[RFC][PATCH 08/10] KEYS: Introduce load_uasym_keyring()

From: Roberto Sassu <roberto.sassu@huaweicloud.com>
To: dhowells@redhat.com, dwmw2@infradead.org,
	herbert@gondor.apana.org.au, davem@davemloft.net,
	jarkko@kernel.org, song@kernel.org, jolsa@kernel.org,
	ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
	martin.lau@linux.dev, yhs@fb.com, john.fastabend@gmail.com,
	kpsingh@kernel.org, sdf@google.com, haoluo@google.com,
	rostedt@goodmis.org, mhiramat@kernel.org, mykolal@fb.com,
	shuah@kernel.org
Cc: linux-kernel@vger.kernel.org, keyrings@vger.kernel.org,
	linux-crypto@vger.kernel.org, bpf@vger.kernel.org,
	linux-trace-kernel@vger.kernel.org,
	linux-kselftest@vger.kernel.org, pbrobinson@gmail.com,
	zbyszek@in.waw.pl, zohar@linux.ibm.com,
	linux-integrity@vger.kernel.org, paul@paul-moore.com,
	linux-security-module@vger.kernel.org, wiktor@metacode.biz,
	devel@lists.sequoia-pgp.org, gnupg-devel@gnupg.org,
	ebiggers@kernel.org, Jason@zx2c4.com, mail@maciej.szmigiero.name,
	antony@vennard.ch, konstantin@linuxfoundation.org,
	James.Bottomley@HansenPartnership.com,
	Roberto Sassu <roberto.sassu@huawei.com>
Subject: [RFC][PATCH 08/10] KEYS: Introduce load_uasym_keyring()
Date: Thu,  6 Jul 2023 16:42:21 +0200	[thread overview]
Message-ID: <20230706144225.1046544-9-roberto.sassu@huaweicloud.com> (raw)
In-Reply-To: <20230706144225.1046544-1-roberto.sassu@huaweicloud.com>

From: Roberto Sassu <roberto.sassu@huawei.com>

Preload user asymmetric keys from 'uasym_keys.bin', placed in certs/ of the
kernel source directory.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 certs/Kconfig               | 11 ++++++++++
 certs/Makefile              |  7 +++++++
 certs/system_certificates.S | 18 ++++++++++++++++
 certs/system_keyring.c      | 41 +++++++++++++++++++++++++++++++++++--
 4 files changed, 75 insertions(+), 2 deletions(-)

diff --git a/certs/Kconfig b/certs/Kconfig
index 1f109b07087..16bbf0f4bb6 100644
--- a/certs/Kconfig
+++ b/certs/Kconfig
@@ -138,4 +138,15 @@ config SYSTEM_BLACKLIST_AUTH_UPDATE
 	  keyring.  The PKCS#7 signature of the description is set in the key
 	  payload.  Blacklist keys cannot be removed.
 
+config UASYM_PRELOAD_PUBLIC_KEYS
+	bool "Preload user asymmetric keys"
+	depends on SYSTEM_TRUSTED_KEYRING
+	select UASYM_KEYS_SIGS
+	default n
+	help
+	  Load at boot time the user asymmetric keys from a reserved area
+	  (populated with the content of 'certs/uasym_keys.bin' provided at
+	  kernel build time), and add them to the built-in keyring. Invalid
+	  keys are ignored and the loading continues.
+
 endmenu
diff --git a/certs/Makefile b/certs/Makefile
index 799ad7b9e68..2e5be6668a6 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -22,6 +22,13 @@ $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
 
 targets += blacklist_hash_list
 
+ifdef CONFIG_UASYM_PRELOAD_PUBLIC_KEYS
+ifeq ($(shell ls $(srctree)/certs/uasym_keys.bin 2> /dev/null), $(srctree)/certs/uasym_keys.bin)
+AFLAGS_system_certificates.o += -DHAVE_UASYM_KEYRING_BLOB
+$(obj)/system_certificates.o: $(srctree)/certs/uasym_keys.bin
+endif
+endif
+
 quiet_cmd_extract_certs  = CERT    $@
       cmd_extract_certs  = $(obj)/extract-cert "$(extract-cert-in)" $@
 extract-cert-in = $(filter-out $(obj)/extract-cert, $(real-prereqs))
diff --git a/certs/system_certificates.S b/certs/system_certificates.S
index 003e25d4a17..67b7c5effb6 100644
--- a/certs/system_certificates.S
+++ b/certs/system_certificates.S
@@ -44,3 +44,21 @@ module_cert_size:
 #else
 	.long __module_cert_end - __module_cert_start
 #endif
+
+	.align 8
+	.globl uasym_keys
+uasym_keys:
+__uasym_key_list_start:
+#ifdef HAVE_UASYM_KEYRING_BLOB
+	.incbin "certs/uasym_keys.bin"
+#endif
+__uasym_key_list_end:
+
+	.align 8
+	.globl uasym_keys_size
+uasym_keys_size:
+#ifdef CONFIG_64BIT
+	.quad __uasym_key_list_end - __uasym_key_list_start
+#else
+	.long __uasym_key_list_end - __uasym_key_list_start
+#endif
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index dbee2e5b732..6035bd2f795 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -179,6 +179,31 @@ static __init int system_trusted_keyring_init(void)
 	return 0;
 }
 
+#ifdef CONFIG_UASYM_PRELOAD_PUBLIC_KEYS
+extern __initconst const u8 uasym_keys[];
+extern __initconst const unsigned long uasym_keys_size;
+
+/**
+ * load_uasym_keyring - Load user asymmetric keys from a keyring blob
+ *
+ * Load user asymmetric keys from a keyring blob. Halt the parsing if
+ * a parsing error is encountered. If parsing succeed, ignore invalid keys.
+ *
+ * Return: Zero on success or on failure (ignored).
+ */
+static __init int load_uasym_keyring(void)
+{
+	pr_notice("Loading compiled-in user asymmetric keys\n");
+
+	if (preload_uasym_keys(uasym_keys, uasym_keys_size,
+			       builtin_trusted_keys) < 0)
+		pr_err("Can't load user asymmetric keys\n");
+
+	return 0;
+}
+late_initcall(load_uasym_keyring);
+#endif /* CONFIG_UASYM_PRELOAD_PUBLIC_KEYS */
+
 /*
  * Must be initialised before we try and load the keys into the keyring.
  */
@@ -186,13 +211,25 @@ device_initcall(system_trusted_keyring_init);
 
 __init int load_module_cert(struct key *keyring)
 {
+	int ret;
+
 	if (!IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG))
 		return 0;
 
 	pr_notice("Loading compiled-in module X.509 certificates\n");
 
-	return x509_load_certificate_list(system_certificate_list,
-					  module_cert_size, keyring);
+	ret = x509_load_certificate_list(system_certificate_list,
+					 module_cert_size, keyring);
+#ifdef CONFIG_UASYM_PRELOAD_PUBLIC_KEYS
+	if (!ret) {
+		pr_notice("Loading compiled-in user asymmetric keys\n");
+
+		ret = preload_uasym_keys(uasym_keys, uasym_keys_size, keyring);
+		if (ret < 0)
+			pr_err("Can't load user asymmetric keys\n");
+	}
+#endif
+	return ret;
 }
 
 /*
-- 
2.34.1

