diff mbox series

integrity: support including firmware ".platform" keys at build time

Message ID 20210910172515.8430-1-nayna@linux.ibm.com (mailing list archive)
State New
Headers show
Series integrity: support including firmware ".platform" keys at build time | expand

Commit Message

Nayna Jain Sept. 10, 2021, 5:25 p.m. UTC 
Firmware keys are loaded on boot onto the ".platform" keyring. In addition,
allow firmware keys to be compiled into the kernel and loaded onto the
".platform" keyring.

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
---
 certs/Makefile                                |  3 ++-
 certs/blacklist.c                             |  1 -
 certs/common.c                                |  2 +-
 certs/common.h                                |  9 -------
 certs/system_keyring.c                        |  1 -
 include/keys/system_keyring.h                 |  3 +++
 security/integrity/Kconfig                    | 10 +++++++
 security/integrity/Makefile                   | 17 +++++++++++-
 security/integrity/digsig.c                   |  2 +-
 security/integrity/integrity.h                |  6 +++++
 .../integrity/platform_certs/platform_cert.S  | 23 ++++++++++++++++
 .../platform_certs/platform_keyring.c         | 26 +++++++++++++++++++
 12 files changed, 88 insertions(+), 15 deletions(-)
 delete mode 100644 certs/common.h
 create mode 100644 security/integrity/platform_certs/platform_cert.S

Comments

kernel test robot Sept. 10, 2021, 9:52 p.m. UTC | #1 
Hi Nayna,

I love your patch! Perhaps something to improve:

[auto build test WARNING on integrity/next-integrity]
[also build test WARNING on linus/master v5.14 next-20210910]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
base:   https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
config: nios2-defconfig (attached as .config)
compiler: nios2-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
        git checkout fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=nios2 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

   certs/common.c: In function 'load_certificate_list':
   certs/common.c:11:9: error: unknown type name 'key_ref_t'; did you mean 'key_ref_put'?
      11 |         key_ref_t key;
         |         ^~~~~~~~~
         |         key_ref_put
   certs/common.c:31:23: error: implicit declaration of function 'key_create_or_update' [-Werror=implicit-function-declaration]
      31 |                 key = key_create_or_update(make_key_ref(keyring, 1),
         |                       ^~~~~~~~~~~~~~~~~~~~
   certs/common.c:36:46: error: 'KEY_POS_ALL' undeclared (first use in this function)
      36 |                                            ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
         |                                              ^~~~~~~~~~~
   certs/common.c:36:46: note: each undeclared identifier is reported only once for each function it appears in
   certs/common.c:36:61: error: 'KEY_POS_SETATTR' undeclared (first use in this function)
      36 |                                            ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
         |                                                             ^~~~~~~~~~~~~~~
   certs/common.c:37:44: error: 'KEY_USR_VIEW' undeclared (first use in this function)
      37 |                                            KEY_USR_VIEW | KEY_USR_READ),
         |                                            ^~~~~~~~~~~~
   certs/common.c:37:59: error: 'KEY_USR_READ' undeclared (first use in this function)
      37 |                                            KEY_USR_VIEW | KEY_USR_READ),
         |                                                           ^~~~~~~~~~~~
   certs/common.c:38:44: error: 'KEY_ALLOC_NOT_IN_QUOTA' undeclared (first use in this function)
      38 |                                            KEY_ALLOC_NOT_IN_QUOTA |
         |                                            ^~~~~~~~~~~~~~~~~~~~~~
   certs/common.c:39:44: error: 'KEY_ALLOC_BUILT_IN' undeclared (first use in this function)
      39 |                                            KEY_ALLOC_BUILT_IN |
         |                                            ^~~~~~~~~~~~~~~~~~
   certs/common.c:40:44: error: 'KEY_ALLOC_BYPASS_RESTRICTION' undeclared (first use in this function)
      40 |                                            KEY_ALLOC_BYPASS_RESTRICTION);
         |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> certs/common.c:41:28: warning: passing argument 1 of 'IS_ERR' makes pointer from integer without a cast [-Wint-conversion]
      41 |                 if (IS_ERR(key)) {
         |                            ^~~
         |                            |
         |                            int
   In file included from include/linux/rwsem.h:18,
                    from include/linux/key.h:18,
                    from certs/common.c:4:
   include/linux/err.h:34:60: note: expected 'const void *' but argument is of type 'int'
      34 | static inline bool __must_check IS_ERR(__force const void *ptr)
         |                                                ~~~~~~~~~~~~^~~
   In file included from include/linux/kernel.h:19,
                    from certs/common.c:3:
>> certs/common.c:43:40: warning: passing argument 1 of 'PTR_ERR' makes pointer from integer without a cast [-Wint-conversion]
      43 |                                PTR_ERR(key));
         |                                        ^~~
         |                                        |
         |                                        int
   include/linux/printk.h:390:40: note: in definition of macro 'pr_err'
     390 |         printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
         |                                        ^~~~~~~~~~~
   In file included from include/linux/rwsem.h:18,
                    from include/linux/key.h:18,
                    from certs/common.c:4:
   include/linux/err.h:29:61: note: expected 'const void *' but argument is of type 'int'
      29 | static inline long __must_check PTR_ERR(__force const void *ptr)
         |                                                 ~~~~~~~~~~~~^~~
   In file included from include/linux/kernel.h:19,
                    from certs/common.c:3:
>> certs/common.c:46:54: warning: dereferencing 'void *' pointer
      46 |                                   key_ref_to_ptr(key)->description);
         |                                                      ^~
   include/linux/printk.h:410:43: note: in definition of macro 'pr_notice'
     410 |         printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
         |                                           ^~~~~~~~~~~
   certs/common.c:46:54: error: request for member 'description' in something not a structure or union
      46 |                                   key_ref_to_ptr(key)->description);
         |                                                      ^~
   include/linux/printk.h:410:43: note: in definition of macro 'pr_notice'
     410 |         printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
         |                                           ^~~~~~~~~~~
   cc1: some warnings being treated as errors


