From: Varad Gautam <varad.gautam@suse.com>
To: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>,
David Howells <dhowells@redhat.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
"David S . Miller" <davem@davemloft.net>,
Ben Boeckel <me@benboeckel.net>,
Randy Dunlap <rdunlap@infradead.org>,
Malte Gell <malte.gell@gmx.de>,
keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-kernel@vger.kernel.org, "Lee, Chun-Yi" <jlee@suse.com>
Subject: Re: [PATCH 2/4] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification
Date: Thu, 15 Apr 2021 14:08:32 +0200 [thread overview]
Message-ID: <27e7e83b-5754-956c-c314-9d4d0ae605b0@suse.com> (raw)
In-Reply-To: <20210409024656.8083-3-jlee@suse.com>
Hi Joey,
On 4/9/21 4:46 AM, Lee, Chun-Yi wrote:
> This patch adds the logic for checking the CodeSigning extended
> key usage when verifying signature of kernel module or
> kexec PE binary in PKCS#7.
>
> Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
> ---
> certs/system_keyring.c | 2 +-
> crypto/asymmetric_keys/Kconfig | 9 +++++++++
> crypto/asymmetric_keys/pkcs7_trust.c | 37 +++++++++++++++++++++++++++++++++---
> include/crypto/pkcs7.h | 3 ++-
> 4 files changed, 46 insertions(+), 5 deletions(-)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 4b693da488f1..c9f8bca0b0d3 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -243,7 +243,7 @@ int verify_pkcs7_message_sig(const void *data, size_t len,
> goto error;
> }
> }
> - ret = pkcs7_validate_trust(pkcs7, trusted_keys);
> + ret = pkcs7_validate_trust(pkcs7, trusted_keys, usage);
> if (ret < 0) {
> if (ret == -ENOKEY)
> pr_devel("PKCS#7 signature not signed with a trusted key\n");
> diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
> index 1f1f004dc757..1754812df989 100644
> --- a/crypto/asymmetric_keys/Kconfig
> +++ b/crypto/asymmetric_keys/Kconfig
> @@ -96,4 +96,13 @@ config SIGNED_PE_FILE_VERIFICATION
> This option provides support for verifying the signature(s) on a
> signed PE binary.
>
> +config CHECK_CODESIGN_EKU
> + bool "Check codeSigning extended key usage"
> + depends on PKCS7_MESSAGE_PARSER=y
> + depends on SYSTEM_DATA_VERIFICATION
> + help
> + This option provides support for checking the codeSigning extended
> + key usage when verifying the signature in PKCS#7. It affects kernel
> + module verification and kexec PE binary verification.
> +
> endif # ASYMMETRIC_KEY_TYPE
> diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
> index b531df2013c4..077bfef928b6 100644
> --- a/crypto/asymmetric_keys/pkcs7_trust.c
> +++ b/crypto/asymmetric_keys/pkcs7_trust.c
> @@ -16,12 +16,36 @@
> #include <crypto/public_key.h>
> #include "pkcs7_parser.h"
>
> +#ifdef CONFIG_CHECK_CODESIGN_EKU
> +static bool check_codesign_eku(struct key *key,
> + enum key_being_used_for usage)
> +{
> + struct public_key *public_key = key->payload.data[asym_crypto];
> +
> + switch (usage) {
> + case VERIFYING_MODULE_SIGNATURE:
> + case VERIFYING_KEXEC_PE_SIGNATURE:
> + return !!(public_key->eku & EKU_codeSigning);
> + default:
> + break;
> + }
> + return true;
> +}
> +#else
> +static bool check_codesign_eku(struct key *key,
> + enum key_being_used_for usage)
> +{
> + return true;
> +}
> +#endif
> +
> /*
> * Check the trust on one PKCS#7 SignedInfo block.
