From patchwork Tue Apr 6 18:53:39 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12185759 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B47BC43461 for ; Tue, 6 Apr 2021 18:54:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 45509613DE for ; Tue, 6 Apr 2021 18:54:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237342AbhDFSyt (ORCPT ); Tue, 6 Apr 2021 14:54:49 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:3918 "EHLO mx0b-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240728AbhDFSx6 (ORCPT ); Tue, 6 Apr 2021 14:53:58 -0400 Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 136IYixS189899; Tue, 6 Apr 2021 14:53:48 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=W0JexB3pGbSVM6Gi/s0lWDphouOz+hg8nBrceVRz5NA=; b=S33qW43fvNljiKw3SmiaqMnoqyZXqH2kJy9US0QGfPm1Ji0MImIN31/OfgMj9B+wgEUZ Usmbt/ZwCZWZ7/qN6pTHjDxQTXlMQe4vLmIzRQlxHUYK+ty38wP4IKMl+VUN6Edp/KGY +E+zNl6w/iySxEAJ1oA6LjS6P+JRLGFcOqy2VkyB6eb3iRS0eahuqyrtlMivbUiytaqi 22IZSTzzdAdryH4pj/gOJNtQX5oUSXreVslI1D7NSg0fTnWm0ho3v963PhPvmRkjerI3 SXxcyI06GeP2l/TPVQxBAzN4TDfEkrKUzw3Q0pQPqvgDEwLYJSDEErkRrSkUZRNP4dp5 eA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 37rvmesgfk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 06 Apr 2021 14:53:48 -0400 Received: from m0127361.ppops.net (m0127361.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 136IZoZn000764; Tue, 6 Apr 2021 14:53:47 -0400 Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0a-001b2d01.pphosted.com with ESMTP id 37rvmesgfb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 06 Apr 2021 14:53:47 -0400 Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.16.0.43/8.16.0.43) with SMTP id 136IbCCn009177; Tue, 6 Apr 2021 18:53:47 GMT Received: from b03cxnp07027.gho.boulder.ibm.com (b03cxnp07027.gho.boulder.ibm.com [9.17.130.14]) by ppma01dal.us.ibm.com with ESMTP id 37rvs1085f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 06 Apr 2021 18:53:47 +0000 Received: from b03ledav003.gho.boulder.ibm.com (b03ledav003.gho.boulder.ibm.com [9.17.130.234]) by b03cxnp07027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 136IrjWd23134614 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 6 Apr 2021 18:53:45 GMT Received: from b03ledav003.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 510BA6A051; Tue, 6 Apr 2021 18:53:45 +0000 (GMT) Received: from b03ledav003.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C135B6A057; Tue, 6 Apr 2021 18:53:44 +0000 (GMT) Received: from localhost.localdomain (unknown [9.47.158.152]) by b03ledav003.gho.boulder.ibm.com (Postfix) with ESMTP; Tue, 6 Apr 2021 18:53:44 +0000 (GMT) From: Stefan Berger To: keyrings@vger.kernel.org, dhowells@redhat.com, zohar@linux.ibm.com, jarkko@kernel.org Cc: nayna@linux.ibm.com, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Berger Subject: [PATCH 1/2] certs: Trigger recreation of module signing key if it's not an RSA key Date: Tue, 6 Apr 2021 14:53:39 -0400 Message-Id: <20210406185340.1079403-2-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210406185340.1079403-1-stefanb@linux.ibm.com> References: <20210406185340.1079403-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: pGnen7d5n5YNdc3RHnezdeAmKb6PHfvx X-Proofpoint-ORIG-GUID: t_y6zRtVxIKoTvYf5CJOfPR3MOMnHgSY X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.369,18.0.761 definitions=2021-04-06_06:2021-04-06,2021-04-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 spamscore=0 impostorscore=0 mlxscore=0 adultscore=0 phishscore=0 priorityscore=1501 malwarescore=0 clxscore=1015 mlxlogscore=999 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104060000 definitions=main-2104060127 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Make sure that the kernel module signing key is an RSA key and remove it otherwise so that it gets recreated. Prevent module loading failures if a developer chose an ECDSA key for module signing with a 5.12 kernel and then falls back to compiling