vim +/IS_ERR +41 certs/common.c

2565ca7f5ec1a9 Eric Snowberg 2021-01-22   6  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   7  int load_certificate_list(const u8 cert_list[],
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   8  			  const unsigned long list_size,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   9  			  const struct key *keyring)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  10  {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  11  	key_ref_t key;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  12  	const u8 *p, *end;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  13  	size_t plen;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  14  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  15  	p = cert_list;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  16  	end = p + list_size;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  17  	while (p < end) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  18  		/* Each cert begins with an ASN.1 SEQUENCE tag and must be more
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  19  		 * than 256 bytes in size.
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  20  		 */
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  21  		if (end - p < 4)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  22  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  23  		if (p[0] != 0x30 &&
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  24  		    p[1] != 0x82)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  25  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  26  		plen = (p[2] << 8) | p[3];
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  27  		plen += 4;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  28  		if (plen > end - p)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  29  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  30  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  31  		key = key_create_or_update(make_key_ref(keyring, 1),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  32  					   "asymmetric",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  33  					   NULL,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  34  					   p,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  35  					   plen,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  36  					   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  37  					   KEY_USR_VIEW | KEY_USR_READ),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  38  					   KEY_ALLOC_NOT_IN_QUOTA |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  39  					   KEY_ALLOC_BUILT_IN |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  40  					   KEY_ALLOC_BYPASS_RESTRICTION);
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @41  		if (IS_ERR(key)) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  42  			pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @43  			       PTR_ERR(key));
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  44  		} else {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  45  			pr_notice("Loaded X.509 cert '%s'\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @46  				  key_ref_to_ptr(key)->description);

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
kernel test robot Sept. 11, 2021, 12:53 a.m. UTC | #2 
Hi Nayna,

I love your patch! Yet something to improve:

[auto build test ERROR on integrity/next-integrity]
[also build test ERROR on linus/master v5.14 next-20210910]
[cannot apply to security/next-testing]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
base:   https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
config: i386-randconfig-a003-20210910 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 261cbe98c38f8c1ee1a482fe76511110e790f58a)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
        git checkout fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        # save the attached .config to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross O=build_dir ARCH=i386 SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All error/warnings (new ones prefixed by >>):

