_len, sig_len,
-				      VERIFY_USE_PLATFORM_KEYRING,
-				      VERIFYING_MODULE_SIGNATURE,
-				      NULL, NULL);
+	ret = verify_pkcs7_signature(kernel, kernel_len,
+				     kernel + kernel_len, sig_len,
+				     VERIFY_USE_SECONDARY_KEYRING,
+				     VERIFYING_MODULE_SIGNATURE,
+				     NULL, NULL);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
+		ret = verify_pkcs7_signature(kernel, kernel_len,
+					     kernel + kernel_len, sig_len,
+					     VERIFY_USE_PLATFORM_KEYRING,
+					     VERIFYING_MODULE_SIGNATURE,
+					     NULL, NULL);
+	return ret;
 }
 #endif /* CONFIG_KEXEC_SIG */
 
-- 
2.35.3

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 10:34am, Coiby Xu wrote:
> commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> signature verify") adds platform keyring support on x86 kexec but not
> arm64.
> 
> The code in bzImage64_verify_sig makes use of system keyrings including
> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> verify signed kernel image as PE file. Make it generic so both x86_64
> and arm64 can use it.
> 
> Note this patch is needed by a later patch so Cc it to the stable tree
> as well.

This note should not be added in log.

> 
> Cc: kexec@lists.infradead.org
> Cc: keyrings@vger.kernel.org
> Cc: linux-security-module@vger.kernel.org
> Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---

You can put the note here, it won't be added to commit log when merged.
Maybe it can be removed when merged.

Otherwise, LGTM

Acked-by: Baoquan He <bhe@redhat.com>

>  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
>  include/linux/kexec.h             |  7 +++++++
>  kernel/kexec_file.c               | 17 +++++++++++++++++
>  3 files changed, 25 insertions(+), 19 deletions(-)
> 
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 170d0fd68b1f..f299b48f9c9f 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -17,7 +17,6 @@
>  #include <linux/kernel.h>
>  #include <linux/mm.h>
>  #include <linux/efi.h>
> -#include <linux/verification.h>
>  
>  #include <asm/bootparam.h>
>  #include <asm/setup.h>
> @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
>  	return 0;
>  }
>  
> -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> -{
> -	int ret;
> -
> -	ret = verify_pefile_signature(kernel, kernel_len,
> -				      VERIFY_USE_SECONDARY_KEYRING,
> -				      VERIFYING_KEXEC_PE_SIGNATURE);
> -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> -		ret = verify_pefile_signature(kernel, kernel_len,
> -					      VERIFY_USE_PLATFORM_KEYRING,
> -					      VERIFYING_KEXEC_PE_SIGNATURE);
> -	}
> -	return ret;
> -}
> -#endif
> -
>  const struct kexec_file_ops kexec_bzImage64_ops = {
>  	.probe = bzImage64_probe,
>  	.load = bzImage64_load,
>  	.cleanup = bzImage64_cleanup,
>  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -	.verify_sig = bzImage64_verify_sig,
> +	.verify_sig = kexec_kernel_verify_pe_sig,
>  #endif
>  };
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 413235c6c797..da83abfc628b 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -19,6 +19,7 @@
>  #include <asm/io.h>
>  
>  #include <uapi/linux/kexec.h>
> +#include <linux/verification.h>
>  
>  /* Location of a reserved region to hold the crash kernel.
>   */
> @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>  				 const Elf_Shdr *relsec,
>  				 const Elf_Shdr *symtab);
>  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> +#ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel,
> +				    unsigned long kernel_len);
> +#endif
> +#endif
>  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>  
>  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 3720435807eb..754885b96aab 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>  }
>  
>  #ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> +{
> +	int ret;
> +
> +	ret = verify_pefile_signature(kernel, kernel_len,
> +				      VERIFY_USE_SECONDARY_KEYRING,
> +				      VERIFYING_KEXEC_PE_SIGNATURE);
> +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> +		ret = verify_pefile_signature(kernel, kernel_len,
> +					      VERIFY_USE_PLATFORM_KEYRING,
> +					      VERIFYING_KEXEC_PE_SIGNATURE);
> +	}
> +	return ret;
> +}
> +#endif
> +
>  static int kexec_image_verify_sig(struct kimage *image, void *buf,
>  		unsigned long buf_len)
>  {
> -- 
> 2.35.3
> 

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 10:34am, Coiby Xu wrote:
> commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> signature verify") adds platform keyring support on x86 kexec but not
> arm64.
> 
> The code in bzImage64_verify_sig makes use of system keyrings including
> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> verify signed kernel image as PE file. Make it generic so both x86_64
> and arm64 can use it.
> 
> Note this patch is needed by a later patch so Cc it to the stable tree
> as well.

This note should not be added in log.

> 
> Cc: kexec@lists.infradead.org
> Cc: keyrings@vger.kernel.org
> Cc: linux-security-module@vger.kernel.org
> Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---

You can put the note here, it won't be added to commit log when merged.
Maybe it can be removed when merged.

Otherwise, LGTM

Acked-by: Baoquan He <bhe@redhat.com>

>  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
>  include/linux/kexec.h             |  7 +++++++
>  kernel/kexec_file.c               | 17 +++++++++++++++++
>  3 files changed, 25 insertions(+), 19 deletions(-)
> 
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 170d0fd68b1f..f299b48f9c9f 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -17,7 +17,6 @@
>  #include <linux/kernel.h>
>  #include <linux/mm.h>
>  #include <linux/efi.h>
> -#include <linux/verification.h>
>  
>  #include <asm/bootparam.h>
>  #include <asm/setup.h>
> @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
>  	return 0;
>  }
>  
> -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> -{
> -	int ret;
> -
> -	ret = verify_pefile_signature(kernel, kernel_len,
> -				      VERIFY_USE_SECONDARY_KEYRING,
> -				      VERIFYING_KEXEC_PE_SIGNATURE);
> -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> -		ret = verify_pefile_signature(kernel, kernel_len,
> -					      VERIFY_USE_PLATFORM_KEYRING,
> -					      VERIFYING_KEXEC_PE_SIGNATURE);
> -	}
> -	return ret;
> -}
> -#endif
> -
>  const struct kexec_file_ops kexec_bzImage64_ops = {
>  	.probe = bzImage64_probe,
>  	.load = bzImage64_load,
>  	.cleanup = bzImage64_cleanup,
>  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -	.verify_sig = bzImage64_verify_sig,
> +	.verify_sig = kexec_kernel_verify_pe_sig,
>  #endif
>  };
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 413235c6c797..da83abfc628b 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -19,6 +19,7 @@
>  #include <asm/io.h>
>  
>  #include <uapi/linux/kexec.h>
> +#include <linux/verification.h>
>  
>  /* Location of a reserved region to hold the crash kernel.
>   */
> @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>  				 const Elf_Shdr *relsec,
>  				 const Elf_Shdr *symtab);
>  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> +#ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel,
> +				    unsigned long kernel_len);
> +#endif
> +#endif
>  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>  
>  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 3720435807eb..754885b96aab 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>  }
>  
>  #ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> +{
> +	int ret;
> +
> +	ret = verify_pefile_signature(kernel, kernel_len,
> +				      VERIFY_USE_SECONDARY_KEYRING,
> +				      VERIFYING_KEXEC_PE_SIGNATURE);
> +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> +		ret = verify_pefile_signature(kernel, kernel_len,
> +					      VERIFY_USE_PLATFORM_KEYRING,
> +					      VERIFYING_KEXEC_PE_SIGNATURE);
> +	}
> +	return ret;
> +}
> +#endif
> +
>  static int kexec_image_verify_sig(struct kimage *image, void *buf,
>  		unsigned long buf_len)
>  {
> -- 
> 2.35.3
> 


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 10:34am, Coiby Xu wrote:
> commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> signature verify") adds platform keyring support on x86 kexec but not
> arm64.
> 
> The code in bzImage64_verify_sig makes use of system keyrings including
> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> verify signed kernel image as PE file. Make it generic so both x86_64
> and arm64 can use it.
> 
> Note this patch is needed by a later patch so Cc it to the stable tree
> as well.