an older kernel. However, this will also only work if falling back to kernels that have actually been patched with this kernel, such as the stable trees. Fixes: cfc411e7fff3 ("Move certificate handling to its own directory") Signed-off-by: Stefan Berger --- certs/Makefile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/certs/Makefile b/certs/Makefile index e3185c57fbd8..f64bc89ccbf1 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -59,6 +59,11 @@ silent_redirect_openssl = 2>/dev/null # external private key, because 'make randconfig' might enable such a # boolean option and we unfortunately can't make it depend on !RANDCONFIG. ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") + +X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) + +$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) + $(obj)/signing_key.pem: $(obj)/x509.genkey @$(kecho) "###" @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." From patchwork Tue Apr 6 18:53:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12185761 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BB18C433ED for ; Tue, 6 Apr 2021 18:54:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 07583613E1 for ; Tue, 6 Apr 2021 18:54:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238107AbhDFSyu (ORCPT ); Tue, 6 Apr 2021 14:54:50 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:49188 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240705AbhDFSx5 (ORCPT ); Tue, 6 Apr 2021 14:53:57 -0400 Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 136IZE8g016009; Tue, 6 Apr 2021 14:53:49 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=smmRE6MNAeTbnKpReJ5A0is8bniX576Pnw/Hil94MoY=; b=FUDT0P7PfTxP4Q4k5FsSMJCzboOkg/3CjT656PFhlKDBKbH/IZuahuSvoXIMzrxfziny tjK3rzHCKgjIdGmQLcs9ZU8vtY7/Vcyp0a8/Tusc7U8nStcFLI1RtBxx7QLDZYX02unE ImttaalfO+iM89F9CEJeCt14gc/T68fOoym+GNEPaSugblYkaTTN3l5uETjES1+qe96D 7wwjHKfbx6lCRhrL3lD7tOHuBreyLtGGc2s51x9InD2mdUinOZpU7dl3oxLGw+T+qb5u RyoVCThEOT1OMmATy5Dt+qpvqQ9/Fq4tFT+7Ra0i/qFklHcLsuo3jPZrja9rD8P2RDCf gA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 37rvum0su6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 06 Apr 2021 14:53:49 -0400 Received: from m0098399.ppops.net (m0098399.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 136IZX0p017249; Tue, 6 Apr 2021 14:53:48 -0400 Received: from ppma03dal.us.ibm.com (b.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.11]) by mx0a-001b2d01.pphosted.com with ESMTP id 37rvum0stx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 06 Apr 2021 14:53:48 -0400 Received: from pps.filterd (ppma03dal.us.ibm.com [127.0.0.1]) by ppma03dal.us.ibm.com (8.16.0.43/8.16.0.43) with SMTP id 136IcbHn007021; Tue, 6 Apr 2021 18:53:47 GMT Received: from b03cxnp07027.gho.boulder.ibm.com (b03cxnp07027.gho.boulder.ibm.com [9.17.130.14]) by ppma03dal.us.ibm.com with ESMTP id 37rvc28eac-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 06 Apr 2021 18:53:47 +0000 Received: from b03ledav003.gho.boulder.ibm.com (b03ledav003.gho.boulder.ibm.com [9.17.130.234]) by b03cxnp07027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 136IrjPp27918592 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 6 Apr 2021 18:53:46 GMT Received: from b03ledav003.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E36CF6A051; Tue, 6 Apr 2021 18:53:45 +0000 (GMT) Received: from b03ledav003.