From patchwork Mon Mar 11 16:11:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589040 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F8304AEC7; Mon, 11 Mar 2024 16:19:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.165.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173985; cv=fail; b=RkLHkagxoHhF65vRak/nbCaCdrplFNZ0Ug0rQEEtPHEa+Unb7Y/REsOcNrhm+1uA/y4t/fFc2Ergv28qEY4FYLZW3nWQKenxgESrpW8f1IXsXwQUt+r4W2J54d47hrj2bUbzIkE7mQVFOLoltwJ/kFwOTUJtElx96XdidQAgaEI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173985; c=relaxed/simple; bh=dgyBi1qU7z9jakUewdQbxjV6RI6Ul3ldbTo0WeLTtNw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=fKdMOB+Fx/0fjpcMOGCAUY6jAQtS8sIXR26woCrNK9YtrjXUTtXIdly9D7z/4MgteLqAddXHloH8JGuLd2yEDIVAHXPadV/yg7ih2ZUAzaJSW0iShM0/ZHGsIv3UwQUHgIvYSd4kaMWdLJT1cIjxvy7l9ogXapmb3Se7wvG95os= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=gA26kRDw; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=oCFAaND3; arc=fail smtp.client-ip=205.220.165.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="gA26kRDw"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="oCFAaND3" Received: from pps.filterd (m0333521.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG0wAS017842; Mon, 11 Mar 2024 16:19:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=soMIWdaWi3eATjfCgd7NVkvKCLBiQju94PVQkd3/AAs=; b=gA26kRDw5b7AnPic/hfvNZS4XoQr+dlxuBM4eLBB5r5SDsWi1jHAXy4XhPoe4XZT70Fh PwvDbozPFp2Y6fDNL/Z4pjVPzBXeSKcbVBq7bPS1DtSmGk97EvJbqwhaKtuID3JaXUu6 FMDJ5Bbk9CDsg0iV7UOFDMATLMunLC+4PqctRlKLU8rMCunbfzMOqZ2tpKiIyfckw+VI VCpjvHZqNZUxL8nAbgwQ2KDvLOznxuOyTqmp1W0wxRQ1ylaxyoe3R2PXC83hnO7xKaPP cEQp3cpQlxum3I7H4juigA1AuaPeSt5PqHPcywd82Rm/8h5VUp+LlRP3XEmvHotChVfD ag== Received: from phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta02.appoci.oracle.com [147.154.114.232]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wrepcusf5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:09 +0000 Received: from pps.filterd (phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BGCjSP019715; Mon, 11 Mar 2024 16:19:08 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2041.outbound.protection.outlook.com [104.47.66.41]) by phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3wre75yvk7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:08 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=X7ORBgLo5zszju29bhjH9QvsqzvFp5rVbeYPImBbNws8tmNGC2TjhuxvlHjsT3IrwMcp5lnWs//Ney/Y9rpWnPWpD3rnTp1aQw6/wc+RR/siplzggYRElwABWJVRtdcRAGTOdtkYlAEj8XpFvtIlGrSsyDusFeDWfvb5W/45vKNGyQT7wOke0L4+0jK/o1CDgpZbrzVEuu4Alar+jZHyfZpZPxz2zUXve3idxZnQlzapJGYOTBv5V6encJl5H1aHedo6pH4moF8myuVwtO1gIsb5ZMVDNYPPPqnjmIdzS8pKJkxOBTjYUEjbtr2ZfG/Wae+XsFuH5XxVOK/VJDxT7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=soMIWdaWi3eATjfCgd7NVkvKCLBiQju94PVQkd3/AAs=; b=WIau/ogrFcvzojaU1nk40iIv0kCVfQbsyB92YPu80WIySYrMRDA6xXlRPagB0CnkymIBcgOCYzO6/3LFn/1Fb8SJAd1be56vPp6/K3kNJIjpfRYAeL+fClP6gYplx3r6iwbURuV8G5kpsgDMBwnEquoXsU6QdgL+oot+x/1lIvGoia2s2go+HX7Jcx87MfEO3VH1c0lCUdQKskuBxfMGt106UgLsc4CARQ4UnPBq2puX3y/n892aYx/HORkgUCpj47t/XNBIrIxZlKBeDF7a4pT2c14PXFsi5rz1oQuC1xwIwvhvyGb79K0f0OuY/vbiouRV6jzZDYUGSpKAt46eKw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=soMIWdaWi3eATjfCgd7NVkvKCLBiQju94PVQkd3/AAs=; b=oCFAaND3h2UJeObnkMKDyg9qXyUTVHYcxnyoPTNultqQVCNTRCrhdQgpmgwPzslKvAPQIdazH76nx8VHi489/N3xMkIXT6NiyP3QgDGVEX/05zStfAMXJrPA3TBE/04mn9W6dR6fnVTZWfPbIO5TQ7Rf+uLM9mk8iZMnHjH1u2A= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by