From patchwork Wed Nov 16 18:11:13 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Howells X-Patchwork-Id: 9432341 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7289660469 for ; Wed, 16 Nov 2016 18:13:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6786528A63 for ; Wed, 16 Nov 2016 18:13:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5B64428A64; Wed, 16 Nov 2016 18:13:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ECAA728977 for ; Wed, 16 Nov 2016 18:13:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753175AbcKPSLS (ORCPT ); Wed, 16 Nov 2016 13:11:18 -0500 Received: from mx1.redhat.com ([209.132.183.28]:44624 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933534AbcKPSLP (ORCPT ); Wed, 16 Nov 2016 13:11:15 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 85B147F3EC; Wed, 16 Nov 2016 18:11:15 +0000 (UTC) Received: from warthog.procyon.org.uk (ovpn-116-110.phx2.redhat.com [10.3.116.110]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uAGIBD4R012413; Wed, 16 Nov 2016 13:11:14 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 Subject: [PATCH 4/9] KEYS: Allow unrestricted boot-time addition of keys to secondary keyring From: David Howells To: keyrings@vger.kernel.org Cc: dhowells@redhat.com, matthew.garrett@nebula.com, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 16 Nov 2016 18:11:13 +0000 Message-ID: <147931987366.16460.12891767069975068260.stgit@warthog.procyon.org.uk> In-Reply-To: <147931984418.16460.6639993676886095760.stgit@warthog.procyon.org.uk> References: <147931984418.16460.6639993676886095760.stgit@warthog.procyon.org.uk> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 16 Nov 2016 18:11:15 +0000 (UTC) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Allow keys to be added to the system secondary certificates keyring during kernel initialisation in an unrestricted fashion. Such keys are implicitly trusted and don't have their trust chains checked on link. This allows keys in the UEFI database to be added in secure boot mode for the purposes of module signing. Signed-off-by: David Howells --- certs/internal.h | 18 ++++++++++++++++++ certs/system_keyring.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 certs/internal.h -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/certs/internal.h b/certs/internal.h new file mode 100644 index 000000000000..5dcbefb0c23a --- /dev/null +++ b/certs/internal.h @@ -0,0 +1,18 @@ +/* Internal definitions + * + * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. + * Written by David Howells (dhowells@redhat.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public Licence + * as published by the Free Software Foundation; either version + * 2 of the Licence, or (at your option) any later version. + */ + +/* + * system_keyring.c + */ +#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING +extern void __init add_trusted_secondary_key(const char *source, + const void *data, size_t len); +#endif diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 50979d6dcecd..dfddcf6e6c88 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -17,6 +17,7 @@ #include #include #include +#include "internal.h" static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING @@ -242,3 +243,35 @@ int verify_pkcs7_signature(const void *data, size_t len, EXPORT_SYMBOL_GPL(verify_pkcs7_signature); #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ + +#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING +/** + * add_trusted_secondary_key - Add to secondary keyring with no validation + * @source: Source of key + * @data: The blob holding the key + * @len: The length of the data blob + * + * Add a key to the secondary keyring without checking its trust chain. This + * is available only during kernel initialisation. + */ +void __init add_trusted_secondary_key(const char *source, + const void *data, size_t len) +{ + key_ref_t key; + + key = key_create_or_update(make_key_ref(secondary_trusted_keys, 1), + "asymmetric", + NULL, data, len, + (KEY_POS_ALL & ~KEY_POS_SETATTR) | + KEY_USR_VIEW, + KEY_ALLOC_NOT_IN_QUOTA | + KEY_ALLOC_BYPASS_RESTRICTION); + + if (IS_ERR(key)) + pr_err("Problem loading %s X.509 certificate (%ld)\n", + source, PTR_ERR(key)); + else + pr_notice("Loaded %s cert '%s' linked to secondary sys keyring\n", + source, key_ref_to_ptr(key)->description); +} +#endif /* CONFIG_SECONDARY_TRUSTED_KEYRING */