This note should not be added in log.

> 
> Cc: kexec at lists.infradead.org
> Cc: keyrings at vger.kernel.org
> Cc: linux-security-module at vger.kernel.org
> Cc: stable at vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---

You can put the note here, it won't be added to commit log when merged.
Maybe it can be removed when merged.

Otherwise, LGTM

Acked-by: Baoquan He <bhe@redhat.com>

>  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
>  include/linux/kexec.h             |  7 +++++++
>  kernel/kexec_file.c               | 17 +++++++++++++++++
>  3 files changed, 25 insertions(+), 19 deletions(-)
> 
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 170d0fd68b1f..f299b48f9c9f 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -17,7 +17,6 @@
>  #include <linux/kernel.h>
>  #include <linux/mm.h>
>  #include <linux/efi.h>
> -#include <linux/verification.h>
>  
>  #include <asm/bootparam.h>
>  #include <asm/setup.h>
> @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
>  	return 0;
>  }
>  
> -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> -{
> -	int ret;
> -
> -	ret = verify_pefile_signature(kernel, kernel_len,
> -				      VERIFY_USE_SECONDARY_KEYRING,
> -				      VERIFYING_KEXEC_PE_SIGNATURE);
> -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> -		ret = verify_pefile_signature(kernel, kernel_len,
> -					      VERIFY_USE_PLATFORM_KEYRING,
> -					      VERIFYING_KEXEC_PE_SIGNATURE);
> -	}
> -	return ret;
> -}
> -#endif
> -
>  const struct kexec_file_ops kexec_bzImage64_ops = {
>  	.probe = bzImage64_probe,
>  	.load = bzImage64_load,
>  	.cleanup = bzImage64_cleanup,
>  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -	.verify_sig = bzImage64_verify_sig,
> +	.verify_sig = kexec_kernel_verify_pe_sig,
>  #endif
>  };
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 413235c6c797..da83abfc628b 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -19,6 +19,7 @@
>  #include <asm/io.h>
>  
>  #include <uapi/linux/kexec.h>
> +#include <linux/verification.h>
>  
>  /* Location of a reserved region to hold the crash kernel.
>   */
> @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>  				 const Elf_Shdr *relsec,
>  				 const Elf_Shdr *symtab);
>  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> +#ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel,
> +				    unsigned long kernel_len);
> +#endif
> +#endif
>  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>  
>  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 3720435807eb..754885b96aab 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>  }
>  
>  #ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> +{
> +	int ret;
> +
> +	ret = verify_pefile_signature(kernel, kernel_len,
> +				      VERIFY_USE_SECONDARY_KEYRING,
> +				      VERIFYING_KEXEC_PE_SIGNATURE);
> +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> +		ret = verify_pefile_signature(kernel, kernel_len,
> +					      VERIFY_USE_PLATFORM_KEYRING,
> +					      VERIFYING_KEXEC_PE_SIGNATURE);
> +	}
> +	return ret;
> +}
> +#endif
> +
>  static int kexec_image_verify_sig(struct kimage *image, void *buf,
>  		unsigned long buf_len)
>  {
> -- 
> 2.35.3
> 

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 10:46am, Baoquan He wrote:
> On 05/12/22 at 10:34am, Coiby Xu wrote:
> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > signature verify") adds platform keyring support on x86 kexec but not
> > arm64.
> > 
> > The code in bzImage64_verify_sig makes use of system keyrings including
> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > verify signed kernel image as PE file. Make it generic so both x86_64
> > and arm64 can use it.
> > 
> > Note this patch is needed by a later patch so Cc it to the stable tree
> > as well.
> 
> This note should not be added in log.
> 
> > 
> > Cc: kexec@lists.infradead.org
> > Cc: keyrings@vger.kernel.org
> > Cc: linux-security-module@vger.kernel.org
> > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig

Hold on, should we CC stable when it's not fixing an issue?

Hi Coiby,

Just to make clear , is this patch fixing an issue, or it's just an
preparation for later patch's use?

Or I should ask in another way, any problem is solved with this patch?


> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > ---
> 
> You can put the note here, it won't be added to commit log when merged.
> Maybe it can be removed when merged.
> 
> Otherwise, LGTM
> 
> Acked-by: Baoquan He <bhe@redhat.com>
> 
> >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> >  include/linux/kexec.h             |  7 +++++++
> >  kernel/kexec_file.c               | 17 +++++++++++++++++
> >  3 files changed, 25 insertions(+), 19 deletions(-)
> > 
> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > index 170d0fd68b1f..f299b48f9c9f 100644
> > --- a/arch/x86/kernel/kexec-bzimage64.c
> > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > @@ -17,7 +17,6 @@
> >  #include <linux/kernel.h>
> >  #include <linux/mm.h>
> >  #include <linux/efi.h>
> > -#include <linux/verification.h>
> >  
> >  #include <asm/bootparam.h>
> >  #include <asm/setup.h>
> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> >  	return 0;
> >  }
> >  
> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > -{
> > -	int ret;
> > -
> > -	ret = verify_pefile_signature(kernel, kernel_len,
> > -				      VERIFY_USE_SECONDARY_KEYRING,
> > -				      VERIFYING_KEXEC_PE_SIGNATURE);
> > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > -		ret = verify_pefile_signature(kernel, kernel_len,
> > -					      VERIFY_USE_PLATFORM_KEYRING,
> > -					      VERIFYING_KEXEC_PE_SIGNATURE);
> > -	}
> > -	return ret;
> > -}
> > -#endif
> > -
> >  const struct kexec_file_ops kexec_bzImage64_ops = {
> >  	.probe = bzImage64_probe,
> >  	.load = bzImage64_load,
> >  	.cleanup = bzImage64_cleanup,
> >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > -	.verify_sig = bzImage64_verify_sig,
> > +	.verify_sig = kexec_kernel_verify_pe_sig,
> >  #endif
> >  };
> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > index 413235c6c797..da83abfc628b 100644
> > --- a/include/linux/kexec.h
> > +++ b/include/linux/kexec.h
> > @@ -19,6 +19,7 @@
> >  #include <asm/io.h>
> >  
> >  #include <uapi/linux/kexec.h>
> > +#include <linux/verification.h>
> >  
> >  /* Location of a reserved region to hold the crash kernel.
> >   */
> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> >  				 const Elf_Shdr *relsec,
> >  				 const Elf_Shdr *symtab);
> >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > +#ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > +				    unsigned long kernel_len);
> > +#endif
> > +#endif
> >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> >  
> >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > index 3720435807eb..754885b96aab 100644
> > --- a/kernel/kexec_file.c
> > +++ b/kernel/kexec_file.c
> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> >  }
> >  
> >  #ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > +{
> > +	int ret;
> > +
> > +	ret = verify_pefile_signature(kernel, kernel_len,
> > +				      VERIFY_USE_SECONDARY_KEYRING,
> > +				      VERIFYING_KEXEC_PE_SIGNATURE);
> > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > +		ret = verify_pefile_signature(kernel, kernel_len,
> > +					      VERIFY_USE_PLATFORM_KEYRING,
> > +					      VERIFYING_KEXEC_PE_SIGNATURE);
> > +	}
> > +	return ret;
> > +}
> > +#endif
> > +
> >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
> >  		unsigned long buf_len)
> >  {
> > -- 
> > 2.35.3
> > 
> 

