From patchwork Sat Jan 13 21:34:38 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Aloni X-Patchwork-Id: 10162441 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5934D6029B for ; Sat, 13 Jan 2018 21:37:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4B76B28AFA for ; Sat, 13 Jan 2018 21:37:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3EE6228B2B; Sat, 13 Jan 2018 21:37:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, URIBL_BLACK autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 665C728AFA for ; Sat, 13 Jan 2018 21:37:09 +0000 (UTC) Received: (qmail 11897 invoked by uid 550); 13 Jan 2018 21:36:33 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 11820 invoked from network); 13 Jan 2018 21:36:31 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernelim-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Lj/O8s2AU4ypgZt4HppTx39rsCYSRl82QFFQ7PRrxqc=; b=zUVDjUv3RdRWqHUkgbvzpC2lJVPEaCRPKAH+2WC+RthgQiKRWtW0qDxAktSY0IXjDJ qPELPtalrX3CdP/oQTb/azhzTD1LiHjgLX1HiSzpQyPG47qtjkC9fx8a5kLjzFmuDous vo3VCXOIFCYhg9FGU0r166ovdodi5Oy0+GGyK7KRLlmvOyxtaomYtp0r45RNSUEQrY4d x21gwlY2VHaUUC2iGSVsaLM2YQHwF09noV4O1UJZD0xAFxINgTEQFpZBwyPz8SQx3F43 M3Z83bMLTBF2wKXo+pI+2SX8sVswlT+c1NXWSyMZ7DPmFsGDbUJC8FYOvkn2UgbLrVQ7 lTrg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Lj/O8s2AU4ypgZt4HppTx39rsCYSRl82QFFQ7PRrxqc=; b=i2+MJJHMsDNWOFi2W+uOpIsEgmJMwYkKP01K9wdFpbJbHxY78MSweyVqfdjC6un4Vz E5F6T3Yj3zba7WbpTA03f5xrlbKYyIZm5pZjfHlBiOlDYnyR6ixrJQ1ZELiWHzFB195k qCZ9kTf6aq0u00nBThVsNSMYgaJI5XM19zCy4n88g9cBbHA7Evx/qrAzXWf62awr0+ii aoRUACmudeJa+fPpGELq6COoHvTgNU6zmClPGo2q6sMFKb754ltXNOdLCq0SNfXdCJFB LCiiXHpwHzI1d2ob0mY82wcxrW8QqrEqQnMZ10ElVdQglZyG04YkFDga19i0pJAL76KH HLyw== X-Gm-Message-State: AKwxytcYAY1E8mgmVPqJHSIrbf/KMPw+/kIlKW6XN7fXdlWt9LyAQWEc 5LiPmiMkzP+O+6hWWA1vRsBYYg== X-Google-Smtp-Source: ACJfBov5gq3v3cTdNLJ+vqt59G0z4mfk+Twy1pEFGqRHUoVamXihvyDfzrDexPkuvFMp79cQmDEqLA== X-Received: by 10.28.166.195 with SMTP id p186mr4205080wme.81.1515879379987; Sat, 13 Jan 2018 13:36:19 -0800 (PST) From: Dan Aloni To: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Cc: David Howells Date: Sat, 13 Jan 2018 23:34:38 +0200 Message-Id: <20180113213441.52047-5-dan@kernelim.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180113213441.52047-1-dan@kernelim.com> References: <20180113213441.52047-1-dan@kernelim.com> Subject: [kernel-hardening] [PATCHv2 4/7] certs: allow in-kernel access of trusted keys X-Virus-Scanned: ClamAV using ClamSMTP CC: David Howells Signed-off-by: Dan Aloni --- certs/system_keyring.c | 56 ++++++++++++++++++++++++++++++++++++++++++- include/keys/system_keyring.h | 3 +++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 6251d1b27f0c..843a38b43fb1 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -131,6 +131,8 @@ static __init int system_trusted_keyring_init(void) */ device_initcall(system_trusted_keyring_init); +static char *first_asymmetric_key_description; + /* * Load the compiled-in list of X.509 certificates. */ @@ -172,8 +174,11 @@ static __init int load_system_certificate_list(void) pr_err("Problem loading in-kernel X.509 certificate (%ld)\n", PTR_ERR(key)); } else { + first_asymmetric_key_description = + kstrdup(key_ref_to_ptr(key)->description, + GFP_KERNEL); pr_notice("Loaded X.509 cert '%s'\n", - key_ref_to_ptr(key)->description); + first_asymmetric_key_description); key_ref_put(key); } p += plen; @@ -265,3 +270,52 @@ int verify_pkcs7_signature(const void *data, size_t len, EXPORT_SYMBOL_GPL(verify_pkcs7_signature); #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ + +/** + * get_first_asymmetric_key - Find a key by ID. + * @keyring: The keys to search. + * + * Return the first asymmetric key in a keyring. + */ +static struct key *get_first_asymmetric_key(struct key *keyring) +{ + key_ref_t ref; + + ref = keyring_search(make_key_ref(keyring, 1), + &key_type_asymmetric, + first_asymmetric_key_description); + if (IS_ERR(ref)) { + switch (PTR_ERR(ref)) { + case -EACCES: + case -ENOTDIR: + case -EAGAIN: + return ERR_PTR(-ENOKEY); + default: + return ERR_CAST(ref); + } + } + + return key_ref_to_ptr(ref); +} + +/** + * find_trusted_asymmetric_key - Find a key by ID in the builtin trusted + * keys keyring, or return the first key in that keyring. + * + * @id_0: The first ID to look for or NULL. + * @id_1: The second ID to look for or NULL. + * + * The preferred identifier is the id_0 and the fallback identifier is + * the id_1. If both are given, the lookup is by the former, but the + * latter must also match. If none are given, the first key is returned. + */ +struct key *find_trusted_asymmetric_key(const struct asymmetric_key_id *id_0, + const struct asymmetric_key_id *id_1) +{ + struct key *keyring = builtin_trusted_keys; + + if (!id_0 && !id_1) + return get_first_asymmetric_key(keyring); + + return find_asymmetric_key(keyring, id_0, id_1, false); +} diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 359c2f936004..0bef29eb8297 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -13,6 +13,7 @@ #define _KEYS_SYSTEM_KEYRING_H #include +#include #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING @@ -61,5 +62,7 @@ static inline struct key *get_ima_blacklist_keyring(void) } #endif /* CONFIG_IMA_BLACKLIST_KEYRING */ +struct key *find_trusted_asymmetric_key(const struct asymmetric_key_id *id_0, + const struct asymmetric_key_id *id_1); #endif /* _KEYS_SYSTEM_KEYRING_H */