> */
> static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
> struct pkcs7_signed_info *sinfo,
> - struct key *trust_keyring)
> + struct key *trust_keyring,
> + enum key_being_used_for usage)
> {
> struct public_key_signature *sig = sinfo->sig;
> struct x509_certificate *x509, *last = NULL, *p;
> @@ -112,6 +136,12 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
> return -ENOKEY;
>
> matched:
> + if (!check_codesign_eku(key, usage)) {
Perhaps this can be a generic check_eku_usage() call, with codesigning as one of the
things it can check for.
> + pr_warn("sinfo %u: The signer %x key is not CodeSigning\n",
> + sinfo->index, key_serial(key));
> + key_put(key);
> + return -ENOKEY;
> + }
> ret = verify_signature(key, sig);
> key_put(key);
> if (ret < 0) {
> @@ -156,7 +186,8 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
> * May also return -ENOMEM.
> */
> int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
> - struct key *trust_keyring)
> + struct key *trust_keyring,
> + enum key_being_used_for usage)
Please also update the comment above to mention the `usage` parameter.
Regards,
Varad
> {
> struct pkcs7_signed_info *sinfo;
> struct x509_certificate *p;
> @@ -167,7 +198,7 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
> p->seen = false;
>
> for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
> - ret = pkcs7_validate_trust_one(pkcs7, sinfo, trust_keyring);
> + ret = pkcs7_validate_trust_one(pkcs7, sinfo, trust_keyring, usage);
> switch (ret) {
> case -ENOKEY:
> continue;
> diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h
> index 38ec7f5f9041..b3b48240ba73 100644
> --- a/include/crypto/pkcs7.h
> +++ b/include/crypto/pkcs7.h
> @@ -30,7 +30,8 @@ extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
> * pkcs7_trust.c
> */
> extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
> - struct key *trust_keyring);
> + struct key *trust_keyring,
> + enum key_being_used_for usage);
>
> /*
> * pkcs7_verify.c
>
--
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5
90409 Nürnberg
Germany
HRB 36809, AG Nürnberg
Geschäftsführer: Felix Imendörffer
next prev parent reply other threads:[~2021-04-15 12:08 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-09 2:46 [PATCH v5 0/4] Check codeSigning extended key usage extension Lee, Chun-Yi
2021-04-09 2:46 ` [PATCH 1/4] X.509: Add CodeSigning extended key usage parsing Lee, Chun-Yi
2021-04-09 2:46 ` [PATCH 2/4] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification Lee, Chun-Yi
2021-04-15 12:08 ` Varad Gautam [this message]
2021-04-20 6:22 ` joeyli
2021-05-21 9:47 ` joeyli
2021-04-09 2:46 ` [PATCH 3/4] modsign: Add codeSigning EKU when generating X.509 key generation config Lee, Chun-Yi
2021-04-09 2:46 ` [PATCH 4/4] Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU Lee, Chun-Yi
-- strict thread matches above, loose matches on Subject: below --
2021-03-23 3:55 [PATCH v5 0/4] Check codeSigning extended key usage extension Lee, Chun-Yi
2021-03-23 3:55 ` [PATCH 2/4] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification Lee, Chun-Yi
2021-03-09 9:10 [PATCH v5 0/4] Check codeSigning extended key usage extension Lee, Chun-Yi
2021-03-09 9:10 ` [PATCH 2/4] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification Lee, Chun-Yi
2021-02-22 6:42 [PATCH v4 0/4] Check codeSigning extended key usage extension Lee, Chun-Yi
2021-02-22 6:42 ` [PATCH 2/4] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification Lee, Chun-Yi
2021-01-20 9:05 [PATCH v4 0/4] Check codeSigning extended key usage extension Lee, Chun-Yi
2021-01-20 9:05 ` [PATCH 2/4] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification Lee, Chun-Yi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=27e7e83b-5754-956c-c314-9d4d0ae605b0@suse.com \
--to=varad.gautam@suse.com \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=herbert@gondor.apana.org.au \
--cc=jlee@suse.com \
--cc=joeyli.kernel@gmail.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=malte.gell@gmx.de \
--cc=me@benboeckel.net \
--cc=rdunlap@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).