>> certs/common.c:11:2: error: unknown type name 'key_ref_t'; did you mean 'key_perm_t'?
           key_ref_t key;
           ^~~~~~~~~
           key_perm_t
   include/linux/key.h:31:18: note: 'key_perm_t' declared here
   typedef uint32_t key_perm_t;
                    ^
>> certs/common.c:31:9: error: implicit declaration of function 'key_create_or_update' [-Werror,-Wimplicit-function-declaration]
                   key = key_create_or_update(make_key_ref(keyring, 1),
                         ^
>> certs/common.c:36:11: error: use of undeclared identifier 'KEY_POS_ALL'
                                              ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
                                                ^
>> certs/common.c:36:26: error: use of undeclared identifier 'KEY_POS_SETATTR'
                                              ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
                                                               ^
>> certs/common.c:37:9: error: use of undeclared identifier 'KEY_USR_VIEW'
                                              KEY_USR_VIEW | KEY_USR_READ),
                                              ^
>> certs/common.c:37:24: error: use of undeclared identifier 'KEY_USR_READ'
                                              KEY_USR_VIEW | KEY_USR_READ),
                                                             ^
>> certs/common.c:38:9: error: use of undeclared identifier 'KEY_ALLOC_NOT_IN_QUOTA'
                                              KEY_ALLOC_NOT_IN_QUOTA |
                                              ^
>> certs/common.c:39:9: error: use of undeclared identifier 'KEY_ALLOC_BUILT_IN'
                                              KEY_ALLOC_BUILT_IN |
                                              ^
>> certs/common.c:40:9: error: use of undeclared identifier 'KEY_ALLOC_BYPASS_RESTRICTION'
                                              KEY_ALLOC_BYPASS_RESTRICTION);
                                              ^
>> certs/common.c:41:14: warning: incompatible integer to pointer conversion passing 'key_perm_t' (aka 'unsigned int') to parameter of type 'const void *' [-Wint-conversion]
                   if (IS_ERR(key)) {
                              ^~~
   include/linux/err.h:34:60: note: passing argument to parameter 'ptr' here
   static inline bool __must_check IS_ERR(__force const void *ptr)
                                                              ^
   certs/common.c:43:19: warning: incompatible integer to pointer conversion passing 'key_perm_t' (aka 'unsigned int') to parameter of type 'const void *' [-Wint-conversion]
                                  PTR_ERR(key));
                                          ^~~
   include/linux/printk.h:390:33: note: expanded from macro 'pr_err'
           printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
                                          ^~~~~~~~~~~
   include/linux/err.h:29:61: note: passing argument to parameter 'ptr' here
   static inline long __must_check PTR_ERR(__force const void *ptr)
                                                               ^
>> certs/common.c:46:26: error: member reference base type 'void' is not a structure or union
                                     key_ref_to_ptr(key)->description);
                                     ~~~~~~~~~~~~~~~~~~~^ ~~~~~~~~~~~
   include/linux/printk.h:410:36: note: expanded from macro 'pr_notice'
           printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
                                             ^~~~~~~~~~~
   2 warnings and 10 errors generated.


vim +11 certs/common.c

2565ca7f5ec1a9 Eric Snowberg 2021-01-22   6  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   7  int load_certificate_list(const u8 cert_list[],
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   8  			  const unsigned long list_size,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   9  			  const struct key *keyring)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  10  {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @11  	key_ref_t key;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  12  	const u8 *p, *end;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  13  	size_t plen;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  14  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  15  	p = cert_list;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  16  	end = p + list_size;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  17  	while (p < end) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  18  		/* Each cert begins with an ASN.1 SEQUENCE tag and must be more
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  19  		 * than 256 bytes in size.
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  20  		 */
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  21  		if (end - p < 4)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  22  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  23  		if (p[0] != 0x30 &&
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  24  		    p[1] != 0x82)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  25  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  26  		plen = (p[2] << 8) | p[3];
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  27  		plen += 4;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  28  		if (plen > end - p)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  29  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  30  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @31  		key = key_create_or_update(make_key_ref(keyring, 1),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  32  					   "asymmetric",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  33  					   NULL,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  34  					   p,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  35  					   plen,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @36  					   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @37  					   KEY_USR_VIEW | KEY_USR_READ),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @38  					   KEY_ALLOC_NOT_IN_QUOTA |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @39  					   KEY_ALLOC_BUILT_IN |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @40  					   KEY_ALLOC_BYPASS_RESTRICTION);
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @41  		if (IS_ERR(key)) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  42  			pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  43  			       PTR_ERR(key));
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  44  		} else {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  45  			pr_notice("Loaded X.509 cert '%s'\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @46  				  key_ref_to_ptr(key)->description);