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 10:46am, Baoquan He wrote:
> On 05/12/22 at 10:34am, Coiby Xu wrote:
> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > signature verify") adds platform keyring support on x86 kexec but not
> > arm64.
> > 
> > The code in bzImage64_verify_sig makes use of system keyrings including
> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > verify signed kernel image as PE file. Make it generic so both x86_64
> > and arm64 can use it.
> > 
> > Note this patch is needed by a later patch so Cc it to the stable tree
> > as well.
> 
> This note should not be added in log.
> 
> > 
> > Cc: kexec@lists.infradead.org
> > Cc: keyrings@vger.kernel.org
> > Cc: linux-security-module@vger.kernel.org
> > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig

Hold on, should we CC stable when it's not fixing an issue?

Hi Coiby,

Just to make clear , is this patch fixing an issue, or it's just an
preparation for later patch's use?

Or I should ask in another way, any problem is solved with this patch?


> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > ---
> 
> You can put the note here, it won't be added to commit log when merged.
> Maybe it can be removed when merged.
> 
> Otherwise, LGTM
> 
> Acked-by: Baoquan He <bhe@redhat.com>
> 
> >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> >  include/linux/kexec.h             |  7 +++++++
> >  kernel/kexec_file.c               | 17 +++++++++++++++++
> >  3 files changed, 25 insertions(+), 19 deletions(-)
> > 
> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > index 170d0fd68b1f..f299b48f9c9f 100644
> > --- a/arch/x86/kernel/kexec-bzimage64.c
> > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > @@ -17,7 +17,6 @@
> >  #include <linux/kernel.h>
> >  #include <linux/mm.h>
> >  #include <linux/efi.h>
> > -#include <linux/verification.h>
> >  
> >  #include <asm/bootparam.h>
> >  #include <asm/setup.h>
> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> >  	return 0;
> >  }
> >  
> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > -{
> > -	int ret;
> > -
> > -	ret = verify_pefile_signature(kernel, kernel_len,
> > -				      VERIFY_USE_SECONDARY_KEYRING,
> > -				      VERIFYING_KEXEC_PE_SIGNATURE);
> > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > -		ret = verify_pefile_signature(kernel, kernel_len,
> > -					      VERIFY_USE_PLATFORM_KEYRING,
> > -					      VERIFYING_KEXEC_PE_SIGNATURE);
> > -	}
> > -	return ret;
> > -}
> > -#endif
> > -
> >  const struct kexec_file_ops kexec_bzImage64_ops = {
> >  	.probe = bzImage64_probe,
> >  	.load = bzImage64_load,
> >  	.cleanup = bzImage64_cleanup,
> >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > -	.verify_sig = bzImage64_verify_sig,
> > +	.verify_sig = kexec_kernel_verify_pe_sig,
> >  #endif
> >  };
> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > index 413235c6c797..da83abfc628b 100644
> > --- a/include/linux/kexec.h
> > +++ b/include/linux/kexec.h
> > @@ -19,6 +19,7 @@
> >  #include <asm/io.h>
> >  
> >  #include <uapi/linux/kexec.h>
> > +#include <linux/verification.h>
> >  
> >  /* Location of a reserved region to hold the crash kernel.
> >   */
> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> >  				 const Elf_Shdr *relsec,
> >  				 const Elf_Shdr *symtab);
> >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > +#ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > +				    unsigned long kernel_len);
> > +#endif
> > +#endif
> >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> >  
> >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > index 3720435807eb..754885b96aab 100644
> > --- a/kernel/kexec_file.c
> > +++ b/kernel/kexec_file.c
> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> >  }
> >  
> >  #ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > +{
> > +	int ret;
> > +
> > +	ret = verify_pefile_signature(kernel, kernel_len,
> > +				      VERIFY_USE_SECONDARY_KEYRING,
> > +				      VERIFYING_KEXEC_PE_SIGNATURE);
> > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > +		ret = verify_pefile_signature(kernel, kernel_len,
> > +					      VERIFY_USE_PLATFORM_KEYRING,
> > +					      VERIFYING_KEXEC_PE_SIGNATURE);
> > +	}
> > +	return ret;
> > +}
> > +#endif
> > +
> >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
> >  		unsigned long buf_len)
> >  {
> > -- 
> > 2.35.3
> > 
> 


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 10:46am, Baoquan He wrote:
> On 05/12/22 at 10:34am, Coiby Xu wrote:
> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > signature verify") adds platform keyring support on x86 kexec but not
> > arm64.
> > 
> > The code in bzImage64_verify_sig makes use of system keyrings including
> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > verify signed kernel image as PE file. Make it generic so both x86_64
> > and arm64 can use it.
> > 
> > Note this patch is needed by a later patch so Cc it to the stable tree
> > as well.
> 
> This note should not be added in log.
> 
> > 
> > Cc: kexec at lists.infradead.org
> > Cc: keyrings at vger.kernel.org
> > Cc: linux-security-module at vger.kernel.org
> > Cc: stable at vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig

Hold on, should we CC stable when it's not fixing an issue?

Hi Coiby,

Just to make clear , is this patch fixing an issue, or it's just an
preparation for later patch's use?

Or I should ask in another way, any problem is solved with this patch?


> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > ---
> 
> You can put the note here, it won't be added to commit log when merged.
> Maybe it can be removed when merged.
> 
> Otherwise, LGTM
> 
> Acked-by: Baoquan He <bhe@redhat.com>
> 
> >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> >  include/linux/kexec.h             |  7 +++++++
> >  kernel/kexec_file.c               | 17 +++++++++++++++++
> >  3 files changed, 25 insertions(+), 19 deletions(-)
> > 
> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > index 170d0fd68b1f..f299b48f9c9f 100644
> > --- a/arch/x86/kernel/kexec-bzimage64.c
> > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > @@ -17,7 +17,6 @@
> >  #include <linux/kernel.h>
> >  #include <linux/mm.h>
> >  #include <linux/efi.h>
> > -#include <linux/verification.h>
> >  
> >  #include <asm/bootparam.h>
> >  #include <asm/setup.h>
> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> >  	return 0;
> >  }
> >  
> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > -{
> > -	int ret;
> > -
> > -	ret = verify_pefile_signature(kernel, kernel_len,
> > -				      VERIFY_USE_SECONDARY_KEYRING,
> > -				      VERIFYING_KEXEC_PE_SIGNATURE);
> > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > -		ret = verify_pefile_signature(kernel, kernel_len,
> > -					      VERIFY_USE_PLATFORM_KEYRING,
> > -					      VERIFYING_KEXEC_PE_SIGNATURE);
> > -	}
> > -	return ret;
> > -}
> > -#endif
> > -
> >  const struct kexec_file_ops kexec_bzImage64_ops = {
> >  	.probe = bzImage64_probe,
> >  	.load = bzImage64_load,
> >  	.cleanup = bzImage64_cleanup,
> >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > -	.verify_sig = bzImage64_verify_sig,
> > +	.verify_sig = kexec_kernel_verify_pe_sig,
> >  #endif
> >  };
> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > index 413235c6c797..da83abfc628b 100644
> > --- a/include/linux/kexec.h
> > +++ b/include/linux/kexec.h
> > @@ -19,6 +19,7 @@
> >  #include <asm/io.h>
> >  
> >  #include <uapi/linux/kexec.h>
> > +#include <linux/verification.h>
> >  
> >  /* Location of a reserved region to hold the crash kernel.
> >   */
> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> >  				 const Elf_Shdr *relsec,
> >  				 const Elf_Shdr *symtab);
> >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > +#ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > +				    unsigned long kernel_len);
> > +#endif
> > +#endif
> >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> >  
> >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > index 3720435807eb..754885b96aab 100644
> > --- a/kernel/kexec_file.c
> > +++ b/kernel/kexec_file.c
> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> >  }
> >  
> >  #ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > +{
> > +	int ret;
> > +
> > +	ret = verify_pefile_signature(kernel, kernel_len,
> > +				      VERIFY_USE_SECONDARY_KEYRING,
> > +				      VERIFYING_KEXEC_PE_SIGNATURE);
> > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > +		ret = verify_pefile_signature(kernel, kernel_len,
> > +					      VERIFY_USE_PLATFORM_KEYRING,
> > +					      VERIFYING_KEXEC_PE_SIGNATURE);
> > +	}
> > +	return ret;
> > +}
> > +#endif
> > +
> >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
> >  		unsigned long buf_len)
> >  {
> > -- 
> > 2.35.3
> > 
> 

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
>On 05/12/22 at 10:46am, Baoquan He wrote:
>> On 05/12/22 at 10:34am, Coiby Xu wrote:
>> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
>> > signature verify") adds platform keyring support on x86 kexec but not
>> > arm64.
>> >
>> > The code in bzImage64_verify_sig makes use of system keyrings including
>> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
>> > verify signed kernel image as PE file. Make it generic so both x86_64
>> > and arm64 can use it.
>> >
>> > Note this patch is needed by a later patch so Cc it to the stable tree
>> > as well.
>>
>> This note should not be added in log.
>>
>> >
>> > Cc: kexec@lists.infradead.org
>> > Cc: keyrings@vger.kernel.org
>> > Cc: linux-security-module@vger.kernel.org
>> > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
>
>Hold on, should we CC stable when it's not fixing an issue?
>
>Hi Coiby,

Hi Baoquan,

>
>Just to make clear , is this patch fixing an issue, or it's just an
>preparation for later patch's use?
>
>Or I should ask in another way, any problem is solved with this patch?

At least it doesn't fix an issue that satisfy the criteria listed in 
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

>
>
>> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > ---
>>
>> You can put the note here, it won't be added to commit log when merged.
>> Maybe it can be removed when merged.

Thanks for the suggestion! Shall I send a version to fix this problem or
can I just bother the maintainer to remove it?


>>
>> Otherwise, LGTM
>>
>> Acked-by: Baoquan He <bhe@redhat.com>
>>
>> >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
>> >  include/linux/kexec.h             |  7 +++++++
>> >  kernel/kexec_file.c               | 17 +++++++++++++++++
>> >  3 files changed, 25 insertions(+), 19 deletions(-)
>> >
>> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
>> > index 170d0fd68b1f..f299b48f9c9f 100644
>> > --- a/arch/x86/kernel/kexec-bzimage64.c
>> > +++ b/arch/x86/kernel/kexec-bzimage64.c
>> > @@ -17,7 +17,6 @@
>> >  #include <linux/kernel.h>
>> >  #include <linux/mm.h>
>> >  #include <linux/efi.h>
>> > -#include <linux/verification.h>
>> >
>> >  #include <asm/bootparam.h>
>> >  #include <asm/setup.h>
>> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
>> >  	return 0;
>> >  }
>> >
>> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
>> > -{
>> > -	int ret;
>> > -
>> > -	ret = verify_pefile_signature(kernel, kernel_len,
>> > -				      VERIFY_USE_SECONDARY_KEYRING,
>> > -				      VERIFYING_KEXEC_PE_SIGNATURE);
>> > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > -		ret = verify_pefile_signature(kernel, kernel_len,
>> > -					      VERIFY_USE_PLATFORM_KEYRING,
>> > -					      VERIFYING_KEXEC_PE_SIGNATURE);
>> > -	}
>> > -	return ret;
>> > -}
>> > -#endif
>> > -
>> >  const struct kexec_file_ops kexec_bzImage64_ops = {
>> >  	.probe = bzImage64_probe,
>> >  	.load = bzImage64_load,
>> >  	.cleanup = bzImage64_cleanup,
>> >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > -	.verify_sig = bzImage64_verify_sig,
>> > +	.verify_sig = kexec_kernel_verify_pe_sig,
>> >  #endif
>> >  };
>> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
>> > index 413235c6c797..da83abfc628b 100644
>> > --- a/include/linux/kexec.h
>> > +++ b/include/linux/kexec.h
>> > @@ -19,6 +19,7 @@
>> >  #include <asm/io.h>
>> >
>> >  #include <uapi/linux/kexec.h>
>> > +#include <linux/verification.h>
>> >
>> >  /* Location of a reserved region to hold the crash kernel.
>> >   */
>> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>> >  				 const Elf_Shdr *relsec,
>> >  				 const Elf_Shdr *symtab);
>> >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
>> > +#ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel,
>> > +				    unsigned long kernel_len);
>> > +#endif
>> > +#endif
>> >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>> >
>> >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
>> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
>> > index 3720435807eb..754885b96aab 100644
>> > --- a/kernel/kexec_file.c
>> > +++ b/kernel/kexec_file.c
>> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>> >  }
>> >
>> >  #ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
>> > +{
>> > +	int ret;
>> > +
>> > +	ret = verify_pefile_signature(kernel, kernel_len,
>> > +				      VERIFY_USE_SECONDARY_KEYRING,
>> > +				      VERIFYING_KEXEC_PE_SIGNATURE);
>> > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > +		ret = verify_pefile_signature(kernel, kernel_len,
>> > +					      VERIFY_USE_PLATFORM_KEYRING,
>> > +					      VERIFYING_KEXEC_PE_SIGNATURE);
>> > +	}
>> > +	return ret;
>> > +}
>> > +#endif
>> > +
>> >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
>> >  		unsigned long buf_len)
>> >  {
>> > --
>> > 2.35.3
>> >
>>
>

-- 
Best regards,
Coiby

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
>On 05/12/22 at 10:46am, Baoquan He wrote:
>> On 05/12/22 at 10:34am, Coiby Xu wrote:
>> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
>> > signature verify") adds platform keyring support on x86 kexec but not
>> > arm64.
>> >
>> > The code in bzImage64_verify_sig makes use of system keyrings including
>> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
>> > verify signed kernel image as PE file. Make it generic so both x86_64
>> > and arm64 can use it.
>> >
>> > Note this patch is needed by a later patch so Cc it to the stable tree
>> > as well.
>>
>> This note should not be added in log.
>>
>> >
>> > Cc: kexec@lists.infradead.org
>> > Cc: keyrings@vger.kernel.org
>> > Cc: linux-security-module@vger.kernel.org
>> > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
>
>Hold on, should we CC stable when it's not fixing an issue?
>
>Hi Coiby,

Hi Baoquan,

>
>Just to make clear , is this patch fixing an issue, or it's just an
>preparation for later patch's use?
>
>Or I should ask in another way, any problem is solved with this patch?

