From patchwork Sat Dec 30 17:58:01 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Aloni X-Patchwork-Id: 10137857 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8AF9660375 for ; Sat, 30 Dec 2017 17:58:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7B2C2287A1 for ; Sat, 30 Dec 2017 17:58:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 70097287B5; Sat, 30 Dec 2017 17:58:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, URIBL_BLACK autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 9B858287A1 for ; Sat, 30 Dec 2017 17:58:44 +0000 (UTC) Received: (qmail 15549 invoked by uid 550); 30 Dec 2017 17:58:25 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 14225 invoked from network); 30 Dec 2017 17:58:22 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernelim-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=pkeuyNKL89KgMBsR61J3TsHgYwKBPYf2qj4JCKR6cu0=; b=DC7XlbXBeqDVSSyiEBD/mMI9ED50NPUEWmjPQoURVOwz1tWrryjVGEkD+BCUxPCZbu k34tZszDjDHSMWObjO8BqRt7FAqoO2utt+XEd2HOFDJxqLbQxYqffHhN/UPLLjJSLMpD VuZAsXFIW7fQ1YCwZe5S06yfzk16d0V63G9skgYdrr9DGFVbbu4FogJzDeif8fgcbUlT n32H1vZW6obePJE95hcFbyDuEioq8gquO/3t5TA5gpTLh+g8Ac1ElCoMtNGMqAFAVPsU 6fydfg6eSZWL6jor6KZwTbCpkrWGkAiU1OvZyx7aH6xMembbUOh0BiaZNAeNeVAmc436 DVnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=pkeuyNKL89KgMBsR61J3TsHgYwKBPYf2qj4JCKR6cu0=; b=dysDI7HhyfIrid8UHKTUg3XS84RL15EVC3+GuaIl6Qhn6TPcby1meRDR3+AyPxgXGT ZxWfTufVuvnoRVgnYmY293ZFtz12sOlrujeZ1LohTPgexcGH7jGu6xpAf/IfdqYiaHVK FCpQPo31JyxFbOTidclHq1/IrQ+GqM0VM7lnTH9mkiopg1dmSabXXIKXOCKyzm/PM1mG 3F6/itcTC0Wdt9/pxp+K6UtcI1rS/torcoaIOKvBrIPA9pkR4Ia+Ck9oVCvaICfA9zra uJenmpJtepl9Mju5zVidpfyt6sYlTVV/Ns99ehtqWdAu79dF1fVZd2oqjM8JJxBB4axz o62g== X-Gm-Message-State: AKGB3mIO/gSWI9hYmxuUtSw+I1c2WSc3JT+alUe+EHSHjR7edpTWDwMB b+dyOWO6mnUTgICDilxWP9mE0hfs X-Google-Smtp-Source: ACJfBos9Ib8nQc9U4537UNoCOSy8AaVOM1n+pQ/udB4DqGIV3D1GY4ftqXXJ9J02yV7NjLYmzeFW2w== X-Received: by 10.28.55.82 with SMTP id e79mr29475187wma.60.1514656691494; Sat, 30 Dec 2017 09:58:11 -0800 (PST) From: Dan Aloni X-Google-Original-From: Dan Aloni To: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Cc: Dan Aloni Date: Sat, 30 Dec 2017 19:58:01 +0200 Message-Id: <20171230175804.7354-3-alonid@gmail.com> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171230175804.7354-1-alonid@gmail.com> References: <20171230175804.7354-1-alonid@gmail.com> Subject: [kernel-hardening] [PATCH 2/5] certs: allow in-kernel access of trusted keys X-Virus-Scanned: ClamAV using ClamSMTP From: Dan Aloni Signed-off-by: Dan Aloni --- certs/system_keyring.c | 56 ++++++++++++++++++++++++++++++++++++++++++- include/keys/system_keyring.h | 3 +++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 6251d1b27f0c..ff7c18d8e67c 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -131,6 +131,8 @@ static __init int system_trusted_keyring_init(void) */ device_initcall(system_trusted_keyring_init); +static char *first_asymmetric_key_description; + /* * Load the compiled-in list of X.509 certificates. */ @@ -172,8 +174,11 @@ static __init int load_system_certificate_list(void) pr_err("Problem loading in-kernel X.509 certificate (%ld)\n", PTR_ERR(key)); } else { + first_asymmetric_key_description = + kstrdup(key_ref_to_ptr(key)->description, + GFP_KERNEL); pr_notice("Loaded X.509 cert '%s'\n", - key_ref_to_ptr(key)->description); + first_asymmetric_key_description); key_ref_put(key); } p += plen; @@ -265,3 +270,52 @@ int verify_pkcs7_signature(const void *data, size_t len, EXPORT_SYMBOL_GPL(verify_pkcs7_signature); #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ + +/** + * get_first_asymmetric_key - Find a key by ID. + * @keyring: The keys to search. + * + * Return the first assymmetric key in a keyring. + */ +static struct key *get_first_asymmetric_key(struct key *keyring) +{ + key_ref_t ref; + + ref = keyring_search(make_key_ref(keyring, 1), + &key_type_asymmetric, + first_asymmetric_key_description); + if (IS_ERR(ref)) { + switch (PTR_ERR(ref)) { + case -EACCES: + case -ENOTDIR: + case -EAGAIN: + return ERR_PTR(-ENOKEY); + default: + return ERR_CAST(ref); + } + } + + return key_ref_to_ptr(ref); +} + +/** + * find_asymmetric_key - Find a key by ID in the builtin trusted keys + * keyring, or return the first key in that keyring. + * + * @id_0: The first ID to look for or NULL. + * @id_1: The second ID to look for or NULL. + * + * The preferred identifier is the id_0 and the fallback identifier is + * the id_1. If both are given, the lookup is by the former, but the + * latter must also match. If none are given, the first key is returned. + */ +struct key *find_trusted_asymmetric_key(const struct asymmetric_key_id *id_0, + const struct asymmetric_key_id *id_1) +{ + struct key *keyring = builtin_trusted_keys; + if (!id_0 && !id_1) { + return get_first_asymmetric_key(keyring); + } + + return find_asymmetric_key(keyring, id_0, id_1, false); +} diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 359c2f936004..0bef29eb8297 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -13,6 +13,7 @@ #define _KEYS_SYSTEM_KEYRING_H #include +#include #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING @@ -61,5 +62,7 @@ static inline struct key *get_ima_blacklist_keyring(void) } #endif /* CONFIG_IMA_BLACKLIST_KEYRING */ +struct key *find_trusted_asymmetric_key(const struct asymmetric_key_id *id_0, + const struct asymmetric_key_id *id_1); #endif /* _KEYS_SYSTEM_KEYRING_H */