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
kernel test robot Sept. 11, 2021, 4:29 p.m. UTC | #3 
Hi Nayna,

I love your patch! Yet something to improve:

[auto build test ERROR on integrity/next-integrity]
[also build test ERROR on linus/master v5.14 next-20210910]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
base:   https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
config: arc-randconfig-r015-20210911 (attached as .config)
compiler: arceb-elf-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
        git checkout fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=arc 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All error/warnings (new ones prefixed by >>):

   certs/common.c: In function 'load_certificate_list':
   certs/common.c:11:9: error: unknown type name 'key_ref_t'; did you mean 'key_ref_put'?
      11 |         key_ref_t key;
         |         ^~~~~~~~~
         |         key_ref_put
>> certs/common.c:31:23: error: implicit declaration of function 'key_create_or_update' [-Werror=implicit-function-declaration]
      31 |                 key = key_create_or_update(make_key_ref(keyring, 1),
         |                       ^~~~~~~~~~~~~~~~~~~~
>> certs/common.c:36:46: error: 'KEY_POS_ALL' undeclared (first use in this function)
      36 |                                            ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
         |                                              ^~~~~~~~~~~
   certs/common.c:36:46: note: each undeclared identifier is reported only once for each function it appears in
>> certs/common.c:36:61: error: 'KEY_POS_SETATTR' undeclared (first use in this function)
      36 |                                            ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
         |                                                             ^~~~~~~~~~~~~~~
>> certs/common.c:37:44: error: 'KEY_USR_VIEW' undeclared (first use in this function)
      37 |                                            KEY_USR_VIEW | KEY_USR_READ),
         |                                            ^~~~~~~~~~~~
>> certs/common.c:37:59: error: 'KEY_USR_READ' undeclared (first use in this function)
      37 |                                            KEY_USR_VIEW | KEY_USR_READ),
         |                                                           ^~~~~~~~~~~~
>> certs/common.c:38:44: error: 'KEY_ALLOC_NOT_IN_QUOTA' undeclared (first use in this function)
      38 |                                            KEY_ALLOC_NOT_IN_QUOTA |
         |                                            ^~~~~~~~~~~~~~~~~~~~~~
>> certs/common.c:39:44: error: 'KEY_ALLOC_BUILT_IN' undeclared (first use in this function)
      39 |                                            KEY_ALLOC_BUILT_IN |
         |                                            ^~~~~~~~~~~~~~~~~~
>> certs/common.c:40:44: error: 'KEY_ALLOC_BYPASS_RESTRICTION' undeclared (first use in this function)
      40 |                                            KEY_ALLOC_BYPASS_RESTRICTION);
         |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> certs/common.c:41:28: warning: passing argument 1 of 'IS_ERR' makes pointer from integer without a cast [-Wint-conversion]
      41 |                 if (IS_ERR(key)) {
         |                            ^~~
         |                            |
         |                            int
   In file included from include/linux/rwsem.h:18,
                    from include/linux/key.h:18,
                    from certs/common.c:4:
   include/linux/err.h:34:60: note: expected 'const void *' but argument is of type 'int'
      34 | static inline bool __must_check IS_ERR(__force const void *ptr)
         |                                                ~~~~~~~~~~~~^~~
   In file included from include/linux/kernel.h:19,
                    from certs/common.c:3:
>> certs/common.c:43:40: warning: passing argument 1 of 'PTR_ERR' makes pointer from integer without a cast [-Wint-conversion]
      43 |                                PTR_ERR(key));
         |                                        ^~~
         |                                        |
         |                                        int
   include/linux/printk.h:390:40: note: in definition of macro 'pr_err'
     390 |         printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
         |                                        ^~~~~~~~~~~
   In file included from include/linux/rwsem.h:18,
                    from include/linux/key.h:18,
                    from certs/common.c:4:
   include/linux/err.h:29:61: note: expected 'const void *' but argument is of type 'int'
      29 | static inline long __must_check PTR_ERR(__force const void *ptr)
         |                                                 ~~~~~~~~~~~~^~~
   In file included from include/linux/kernel.h:19,
                    from certs/common.c:3:
>> certs/common.c:46:54: warning: dereferencing 'void *' pointer
      46 |                                   key_ref_to_ptr(key)->description);
         |                                                      ^~
   include/linux/printk.h:410:43: note: in definition of macro 'pr_notice'
     410 |         printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
         |                                           ^~~~~~~~~~~
>> certs/common.c:46:54: error: request for member 'description' in something not a structure or union
      46 |                                   key_ref_to_ptr(key)->description);
         |                                                      ^~
   include/linux/printk.h:410:43: note: in definition of macro 'pr_notice'
     410 |         printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
         |                                           ^~~~~~~~~~~
   cc1: some warnings being treated as errors