At least it doesn't fix an issue that satisfy the criteria listed in 
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

>
>
>> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > ---
>>
>> You can put the note here, it won't be added to commit log when merged.
>> Maybe it can be removed when merged.

Thanks for the suggestion! Shall I send a version to fix this problem or
can I just bother the maintainer to remove it?


>>
>> Otherwise, LGTM
>>
>> Acked-by: Baoquan He <bhe@redhat.com>
>>
>> >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
>> >  include/linux/kexec.h             |  7 +++++++
>> >  kernel/kexec_file.c               | 17 +++++++++++++++++
>> >  3 files changed, 25 insertions(+), 19 deletions(-)
>> >
>> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
>> > index 170d0fd68b1f..f299b48f9c9f 100644
>> > --- a/arch/x86/kernel/kexec-bzimage64.c
>> > +++ b/arch/x86/kernel/kexec-bzimage64.c
>> > @@ -17,7 +17,6 @@
>> >  #include <linux/kernel.h>
>> >  #include <linux/mm.h>
>> >  #include <linux/efi.h>
>> > -#include <linux/verification.h>
>> >
>> >  #include <asm/bootparam.h>
>> >  #include <asm/setup.h>
>> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
>> >  	return 0;
>> >  }
>> >
>> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
>> > -{
>> > -	int ret;
>> > -
>> > -	ret = verify_pefile_signature(kernel, kernel_len,
>> > -				      VERIFY_USE_SECONDARY_KEYRING,
>> > -				      VERIFYING_KEXEC_PE_SIGNATURE);
>> > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > -		ret = verify_pefile_signature(kernel, kernel_len,
>> > -					      VERIFY_USE_PLATFORM_KEYRING,
>> > -					      VERIFYING_KEXEC_PE_SIGNATURE);
>> > -	}
>> > -	return ret;
>> > -}
>> > -#endif
>> > -
>> >  const struct kexec_file_ops kexec_bzImage64_ops = {
>> >  	.probe = bzImage64_probe,
>> >  	.load = bzImage64_load,
>> >  	.cleanup = bzImage64_cleanup,
>> >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > -	.verify_sig = bzImage64_verify_sig,
>> > +	.verify_sig = kexec_kernel_verify_pe_sig,
>> >  #endif
>> >  };
>> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
>> > index 413235c6c797..da83abfc628b 100644
>> > --- a/include/linux/kexec.h
>> > +++ b/include/linux/kexec.h
>> > @@ -19,6 +19,7 @@
>> >  #include <asm/io.h>
>> >
>> >  #include <uapi/linux/kexec.h>
>> > +#include <linux/verification.h>
>> >
>> >  /* Location of a reserved region to hold the crash kernel.
>> >   */
>> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>> >  				 const Elf_Shdr *relsec,
>> >  				 const Elf_Shdr *symtab);
>> >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
>> > +#ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel,
>> > +				    unsigned long kernel_len);
>> > +#endif
>> > +#endif
>> >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>> >
>> >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
>> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
>> > index 3720435807eb..754885b96aab 100644
>> > --- a/kernel/kexec_file.c
>> > +++ b/kernel/kexec_file.c
>> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>> >  }
>> >
>> >  #ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
>> > +{
>> > +	int ret;
>> > +
>> > +	ret = verify_pefile_signature(kernel, kernel_len,
>> > +				      VERIFY_USE_SECONDARY_KEYRING,
>> > +				      VERIFYING_KEXEC_PE_SIGNATURE);
>> > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > +		ret = verify_pefile_signature(kernel, kernel_len,
>> > +					      VERIFY_USE_PLATFORM_KEYRING,
>> > +					      VERIFYING_KEXEC_PE_SIGNATURE);
>> > +	}
>> > +	return ret;
>> > +}
>> > +#endif
>> > +
>> >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
>> >  		unsigned long buf_len)
>> >  {
>> > --
>> > 2.35.3
>> >
>>
>

-- 
Best regards,
Coiby


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
>On 05/12/22 at 10:46am, Baoquan He wrote:
>> On 05/12/22 at 10:34am, Coiby Xu wrote:
>> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
>> > signature verify") adds platform keyring support on x86 kexec but not
>> > arm64.
>> >
>> > The code in bzImage64_verify_sig makes use of system keyrings including
>> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
>> > verify signed kernel image as PE file. Make it generic so both x86_64
>> > and arm64 can use it.
>> >
>> > Note this patch is needed by a later patch so Cc it to the stable tree
>> > as well.
>>
>> This note should not be added in log.
>>
>> >
>> > Cc: kexec at lists.infradead.org
>> > Cc: keyrings at vger.kernel.org
>> > Cc: linux-security-module at vger.kernel.org
>> > Cc: stable at vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
>
>Hold on, should we CC stable when it's not fixing an issue?
>
>Hi Coiby,

Hi Baoquan,

>
>Just to make clear , is this patch fixing an issue, or it's just an
>preparation for later patch's use?
>
>Or I should ask in another way, any problem is solved with this patch?

At least it doesn't fix an issue that satisfy the criteria listed in 
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

>
>
>> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > ---
>>
>> You can put the note here, it won't be added to commit log when merged.
>> Maybe it can be removed when merged.

Thanks for the suggestion! Shall I send a version to fix this problem or
can I just bother the maintainer to remove it?


