From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, kexec@lists.infradead.org,
keyrings@vger.kernel.org, linux-security-module@vger.kernel.org,
Michal Suchanek <msuchanek@suse.de>, Coiby Xu <coxu@redhat.com>,
Mimi Zohar <zohar@linux.ibm.com>
Subject: [PATCH 5.15 13/14] kexec, KEYS: make the code in bzImage64_verify_sig generic
Date: Fri, 19 Aug 2022 17:40:29 +0200 [thread overview]
Message-ID: <20220819153712.107081653@linuxfoundation.org> (raw)
In-Reply-To: <20220819153711.658766010@linuxfoundation.org>
From: Coiby Xu <coxu@redhat.com>
commit c903dae8941deb55043ee46ded29e84e97cd84bb upstream.
commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
signature verify") adds platform keyring support on x86 kexec but not
arm64.
The code in bzImage64_verify_sig uses the keys on the
.builtin_trusted_keys, .machine, if configured and enabled,
.secondary_trusted_keys, also if configured, and .platform keyrings
to verify the signed kernel image as PE file.
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
include/linux/kexec.h | 7 +++++++
kernel/kexec_file.c | 17 +++++++++++++++++
3 files changed, 25 insertions(+), 19 deletions(-)
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -17,7 +17,6 @@
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/efi.h>
-#include <linux/verification.h>
#include <asm/bootparam.h>
#include <asm/setup.h>
@@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loade
return 0;
}
-#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
-{
- int ret;
-
- ret = verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_SECONDARY_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
- if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
- ret = verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_PLATFORM_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
- }
- return ret;
-}
-#endif
-
const struct kexec_file_ops kexec_bzImage64_ops = {
.probe = bzImage64_probe,
.load = bzImage64_load,
.cleanup = bzImage64_cleanup,
#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
- .verify_sig = bzImage64_verify_sig,
+ .verify_sig = kexec_kernel_verify_pe_sig,
#endif
};
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -19,6 +19,7 @@
#include <asm/io.h>
#include <uapi/linux/kexec.h>
+#include <linux/verification.h>
#ifdef CONFIG_KEXEC_CORE
#include <linux/list.h>
@@ -206,6 +207,12 @@ static inline void *arch_kexec_kernel_im
}
#endif
+#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len);
+#endif
+#endif
+
extern int kexec_add_buffer(struct kexec_buf *kbuf);
int kexec_locate_mem_hole(struct kexec_buf *kbuf);
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -123,6 +123,23 @@ void kimage_file_post_load_cleanup(struc
}
#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
+{
+ int ret;
+
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ return ret;
+}
+#endif
+
static int kexec_image_verify_sig(struct kimage *image, void *buf,
unsigned long buf_len)
{
next prev parent reply other threads:[~2022-08-19 15:42 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-19 15:40 [PATCH 5.15 00/14] 5.15.62-rc1 review Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 01/14] io_uring: use original request task for inflight tracking Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 02/14] tee: add overflow check in register_shm_helper() Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 03/14] net_sched: cls_route: disallow handle of 0 Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 04/14] ksmbd: prevent out of bound read for SMB2_WRITE Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 05/14] ksmbd: fix heap-based overflow in set_ntacl_dacl() Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 06/14] Revert "x86/ftrace: Use alternative RET encoding" Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 07/14] x86/ibt,ftrace: Make function-graph play nice Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 08/14] x86/ftrace: Use alternative RET encoding Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 09/14] btrfs: only write the sectors in the vertical stripe which has data stripes Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 10/14] btrfs: raid56: dont trust any cached sector in __raid56_parity_recover() Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 11/14] kexec_file: drop weak attribute from functions Greg Kroah-Hartman
2022-08-19 15:40 ` [PATCH 5.15 12/14] kexec: clean up arch_kexec_kernel_verify_sig Greg Kroah-Hartman
2022-08-19 15:40 ` Greg Kroah-Hartman [this message]
2022-08-19 15:40 ` [PATCH 5.15 14/14] arm64: kexec_file: use more system keyrings to verify kernel image signature Greg Kroah-Hartman
2022-08-20 0:42 ` [PATCH 5.15 00/14] 5.15.62-rc1 review Shuah Khan
2022-08-20 8:27 ` Naresh Kamboju
2022-08-20 18:17 ` Greg Kroah-Hartman
2022-08-20 10:05 ` Bagas Sanjaya
2022-08-20 10:42 ` Sudip Mukherjee (Codethink)
2022-08-20 22:23 ` Ron Economos
2022-08-21 0:56 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220819153712.107081653@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=coxu@redhat.com \
--cc=kexec@lists.infradead.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=msuchanek@suse.de \
--cc=stable@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).