From patchwork Thu Apr 20 22:28:37 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mehmet Kayaalp X-Patchwork-Id: 9691455 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 24225601D4 for ; Thu, 20 Apr 2017 22:29:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0ABC72780C for ; Thu, 20 Apr 2017 22:29:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F07D627DA4; Thu, 20 Apr 2017 22:29:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 75D862780C for ; Thu, 20 Apr 2017 22:29:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1033533AbdDTW3a (ORCPT ); Thu, 20 Apr 2017 18:29:30 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:58005 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032144AbdDTW32 (ORCPT ); Thu, 20 Apr 2017 18:29:28 -0400 Received: from pps.filterd (m0098416.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v3KMSTCW008029 for ; Thu, 20 Apr 2017 18:29:27 -0400 Received: from e17.ny.us.ibm.com (e17.ny.us.ibm.com [129.33.205.207]) by mx0b-001b2d01.pphosted.com with ESMTP id 29xur55cd2-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 20 Apr 2017 18:29:27 -0400 Received: from localhost by e17.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 20 Apr 2017 18:29:26 -0400 Received: from b01cxnp22036.gho.pok.ibm.com (9.57.198.26) by e17.ny.us.ibm.com (146.89.104.204) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 20 Apr 2017 18:29:24 -0400 Received: from b01ledav004.gho.pok.ibm.com (b01ledav004.gho.pok.ibm.com [9.57.199.109]) by b01cxnp22036.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v3KMTOrE55312430; Thu, 20 Apr 2017 22:29:24 GMT Received: from b01ledav004.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9D07C112054; Thu, 20 Apr 2017 18:29:23 -0400 (EDT) Received: from dogbert.watson.ibm.com (unknown [9.2.195.53]) by b01ledav004.gho.pok.ibm.com (Postfix) with ESMTP id 762E4112034; Thu, 20 Apr 2017 18:29:23 -0400 (EDT) From: Mehmet Kayaalp To: David Howells Cc: David Woodhouse , keyrings , LSM , kernel , Mimi Zohar , Stefan Berger , George Wilson , Mehmet Kayaalp Subject: [PATCH v4 1/4] KEYS: Insert incompressible bytes to reserve space in bzImage Date: Thu, 20 Apr 2017 18:28:37 -0400 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1492727320-26194-1-git-send-email-mkayaalp@linux.vnet.ibm.com> References: <1492727320-26194-1-git-send-email-mkayaalp@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 17042022-0040-0000-0000-0000031EF1CD X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00006946; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000208; SDB=6.00850214; UDB=6.00419937; IPR=6.00628902; BA=6.00005305; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00015114; XFM=3.00000013; UTC=2017-04-20 22:29:26 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17042022-0041-0000-0000-0000071305EF Message-Id: <1492727320-26194-2-git-send-email-mkayaalp@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-04-20_20:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1704200226 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Include a random filled binary in vmlinux at the space reserved with CONFIG_SYSTEM_EXTRA_CERTIFICATE. This results in an uncompressed reserved area inside the bzImage as well, so that it can be replaced with an actual certificate later (after the bzImage is distributed). The bzImage contains a stripped ELF file with one section containing the compressed vmlinux. If the reserved space is initially filled with zeros, certificate insertion will cause a size increase in the compressed vmlinux. In that case, reconstructing the bzImage would require relocation. To avoid this situation, the reserved space is initially filled with random bytes. Since a certificate contains some compressible bytes, after insertion the vmlinux will hopefully be compressed to a smaller size. Signed-off-by: Mehmet Kayaalp --- certs/.gitignore | 1 + certs/Makefile | 21 ++++++++++++++++++--- certs/system_certificates.S | 2 +- 3 files changed, 20 insertions(+), 4 deletions(-) diff --git a/certs/.gitignore b/certs/.gitignore index f51aea4..4ecc8dd 100644 --- a/certs/.gitignore +++ b/certs/.gitignore @@ -2,3 +2,4 @@ # Generated files # x509_certificate_list +extra_cert_placeholder diff --git a/certs/Makefile b/certs/Makefile index 4119bb3..ad04feb 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -15,7 +15,12 @@ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) -$(obj)/system_certificates.o: $(obj)/x509_certificate_list +ifeq ($(CONFIG_SYSTEM_EXTRA_CERTIFICATE),y) +system_certs_incbin = $(obj)/x509_certificate_list $(obj)/extra_cert_placeholder +else +system_certs_incbin = $(obj)/x509_certificate_list +endif +$(obj)/system_certificates.o: $(system_certs_incbin) # Cope with signing_key.x509 existing in $(srctree) not $(objtree) AFLAGS_system_certificates.o := -I$(srctree) @@ -23,12 +28,22 @@ AFLAGS_system_certificates.o := -I$(srctree) quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2)) cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1) -targets += x509_certificate_list +targets += $(system_certs_incbin) $(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) + +ifeq ($(CONFIG_SYSTEM_EXTRA_CERTIFICATE),y) +# Generate incompressible bytes. Use seed to make it reproducible +quiet_cmd_placeholder = EXTRA_CERT_PLACEHOLDER + cmd_placeholder = perl -e 'srand(0); printf("%c", int(rand(256))) for (1..$(2))' > $@ + +$(obj)/extra_cert_placeholder: FORCE + $(call if_changed,placeholder,$(CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE)) +endif + endif -clean-files := x509_certificate_list .x509.list +clean-files := $(system_certs_incbin) .x509.list ifeq ($(CONFIG_MODULE_SIG),y) ############################################################################### diff --git a/certs/system_certificates.S b/certs/system_certificates.S index c9ceb71..02b9222 100644 --- a/certs/system_certificates.S +++ b/certs/system_certificates.S @@ -17,7 +17,7 @@ __cert_list_end: .globl VMLINUX_SYMBOL(system_extra_cert) .size system_extra_cert, CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE VMLINUX_SYMBOL(system_extra_cert): - .fill CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE, 1, 0 + .incbin "certs/extra_cert_placeholder" .align 4 .globl VMLINUX_SYMBOL(system_extra_cert_used)