From patchwork Thu Mar 10 21:44:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nayna Jain X-Patchwork-Id: 12776957 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B68C2C4332F for ; Thu, 10 Mar 2022 21:45:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343994AbiCJVq0 (ORCPT ); Thu, 10 Mar 2022 16:46:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234231AbiCJVqZ (ORCPT ); Thu, 10 Mar 2022 16:46:25 -0500 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DAA2159289; Thu, 10 Mar 2022 13:45:23 -0800 (PST) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 22AKVSq8030636; Thu, 10 Mar 2022 21:45:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : mime-version; s=pp1; bh=AYdo1AQd1DukO1ZWiOzG32Xmaay+ti40BRN5Doqxxx8=; b=ghF9dOArRhBc9solvCGhR+w/sJ3T7GAAJHjuMkEMu5IeCej0HTrmrmnED0ZMHQ3zl9or CBIQvrHwl1DjWli2xg26NP5zFYzxBTQKiyhZF8dmt+inQGT8cYqQ/9sIJIxnHokkJx1B WZcfgTYp/EPau3NNRGhK8adBsQSQq0itrithIT6o2i//eB8HI0qHcvH6gctU872czGCA hsp1WPyUHos5iEOuskE7NUjojTzdesZKjeOhf8F186wL77srRJzGcSXxnqfWl1VNy1Zw DEbGKHwYpqTWNVJDoMRoBRMosOs/mtCyW4InAE4jhZVBQCMQ9jgc01AP4OfTTSZUgjT1 LA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3epwxfkayc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 10 Mar 2022 21:45:18 +0000 Received: from m0098421.ppops.net (m0098421.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 22ALEiqm025309; Thu, 10 Mar 2022 21:45:18 GMT Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com with ESMTP id 3epwxfkaxt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 10 Mar 2022 21:45:17 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 22ALi3gu006200; Thu, 10 Mar 2022 21:45:16 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma04ams.nl.ibm.com with ESMTP id 3enqgnr658-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 10 Mar 2022 21:45:16 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 22ALjDSx54854010 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 10 Mar 2022 21:45:13 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EBD53A4040; Thu, 10 Mar 2022 21:45:12 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E4EFCA404D; Thu, 10 Mar 2022 21:45:09 +0000 (GMT) Received: from li-4b5937cc-25c4-11b2-a85c-cea3a66903e4.ibm.com.com (unknown [9.211.53.50]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 10 Mar 2022 21:45:09 +0000 (GMT) From: Nayna Jain To: linux-integrity@vger.kernel.org, keyrings@vger.kernel.org Cc: dhowells@redhat.com, zohar@linux.ibm.com, jarkko@kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dimitri.ledkov@canonical.com, seth@forshee.me, rnsastry@linux.ibm.com, Masahiro Yamada , Nayna Jain Subject: [PATCH v11 0/4] integrity: support including firmware ".platform" keys at build time Date: Thu, 10 Mar 2022 16:44:46 -0500 Message-Id: <20220310214450.676505-1-nayna@linux.ibm.com> X-Mailer: git-send-email 2.27.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: DTJNzB91RNcxH9fF-9zWCHvF_D0PKpQo X-Proofpoint-ORIG-GUID: BCVqt7ZZFljSIHWFVcIUlmRB0L0WHxJ8 X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.816,Hydra:6.0.425,FMLib:17.11.64.514 definitions=2022-03-10_09,2022-03-09_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 clxscore=1011 impostorscore=0 phishscore=0 adultscore=0 malwarescore=0 suspectscore=0 mlxscore=0 spamscore=0 bulkscore=0 priorityscore=1501 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2203100107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Some firmware support secure boot by embedding static keys to verify the Linux kernel during boot. However, these firmware do not expose an interface for the kernel to load firmware keys onto the ".platform" keyring, preventing the kernel from verifying the kexec kernel image signature. This patchset exports load_certificate_list() and defines a new function load_builtin_platform_cert() to load compiled in certificates onto the ".platform" keyring. Changelog: v11: * Added a new patch to conditionally build extract-cert if PLATFORM_KEYRING is enabled. v10: * Fixed the externs warning for Patch 3. v9: * Rebased on Jarkko's repo - git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git v8: * Includes Jarkko's feedback on patch description and removed Reported-by for Patch 1. v7: * Incldues Jarkko's feedback on patch description for Patch 1 and 3. v6: * Includes Jarkko's feedback: * Split Patch 2 into two. * Update Patch description. v5: * Renamed load_builtin_platform_cert() to load_platform_certificate_list() and config INTEGRITY_PLATFORM_BUILTIN_KEYS to INTEGRITY_PLATFORM_KEYS, as suggested by Mimi Zohar. v4: * Split into two patches as per Mimi Zohar and Dimitri John Ledkov recommendation. v3: * Included Jarkko's feedback ** updated patch description to include approach. ** removed extern for function declaration in the .h file. * Included load_certificate_list() within #ifdef CONFIG_KEYS condition. v2: * Fixed the error reported by kernel test robot * Updated patch description based on Jarkko's feedback. Nayna Jain (4): certs: export load_certificate_list() to be used outside certs/ integrity: make integrity_keyring_from_id() non-static certs: conditionally build extract-cert if platform keyring is enabled integrity: support including firmware ".platform" keys at build time certs/Makefile | 9 ++++++-- certs/blacklist.c | 1 - certs/common.c | 2 +- certs/common.h | 9 -------- certs/system_keyring.c | 1 - include/keys/system_keyring.h | 6 +++++ security/integrity/Kconfig | 10 ++++++++ security/integrity/Makefile | 15 +++++++++++- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 9 ++++++++ .../integrity/platform_certs/platform_cert.S | 23 +++++++++++++++++++ .../platform_certs/platform_keyring.c | 23 +++++++++++++++++++ 12 files changed, 94 insertions(+), 16 deletions(-) delete mode 100644 certs/common.h create mode 100644 security/integrity/platform_certs/platform_cert.S base-commit: fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9 Tested-by: Nageswara R Sastry