>>
>> Otherwise, LGTM
>>
>> Acked-by: Baoquan He <bhe@redhat.com>
>>
>> >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
>> >  include/linux/kexec.h             |  7 +++++++
>> >  kernel/kexec_file.c               | 17 +++++++++++++++++
>> >  3 files changed, 25 insertions(+), 19 deletions(-)
>> >
>> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
>> > index 170d0fd68b1f..f299b48f9c9f 100644
>> > --- a/arch/x86/kernel/kexec-bzimage64.c
>> > +++ b/arch/x86/kernel/kexec-bzimage64.c
>> > @@ -17,7 +17,6 @@
>> >  #include <linux/kernel.h>
>> >  #include <linux/mm.h>
>> >  #include <linux/efi.h>
>> > -#include <linux/verification.h>
>> >
>> >  #include <asm/bootparam.h>
>> >  #include <asm/setup.h>
>> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
>> >  	return 0;
>> >  }
>> >
>> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
>> > -{
>> > -	int ret;
>> > -
>> > -	ret = verify_pefile_signature(kernel, kernel_len,
>> > -				      VERIFY_USE_SECONDARY_KEYRING,
>> > -				      VERIFYING_KEXEC_PE_SIGNATURE);
>> > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > -		ret = verify_pefile_signature(kernel, kernel_len,
>> > -					      VERIFY_USE_PLATFORM_KEYRING,
>> > -					      VERIFYING_KEXEC_PE_SIGNATURE);
>> > -	}
>> > -	return ret;
>> > -}
>> > -#endif
>> > -
>> >  const struct kexec_file_ops kexec_bzImage64_ops = {
>> >  	.probe = bzImage64_probe,
>> >  	.load = bzImage64_load,
>> >  	.cleanup = bzImage64_cleanup,
>> >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > -	.verify_sig = bzImage64_verify_sig,
>> > +	.verify_sig = kexec_kernel_verify_pe_sig,
>> >  #endif
>> >  };
>> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
>> > index 413235c6c797..da83abfc628b 100644
>> > --- a/include/linux/kexec.h
>> > +++ b/include/linux/kexec.h
>> > @@ -19,6 +19,7 @@
>> >  #include <asm/io.h>
>> >
>> >  #include <uapi/linux/kexec.h>
>> > +#include <linux/verification.h>
>> >
>> >  /* Location of a reserved region to hold the crash kernel.
>> >   */
>> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>> >  				 const Elf_Shdr *relsec,
>> >  				 const Elf_Shdr *symtab);
>> >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
>> > +#ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel,
>> > +				    unsigned long kernel_len);
>> > +#endif
>> > +#endif
>> >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>> >
>> >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
>> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
>> > index 3720435807eb..754885b96aab 100644
>> > --- a/kernel/kexec_file.c
>> > +++ b/kernel/kexec_file.c
>> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>> >  }
>> >
>> >  #ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
>> > +{
>> > +	int ret;
>> > +
>> > +	ret = verify_pefile_signature(kernel, kernel_len,
>> > +				      VERIFY_USE_SECONDARY_KEYRING,
>> > +				      VERIFYING_KEXEC_PE_SIGNATURE);
>> > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > +		ret = verify_pefile_signature(kernel, kernel_len,
>> > +					      VERIFY_USE_PLATFORM_KEYRING,
>> > +					      VERIFYING_KEXEC_PE_SIGNATURE);
>> > +	}
>> > +	return ret;
>> > +}
>> > +#endif
>> > +
>> >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
>> >  		unsigned long buf_len)
>> >  {
>> > --
>> > 2.35.3
>> >
>>
>

-- 
Best regards,
Coiby

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 12:33pm, Coiby Xu wrote:
> On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
> > On 05/12/22 at 10:46am, Baoquan He wrote:
> > > On 05/12/22 at 10:34am, Coiby Xu wrote:
> > > > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > > > signature verify") adds platform keyring support on x86 kexec but not
> > > > arm64.
> > > >
> > > > The code in bzImage64_verify_sig makes use of system keyrings including
> > > > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > > > verify signed kernel image as PE file. Make it generic so both x86_64
> > > > and arm64 can use it.
> > > >
> > > > Note this patch is needed by a later patch so Cc it to the stable tree
> > > > as well.
> > > 
> > > This note should not be added in log.
> > > 
> > > >
> > > > Cc: kexec@lists.infradead.org
> > > > Cc: keyrings@vger.kernel.org
> > > > Cc: linux-security-module@vger.kernel.org
> > > > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> > 
> > Hold on, should we CC stable when it's not fixing an issue?
> > 
> > Hi Coiby,
> 
> Hi Baoquan,
> 
> > 
> > Just to make clear , is this patch fixing an issue, or it's just an
> > preparation for later patch's use?
> > 
> > Or I should ask in another way, any problem is solved with this patch?
> 
> At least it doesn't fix an issue that satisfy the criteria listed in
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

Then it should not be CC-ed to stable.

> 
> > 
> > 
> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > > > ---
> > > 
> > > You can put the note here, it won't be added to commit log when merged.
> > > Maybe it can be removed when merged.
> 
> Thanks for the suggestion! Shall I send a version to fix this problem or
> can I just bother the maintainer to remove it?

Better send a clean one, it will save maintainer's time, they can pick
it directly.

> 
> 
> > > 
> > > Otherwise, LGTM
> > > 
> > > Acked-by: Baoquan He <bhe@redhat.com>
> > > 
> > > >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> > > >  include/linux/kexec.h             |  7 +++++++
> > > >  kernel/kexec_file.c               | 17 +++++++++++++++++
> > > >  3 files changed, 25 insertions(+), 19 deletions(-)
> > > >
> > > > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > > > index 170d0fd68b1f..f299b48f9c9f 100644
> > > > --- a/arch/x86/kernel/kexec-bzimage64.c
> > > > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > > > @@ -17,7 +17,6 @@
> > > >  #include <linux/kernel.h>
> > > >  #include <linux/mm.h>
> > > >  #include <linux/efi.h>
> > > > -#include <linux/verification.h>
> > > >
> > > >  #include <asm/bootparam.h>
> > > >  #include <asm/setup.h>
> > > > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> > > >  	return 0;
> > > >  }
> > > >
> > > > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > > > -{
> > > > -	int ret;
> > > > -
> > > > -	ret = verify_pefile_signature(kernel, kernel_len,
> > > > -				      VERIFY_USE_SECONDARY_KEYRING,
> > > > -				      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > -		ret = verify_pefile_signature(kernel, kernel_len,
> > > > -					      VERIFY_USE_PLATFORM_KEYRING,
> > > > -					      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > -	}
> > > > -	return ret;
> > > > -}
> > > > -#endif
> > > > -
> > > >  const struct kexec_file_ops kexec_bzImage64_ops = {
> > > >  	.probe = bzImage64_probe,
> > > >  	.load = bzImage64_load,
> > > >  	.cleanup = bzImage64_cleanup,
> > > >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > -	.verify_sig = bzImage64_verify_sig,
> > > > +	.verify_sig = kexec_kernel_verify_pe_sig,
> > > >  #endif
> > > >  };
> > > > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > > > index 413235c6c797..da83abfc628b 100644
> > > > --- a/include/linux/kexec.h
> > > > +++ b/include/linux/kexec.h
> > > > @@ -19,6 +19,7 @@
> > > >  #include <asm/io.h>
> > > >
> > > >  #include <uapi/linux/kexec.h>
> > > > +#include <linux/verification.h>
> > > >
> > > >  /* Location of a reserved region to hold the crash kernel.
> > > >   */
> > > > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> > > >  				 const Elf_Shdr *relsec,
> > > >  				 const Elf_Shdr *symtab);
> > > >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > > > +#ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > > > +				    unsigned long kernel_len);
> > > > +#endif
> > > > +#endif
> > > >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> > > >
> > > >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > > > index 3720435807eb..754885b96aab 100644
> > > > --- a/kernel/kexec_file.c
> > > > +++ b/kernel/kexec_file.c
> > > > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> > > >  }
> > > >
> > > >  #ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > > > +{
> > > > +	int ret;
> > > > +
> > > > +	ret = verify_pefile_signature(kernel, kernel_len,
> > > > +				      VERIFY_USE_SECONDARY_KEYRING,
> > > > +				      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > +		ret = verify_pefile_signature(kernel, kernel_len,
> > > > +					      VERIFY_USE_PLATFORM_KEYRING,
> > > > +					      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > +	}
> > > > +	return ret;
> > > > +}
> > > > +#endif
> > > > +
> > > >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
> > > >  		unsigned long buf_len)
> > > >  {
> > > > --
> > > > 2.35.3
> > > >
> > > 
> > 
> 
> -- 
> Best regards,
> Coiby
> 