vim +/key_create_or_update +31 certs/common.c

2565ca7f5ec1a9 Eric Snowberg 2021-01-22   6  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   7  int load_certificate_list(const u8 cert_list[],
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   8  			  const unsigned long list_size,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   9  			  const struct key *keyring)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  10  {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  11  	key_ref_t key;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  12  	const u8 *p, *end;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  13  	size_t plen;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  14  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  15  	p = cert_list;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  16  	end = p + list_size;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  17  	while (p < end) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  18  		/* Each cert begins with an ASN.1 SEQUENCE tag and must be more
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  19  		 * than 256 bytes in size.
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  20  		 */
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  21  		if (end - p < 4)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  22  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  23  		if (p[0] != 0x30 &&
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  24  		    p[1] != 0x82)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  25  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  26  		plen = (p[2] << 8) | p[3];
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  27  		plen += 4;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  28  		if (plen > end - p)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  29  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  30  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @31  		key = key_create_or_update(make_key_ref(keyring, 1),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  32  					   "asymmetric",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  33  					   NULL,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  34  					   p,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  35  					   plen,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @36  					   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @37  					   KEY_USR_VIEW | KEY_USR_READ),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @38  					   KEY_ALLOC_NOT_IN_QUOTA |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @39  					   KEY_ALLOC_BUILT_IN |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @40  					   KEY_ALLOC_BYPASS_RESTRICTION);
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @41  		if (IS_ERR(key)) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  42  			pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @43  			       PTR_ERR(key));
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  44  		} else {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  45  			pr_notice("Loaded X.509 cert '%s'\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @46  				  key_ref_to_ptr(key)->description);

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Jarkko Sakkinen Sept. 13, 2021, 7:37 p.m. UTC | #4 
On Fri, 2021-09-10 at 13:25 -0400, Nayna Jain wrote:
> Firmware keys are loaded on boot onto the ".platform" keyring. In addition,
> allow firmware keys to be compiled into the kernel and loaded onto the
> ".platform" keyring.
> 
> Signed-off-by: Nayna Jain <nayna@linux.ibm.com>

Lacks completely use case/application.