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 67C1A6A047; Tue, 6 Apr 2021 18:53:45 +0000 (GMT) Received: from localhost.localdomain (unknown [9.47.158.152]) by b03ledav003.gho.boulder.ibm.com (Postfix) with ESMTP; Tue, 6 Apr 2021 18:53:45 +0000 (GMT) From: Stefan Berger To: keyrings@vger.kernel.org, dhowells@redhat.com, zohar@linux.ibm.com, jarkko@kernel.org Cc: nayna@linux.ibm.com, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Berger Subject: [PATCH 2/2] certs: Add support for using elliptic curve keys for signing modules Date: Tue, 6 Apr 2021 14:53:40 -0400 Message-Id: <20210406185340.1079403-3-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210406185340.1079403-1-stefanb@linux.ibm.com> References: <20210406185340.1079403-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: qprp7teVTG0-_351RHuESRuIiyAdGM5l X-Proofpoint-ORIG-GUID: 9QlJEbJI84ShQ1RWRDRkZWVMnpqLXovf X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.369,18.0.761 definitions=2021-04-06_06:2021-04-06,2021-04-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 mlxlogscore=999 priorityscore=1501 phishscore=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 mlxscore=0 clxscore=1015 spamscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104060000 definitions=main-2104060127 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Add support for using elliptic curve keys for signing modules. It uses a NIST P384 (secp384r1) key if the user chooses an elliptic curve key and will have ECDSA support built into the kernel. Note: A developer choosing an ECDSA key for signing modules should delete the signing key (rm certs/signing_key.*) when falling back to building an older version of a kernel that only supports RSA keys since otherwise ECDSA-signed modules will not be usable when that older kernel runs and the ECDSA key was still used for signing modules. Signed-off-by: Stefan Berger --- certs/Kconfig | 25 +++++++++++++++++++++++++ certs/Makefile | 9 +++++++++ crypto/asymmetric_keys/pkcs7_parser.c | 4 ++++ 3 files changed, 38 insertions(+) diff --git a/certs/Kconfig b/certs/Kconfig index 48675ad319db..6f8337874ae0 100644 --- a/certs/Kconfig +++ b/certs/Kconfig @@ -15,6 +15,31 @@ config MODULE_SIG_KEY then the kernel will automatically generate the private key and certificate as described in Documentation/admin-guide/module-signing.rst +choice + prompt "Type of module signing key to be generated" + default MODULE_SIG_KEY_TYPE_RSA + help + The type of module signing key type to generate. This option + does not apply if a #PKCS11 URI is used. + +config MODULE_SIG_KEY_TYPE_RSA + bool "RSA" + depends on MODULE_SIG || IMA_APPRAISE_MODSIG + help + Use an RSA key for module signing. + +config MODULE_SIG_KEY_TYPE_ECDSA + bool "ECDSA" + select CRYPTO_ECDSA + depends on MODULE_SIG || IMA_APPRAISE_MODSIG + help + Use an elliptic curve key (NIST P384) for module signing. + + Note: Remove all ECDSA signing keys, e.g. certs/signing_key.pem, + when falling back to building Linux 5.11 and older kernels. + +endchoice + config SYSTEM_TRUSTED_KEYRING bool "Provide system-wide ring of trusted keys" depends on KEYS diff --git a/certs/Makefile b/certs/Makefile index f64bc89ccbf1..c07736ec5a9a 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -62,7 +62,15 @@ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) +# Support user changing key type +ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA +keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 +$(if $(findstring ecdsa-with-,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) +endif + +ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) +endif $(obj)/signing_key.pem: $(obj)/x509.genkey @$(kecho) "###" @@ -77,6 +85,7 @@ $(obj)/signing_key.pem: $(obj)/x509.genkey -batch -x509 -config $(obj)/x509.genkey \ -outform PEM -out $(obj)/signing_key.pem \ -keyout $(obj)/signing_key.pem \ + $(keytype_openssl) \ $($(quiet)redirect_openssl) @$(kecho) "###" @$(kecho) "### Key pair generated." diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c index 967329e0a07b..2546ec6a0505 100644 --- a/crypto/asymmetric_keys/pkcs7_parser.c +++ b/crypto/asymmetric_keys/pkcs7_parser.c @@ -269,6 +269,10 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen, ctx->sinfo->sig->pkey_algo = "rsa"; ctx->sinfo->sig->encoding = "pkcs1"; break; + case OID_id_ecdsa_with_sha256: + ctx->sinfo->sig->pkey_algo = "ecdsa"; + ctx->sinfo->sig->encoding = "x962"; + break; default: printk("Unsupported pkey algo: %u\n", ctx->last_oid); return -ENOPKG;