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 12:33pm, Coiby Xu wrote:
> On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
> > On 05/12/22 at 10:46am, Baoquan He wrote:
> > > On 05/12/22 at 10:34am, Coiby Xu wrote:
> > > > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > > > signature verify") adds platform keyring support on x86 kexec but not
> > > > arm64.
> > > >
> > > > The code in bzImage64_verify_sig makes use of system keyrings including
> > > > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > > > verify signed kernel image as PE file. Make it generic so both x86_64
> > > > and arm64 can use it.
> > > >
> > > > Note this patch is needed by a later patch so Cc it to the stable tree
> > > > as well.
> > > 
> > > This note should not be added in log.
> > > 
> > > >
> > > > Cc: kexec@lists.infradead.org
> > > > Cc: keyrings@vger.kernel.org
> > > > Cc: linux-security-module@vger.kernel.org
> > > > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> > 
> > Hold on, should we CC stable when it's not fixing an issue?
> > 
> > Hi Coiby,
> 
> Hi Baoquan,
> 
> > 
> > Just to make clear , is this patch fixing an issue, or it's just an
> > preparation for later patch's use?
> > 
> > Or I should ask in another way, any problem is solved with this patch?
> 
> At least it doesn't fix an issue that satisfy the criteria listed in
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

Then it should not be CC-ed to stable.

> 
> > 
> > 
> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > > > ---
> > > 
> > > You can put the note here, it won't be added to commit log when merged.
> > > Maybe it can be removed when merged.
> 
> Thanks for the suggestion! Shall I send a version to fix this problem or
> can I just bother the maintainer to remove it?

Better send a clean one, it will save maintainer's time, they can pick
it directly.

> 
> 
> > > 
> > > Otherwise, LGTM
> > > 
> > > Acked-by: Baoquan He <bhe@redhat.com>
> > > 
> > > >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> > > >  include/linux/kexec.h             |  7 +++++++
> > > >  kernel/kexec_file.c               | 17 +++++++++++++++++
> > > >  3 files changed, 25 insertions(+), 19 deletions(-)
> > > >
> > > > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > > > index 170d0fd68b1f..f299b48f9c9f 100644
> > > > --- a/arch/x86/kernel/kexec-bzimage64.c
> > > > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > > > @@ -17,7 +17,6 @@
> > > >  #include <linux/kernel.h>
> > > >  #include <linux/mm.h>
> > > >  #include <linux/efi.h>
> > > > -#include <linux/verification.h>
> > > >
> > > >  #include <asm/bootparam.h>
> > > >  #include <asm/setup.h>
> > > > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> > > >  	return 0;
> > > >  }
> > > >
> > > > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > > > -{
> > > > -	int ret;
> > > > -
> > > > -	ret = verify_pefile_signature(kernel, kernel_len,
> > > > -				      VERIFY_USE_SECONDARY_KEYRING,
> > > > -				      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > -		ret = verify_pefile_signature(kernel, kernel_len,
> > > > -					      VERIFY_USE_PLATFORM_KEYRING,
> > > > -					      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > -	}
> > > > -	return ret;
> > > > -}
> > > > -#endif
> > > > -
> > > >  const struct kexec_file_ops kexec_bzImage64_ops = {
> > > >  	.probe = bzImage64_probe,
> > > >  	.load = bzImage64_load,
> > > >  	.cleanup = bzImage64_cleanup,
> > > >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > -	.verify_sig = bzImage64_verify_sig,
> > > > +	.verify_sig = kexec_kernel_verify_pe_sig,
> > > >  #endif
> > > >  };
> > > > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > > > index 413235c6c797..da83abfc628b 100644
> > > > --- a/include/linux/kexec.h
> > > > +++ b/include/linux/kexec.h
> > > > @@ -19,6 +19,7 @@
> > > >  #include <asm/io.h>
> > > >
> > > >  #include <uapi/linux/kexec.h>
> > > > +#include <linux/verification.h>
> > > >
> > > >  /* Location of a reserved region to hold the crash kernel.
> > > >   */
> > > > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> > > >  				 const Elf_Shdr *relsec,
> > > >  				 const Elf_Shdr *symtab);
> > > >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > > > +#ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > > > +				    unsigned long kernel_len);
> > > > +#endif
> > > > +#endif
> > > >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> > > >
> > > >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > > > index 3720435807eb..754885b96aab 100644
> > > > --- a/kernel/kexec_file.c
> > > > +++ b/kernel/kexec_file.c
> > > > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> > > >  }
> > > >
> > > >  #ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > > > +{
> > > > +	int ret;
> > > > +
> > > > +	ret = verify_pefile_signature(kernel, kernel_len,
> > > > +				      VERIFY_USE_SECONDARY_KEYRING,
> > > > +				      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > +		ret = verify_pefile_signature(kernel, kernel_len,
> > > > +					      VERIFY_USE_PLATFORM_KEYRING,
> > > > +					      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > +	}
> > > > +	return ret;
> > > > +}
> > > > +#endif
> > > > +
> > > >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
> > > >  		unsigned long buf_len)
> > > >  {
> > > > --
> > > > 2.35.3
> > > >
> > > 
> > 
> 
> -- 
> Best regards,
> Coiby
> 


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Baoquan He]

On 05/12/22 at 12:33pm, Coiby Xu wrote:
> On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
> > On 05/12/22 at 10:46am, Baoquan He wrote:
> > > On 05/12/22 at 10:34am, Coiby Xu wrote:
> > > > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > > > signature verify") adds platform keyring support on x86 kexec but not
> > > > arm64.
> > > >
> > > > The code in bzImage64_verify_sig makes use of system keyrings including
> > > > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > > > verify signed kernel image as PE file. Make it generic so both x86_64
> > > > and arm64 can use it.
> > > >
> > > > Note this patch is needed by a later patch so Cc it to the stable tree
> > > > as well.
> > > 
> > > This note should not be added in log.
> > > 
> > > >
> > > > Cc: kexec at lists.infradead.org
> > > > Cc: keyrings at vger.kernel.org
> > > > Cc: linux-security-module at vger.kernel.org
> > > > Cc: stable at vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> > 
> > Hold on, should we CC stable when it's not fixing an issue?
> > 
> > Hi Coiby,
> 
> Hi Baoquan,
> 
> > 
> > Just to make clear , is this patch fixing an issue, or it's just an
> > preparation for later patch's use?
> > 
> > Or I should ask in another way, any problem is solved with this patch?
> 
> At least it doesn't fix an issue that satisfy the criteria listed in
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

Then it should not be CC-ed to stable.

> 
> > 
> > 
> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > > > ---
> > > 
> > > You can put the note here, it won't be added to commit log when merged.
> > > Maybe it can be removed when merged.
> 
> Thanks for the suggestion! Shall I send a version to fix this problem or
> can I just bother the maintainer to remove it?

Better send a clean one, it will save maintainer's time, they can pick
it directly.