/Jarkko
diff mbox series

Patch

diff --git a/certs/Makefile b/certs/Makefile
index 359239a0ee9e..29765d0aefbb 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -3,7 +3,8 @@ 
 # Makefile for the linux kernel signature checking certificates.
 #
 
-obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
+obj-y	+= common.o
+obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o
 obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
 obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
 ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),"")
diff --git a/certs/blacklist.c b/certs/blacklist.c
index c9a435b15af4..b95e9b19c42f 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -17,7 +17,6 @@ 
 #include <linux/uidgid.h>
 #include <keys/system_keyring.h>
 #include "blacklist.h"
-#include "common.h"
 
 static struct key *blacklist_keyring;
 
diff --git a/certs/common.c b/certs/common.c
index 16a220887a53..41f763415a00 100644
--- a/certs/common.c
+++ b/certs/common.c
@@ -2,7 +2,7 @@ 
 
 #include <linux/kernel.h>
 #include <linux/key.h>
-#include "common.h"
+#include <keys/system_keyring.h>
 
 int load_certificate_list(const u8 cert_list[],
 			  const unsigned long list_size,
diff --git a/certs/common.h b/certs/common.h
deleted file mode 100644
index abdb5795936b..000000000000
--- a/certs/common.h
+++ /dev/null
@@ -1,9 +0,0 @@ 
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-
-#ifndef _CERT_COMMON_H
-#define _CERT_COMMON_H
-
-int load_certificate_list(const u8 cert_list[], const unsigned long list_size,
-			  const struct key *keyring);
-
-#endif
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 692365dee2bd..d130d5a96e09 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -16,7 +16,6 @@ 
 #include <keys/asymmetric-type.h>
 #include <keys/system_keyring.h>
 #include <crypto/pkcs7.h>
-#include "common.h"
 
 static struct key *builtin_trusted_keys;
 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 6acd3cf13a18..842d770b2a46 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -10,6 +10,9 @@ 
 
 #include <linux/key.h>
 
+extern int load_certificate_list(const u8 cert_list[],
+				 const unsigned long list_size,
+				 const struct key *keyring);
 #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
 
 extern int restrict_link_by_builtin_trusted(struct key *keyring,
diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
index 71f0177e8716..b2009b792882 100644
--- a/security/integrity/Kconfig
+++ b/security/integrity/Kconfig
@@ -62,6 +62,16 @@  config INTEGRITY_PLATFORM_KEYRING
          provided by the platform for verifying the kexec'ed kerned image
          and, possibly, the initramfs signature.
 
+config INTEGRITY_PLATFORM_BUILTIN_KEYS
+        string "Builtin X.509 keys for .platform keyring"
+        depends on KEYS
+        depends on ASYMMETRIC_KEY_TYPE
+        depends on INTEGRITY_PLATFORM_KEYRING
+        help
+          If set, this option should be the filename of a PEM-formatted file
+          containing X.509 certificates to be loaded onto the ".platform"
+          keyring.
+
 config LOAD_UEFI_KEYS
        depends on INTEGRITY_PLATFORM_KEYRING
        depends on EFI
diff --git a/security/integrity/Makefile b/security/integrity/Makefile
index 7ee39d66cf16..a45f083589b8 100644
--- a/security/integrity/Makefile
+++ b/security/integrity/Makefile
@@ -3,13 +3,18 @@ 
 # Makefile for caching inode integrity data (iint)
 #
 
+quiet_cmd_extract_certs  = EXTRACT_CERTS   $(patsubst "%",%,$(2))
+      cmd_extract_certs  = scripts/extract-cert $(2) $@
+$(eval $(call config_filename,INTEGRITY_PLATFORM_BUILTIN_KEYS))
+
 obj-$(CONFIG_INTEGRITY) += integrity.o
 
 integrity-y := iint.o
 integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o
 integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o
 integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o
-integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o
+integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o \
+						  platform_certs/platform_cert.o
 integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \
 				      platform_certs/load_uefi.o \
 				      platform_certs/keyring_handler.o
@@ -19,3 +24,13 @@  integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \
                                      platform_certs/keyring_handler.o
 obj-$(CONFIG_IMA)			+= ima/
 obj-$(CONFIG_EVM)			+= evm/
+
+
+$(obj)/platform_certs/platform_cert.o: $(obj)/platform_certs/platform_certificate_list
+
+targets += platform_certificate_list
+
+$(obj)/platform_certs/platform_certificate_list: scripts/extract-cert $(INTEGRITY_PLATFORM_BUILTIN_KEYS_FILENAME) FORCE
+	$(call if_changed,extract_certs,$(CONFIG_INTEGRITY_PLATFORM_BUILTIN_KEYS))
+
+clean-files := platform_certs/platform_certificate_list
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 3b06a01bd0fd..0ea40ed8dfcb 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -38,7 +38,7 @@  static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = {
 #define restrict_link_to_ima restrict_link_by_builtin_trusted
 #endif
 
-static struct key *integrity_keyring_from_id(const unsigned int id)
+struct key *integrity_keyring_from_id(const unsigned int id)
 {
 	if (id >= INTEGRITY_KEYRING_MAX)
 		return ERR_PTR(-EINVAL);
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 547425c20e11..feb84e1b1105 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -167,6 +167,7 @@  int __init integrity_init_keyring(const unsigned int id);
 int __init integrity_load_x509(const unsigned int id, const char *path);
 int __init integrity_load_cert(const unsigned int id, const char *source,
 			       const void *data, size_t len, key_perm_t perm);
+struct key *integrity_keyring_from_id(const unsigned int id);
 #else
 
 static inline int integrity_digsig_verify(const unsigned int id,
@@ -194,6 +195,11 @@  static inline int __init integrity_load_cert(const unsigned int id,
 {
 	return 0;
 }
+
+static inline struct key *integrity_keyring_from_id(const unsigned int id)
+{
+	return ERR_PTR(-EOPNOTSUPP);
+}
 #endif /* CONFIG_INTEGRITY_SIGNATURE */
 
 #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
diff --git a/security/integrity/platform_certs/platform_cert.S b/security/integrity/platform_certs/platform_cert.S
new file mode 100644
index 000000000000..20bccce5dc5a
--- /dev/null
+++ b/security/integrity/platform_certs/platform_cert.S
@@ -0,0 +1,23 @@ 
+/* SPDX-License-Identifier: GPL-2.0 */
+#include <linux/export.h>
+#include <linux/init.h>
+
+	__INITRODATA
+
+	.align 8
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+	.globl platform_certificate_list
+platform_certificate_list:
+__cert_list_start:
+	.incbin "security/integrity/platform_certs/platform_certificate_list"
+__cert_list_end:
+#endif
+
+	.align 8
+	.globl platform_certificate_list_size
+platform_certificate_list_size:
+#ifdef CONFIG_64BIT
+	.quad __cert_list_end - __cert_list_start
+#else
+	.long __cert_list_end - __cert_list_start
+#endif
diff --git a/security/integrity/platform_certs/platform_keyring.c b/security/integrity/platform_certs/platform_keyring.c
index bcafd7387729..17535050d08d 100644
--- a/security/integrity/platform_certs/platform_keyring.c
+++ b/security/integrity/platform_certs/platform_keyring.c
@@ -12,8 +12,12 @@ 
 #include <linux/cred.h>
 #include <linux/err.h>
 #include <linux/slab.h>
+#include <keys/system_keyring.h>
 #include "../integrity.h"
 
+extern __initconst const u8 platform_certificate_list[];
+extern __initconst const unsigned long platform_certificate_list_size;
+
 /**
  * add_to_platform_keyring - Add to platform keyring without validation.
  * @source: Source of key
@@ -37,6 +41,28 @@  void __init add_to_platform_keyring(const char *source, const void *data,
 		pr_info("Error adding keys to platform keyring %s\n", source);
 }
 
+static __init int load_builtin_platform_cert(void)
+{
+	const u8 *p;
+	unsigned long size;
+	int rc;
+	struct key *keyring;
+
+	p = platform_certificate_list;
+	size = platform_certificate_list_size;
+
+	keyring = integrity_keyring_from_id(INTEGRITY_KEYRING_PLATFORM);
+	if (IS_ERR(keyring))
+		return PTR_ERR(keyring);
+
+	rc = load_certificate_list(p, size, keyring);
+	if (rc)
+		pr_info("Error adding keys to platform keyring %d\n", rc);
+
+	return rc;
+}
+late_initcall(load_builtin_platform_cert);
+
 /*
  * Create the trusted keyrings.
  */