> 
> 
> > > 
> > > Otherwise, LGTM
> > > 
> > > Acked-by: Baoquan He <bhe@redhat.com>
> > > 
> > > >  arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> > > >  include/linux/kexec.h             |  7 +++++++
> > > >  kernel/kexec_file.c               | 17 +++++++++++++++++
> > > >  3 files changed, 25 insertions(+), 19 deletions(-)
> > > >
> > > > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > > > index 170d0fd68b1f..f299b48f9c9f 100644
> > > > --- a/arch/x86/kernel/kexec-bzimage64.c
> > > > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > > > @@ -17,7 +17,6 @@
> > > >  #include <linux/kernel.h>
> > > >  #include <linux/mm.h>
> > > >  #include <linux/efi.h>
> > > > -#include <linux/verification.h>
> > > >
> > > >  #include <asm/bootparam.h>
> > > >  #include <asm/setup.h>
> > > > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> > > >  	return 0;
> > > >  }
> > > >
> > > > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > > > -{
> > > > -	int ret;
> > > > -
> > > > -	ret = verify_pefile_signature(kernel, kernel_len,
> > > > -				      VERIFY_USE_SECONDARY_KEYRING,
> > > > -				      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > -	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > -		ret = verify_pefile_signature(kernel, kernel_len,
> > > > -					      VERIFY_USE_PLATFORM_KEYRING,
> > > > -					      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > -	}
> > > > -	return ret;
> > > > -}
> > > > -#endif
> > > > -
> > > >  const struct kexec_file_ops kexec_bzImage64_ops = {
> > > >  	.probe = bzImage64_probe,
> > > >  	.load = bzImage64_load,
> > > >  	.cleanup = bzImage64_cleanup,
> > > >  #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > -	.verify_sig = bzImage64_verify_sig,
> > > > +	.verify_sig = kexec_kernel_verify_pe_sig,
> > > >  #endif
> > > >  };
> > > > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > > > index 413235c6c797..da83abfc628b 100644
> > > > --- a/include/linux/kexec.h
> > > > +++ b/include/linux/kexec.h
> > > > @@ -19,6 +19,7 @@
> > > >  #include <asm/io.h>
> > > >
> > > >  #include <uapi/linux/kexec.h>
> > > > +#include <linux/verification.h>
> > > >
> > > >  /* Location of a reserved region to hold the crash kernel.
> > > >   */
> > > > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> > > >  				 const Elf_Shdr *relsec,
> > > >  				 const Elf_Shdr *symtab);
> > > >  int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > > > +#ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > > > +				    unsigned long kernel_len);
> > > > +#endif
> > > > +#endif
> > > >  int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> > > >
> > > >  extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > > > index 3720435807eb..754885b96aab 100644
> > > > --- a/kernel/kexec_file.c
> > > > +++ b/kernel/kexec_file.c
> > > > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> > > >  }
> > > >
> > > >  #ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > > > +{
> > > > +	int ret;
> > > > +
> > > > +	ret = verify_pefile_signature(kernel, kernel_len,
> > > > +				      VERIFY_USE_SECONDARY_KEYRING,
> > > > +				      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > +	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > +		ret = verify_pefile_signature(kernel, kernel_len,
> > > > +					      VERIFY_USE_PLATFORM_KEYRING,
> > > > +					      VERIFYING_KEXEC_PE_SIGNATURE);
> > > > +	}
> > > > +	return ret;
> > > > +}
> > > > +#endif
> > > > +
> > > >  static int kexec_image_verify_sig(struct kimage *image, void *buf,
> > > >  		unsigned long buf_len)
> > > >  {
> > > > --
> > > > 2.35.3
> > > >
> > > 
> > 
> 
> -- 
> Best regards,
> Coiby
> 

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

On Thu, May 12, 2022 at 02:22:57PM +0800, Baoquan He wrote:
>On 05/12/22 at 12:33pm, Coiby Xu wrote:
[...]
>> > Just to make clear , is this patch fixing an issue, or it's just an
>> > preparation for later patch's use?
>> >
>> > Or I should ask in another way, any problem is solved with this patch?
>>
>> At least it doesn't fix an issue that satisfy the criteria listed in
>> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
>Then it should not be CC-ed to stable.

OK, I'll drop "CC:" in next version.

>
>>
>> >
>> >
>> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > > > ---
>> > >
>> > > You can put the note here, it won't be added to commit log when merged.
>> > > Maybe it can be removed when merged.
>>
>> Thanks for the suggestion! Shall I send a version to fix this problem or
>> can I just bother the maintainer to remove it?
>
>Better send a clean one, it will save maintainer's time, they can pick
>it directly.

Thanks for the confirmation! I'll simply delete them because,
1. these notes don't make sense anymore if I don't CC the patches to the stable
    tree 
2. I've explained in the cover letter the first two patches
    are the prerequisite patches for the 3rd patch.

-- 
Best regards,
Coiby

Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

On Thu, May 12, 2022 at 02:22:57PM +0800, Baoquan He wrote:
>On 05/12/22 at 12:33pm, Coiby Xu wrote:
[...]
>> > Just to make clear , is this patch fixing an issue, or it's just an
>> > preparation for later patch's use?
>> >
>> > Or I should ask in another way, any problem is solved with this patch?
>>
>> At least it doesn't fix an issue that satisfy the criteria listed in
>> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
>Then it should not be CC-ed to stable.

OK, I'll drop "CC:" in next version.

>
>>
>> >
>> >
>> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > > > ---
>> > >
>> > > You can put the note here, it won't be added to commit log when merged.
>> > > Maybe it can be removed when merged.
>>
>> Thanks for the suggestion! Shall I send a version to fix this problem or
>> can I just bother the maintainer to remove it?
>
>Better send a clean one, it will save maintainer's time, they can pick
>it directly.

Thanks for the confirmation! I'll simply delete them because,
1. these notes don't make sense anymore if I don't CC the patches to the stable
    tree 
2. I've explained in the cover letter the first two patches
    are the prerequisite patches for the 3rd patch.

-- 
Best regards,
Coiby


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic

[Coiby Xu]

On Thu, May 12, 2022 at 02:22:57PM +0800, Baoquan He wrote:
>On 05/12/22 at 12:33pm, Coiby Xu wrote:
[...]
>> > Just to make clear , is this patch fixing an issue, or it's just an
>> > preparation for later patch's use?
>> >
>> > Or I should ask in another way, any problem is solved with this patch?
>>
>> At least it doesn't fix an issue that satisfy the criteria listed in
>> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
>Then it should not be CC-ed to stable.

OK, I'll drop "CC:" in next version.

>
>>
>> >
>> >
>> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > > > ---
>> > >
>> > > You can put the note here, it won't be added to commit log when merged.
>> > > Maybe it can be removed when merged.
>>
>> Thanks for the suggestion! Shall I send a version to fix this problem or
>> can I just bother the maintainer to remove it?
>
>Better send a clean one, it will save maintainer's time, they can pick
>it directly.

Thanks for the confirmation! I'll simply delete them because,
1. these notes don't make sense anymore if I don't CC the patches to the stable
    tree 
2. I've explained in the cover letter the first two patches
    are the prerequisite patches for the 3rd patch.

-- 
Best regards,
Coiby