DS7PR10MB5119.namprd10.prod.outlook.com (2603:10b6:5:297::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:06 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:06 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 1/8] certs: Introduce ability to link to a system key Date: Mon, 11 Mar 2024 12:11:04 -0400 Message-Id: <20240311161111.3268190-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: MN2PR01CA0057.prod.exchangelabs.com (2603:10b6:208:23f::26) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|DS7PR10MB5119:EE_ X-MS-Office365-Filtering-Correlation-Id: 91c2d175-7772-45ac-8704-08dc41e6f92a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: SPVtJcLcUOEMs0Fwta7v+3bbmO6PmJ/j0s/GkaUmSK+O9YivqHsPdHa5ICyh0iwQ3S5CJXdIX7Vk7RfvGHBPe+3+Yyk+dcQsp65EoGqzw20wi0Hv73AmbEWo5UtJBSlTvdQr29taBrb59sJjNmKbwEIDea8Ivi3v/VwH/OcdpK/SJF27b1t3ok2AkPZBRj3QMCtibWp+JcpFYn5yqbGD8w9g3xeZhv9pOeeGPe60KG3BdmiL1eTwrufV1WyqKcRmVaki/Go7UcBudI0H36BGGcKVdtYlIM/6ldBBbDKzcr7PH2JMiR0JdSvyBZ/1jbQWu7kpZWx7TYax6v0jLE+tKkHW0iTkChaGHAaswBHxYGvUrtdAzVsdYW76WlfI+kR0uMfK6FdOHuQ/0bwqFiqyPvS9Ewk/BgUdAw7LaKKoghDANfSJw674hOWEpX4Yy/+g+t6pc9pWgfrbvvIpqCT5muwe3+CU+3q0hQKKuKDzD3kzZK070IlG5kKkjR6IGrsPMwY7CSa2fwxh5lJlqpXZ43QJ7PcjAT63CTG7+4t2wIhbwajh2wd2T+E2A+k7/+cIArdmxbg0+STexvR5Xm91vO2xwT4YWmXsou3KUIxQShgsfS1pRymmAwGBavMldZKIX1pOddLfXpjLTL+p4lL9wMH5T2VUovncverBaO9ut5M= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(1800799015)(7416005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: qYyu1wHpVUxVrrxGZEz+jEQ9H1uab/WikCLXZh4EL9as5jbjKFKk5C9ih/jDg9njR2eneMhMlAruYVhGOpLG9F6NSsN99VN/lE/CmdlXn7oP9GV2VSHsvE2uTxb98CtVqz9ytIVgekXw5rOl9PtU1H3v+QtMYu8JZFS0yyk6TcDkeu9ZmSHkNvx1HGfB44r3P2Uss9gvcJ3xZFTi3MBmZZLoceALKaM2Y8orYb5vOmlVWzIzX/dXhcTnzaUAJGzKCzygOqocNig/HqugspNi8R2OjskfwcU8bCcXHaXj7EElv1XLMN5iVu7F5O5dPLwVP1irUKWI2FyRUeJ136JcC2slfVK6BgK21VcZ2S93IbGtpHBKoOU4ZEzY7O7DfjALWncdy5v1lPr/cmiLUUh6hBXWKZvWK1bGURRw+KnKcX/9iZjRaBQNl1oVF7IBVpApUmmi/HUEldbYOSzKzoc3lzwvCXG7kyY55mMDyePvbZeZ8hFEsdi3z8XE7J9YjL//j1XsgR40EBV6Sn7ZwZ+uE3RJJO2YeG13x+i09ql0tg34Lb/GNzeRJbA8UprOV3lsGrnV8fd9me1GjhZMgw/i0tjzvdb4C0XVdDSBhUpkMrdFOAk8EaTfkeHx0tIj19C1l/bPCASU88MI09SID42YOZemas/+0uV89nnqtQ8JrEb6N/W5Zt5erCYcDQ5AZkDdkSnabAEIE1klbUHlAqg0NXUYPN+ZOEPn49TQDLL8crbaxnZU8i4b662mNwTUS10hU3T8BPOoIZGnMIVqQv1rs7Rtqg89wfia43zQ7OOWoMNmNbNo4V0MwuGo/57+704yEZKDkI+bLPviSjUi/MKyYMMGncuNhQt6SXTW9q7HiSLIQWMJI1rEaIXimwfO5eiBDrPkPbiHJABdAe3x703slyAGkGziTSA1Fk17jHCAFHXRIUFM5YKtel2fWFhj+IP7EQoNp5/XD07OvJQO4VIAqe4TlYkLCpnWkNWLba6rpDBzDvl9y5tWl1xoUDau9rFZbft1RvdqFrlxsPNysAI4IMG6eka2yqE1kNcgkmNPNR+Hu6+enh67XlY+6v4Pb5AyqsmDMfwwykqSGjfxocC8oM9dm+JKN5O42WjinyqZL5IjzFzEqH+LjTTo7e+28BhUsu5XG5fypVt84RzAxM1DaKF33mJEYge67toNj23/uOuOvT65edDt9pdK8oaDHRe9b5OGBbw6rS7CUOE3xognW2vWtuuyja4yoVq3E3q0W3guovTvhvdoI/c6CmauUMhgvkbxDjDiFNIc7HMLFpO8Exp8t7z8fvVJGo3/Vz6gI4yBrU+2cCZmT+42kwASwKMF/YNp8Y6iOejERwkdYrop4Km2dE5t5UCkvdY6VpSYxIU9+7eEfWYCxQgmpNyN7i9xHKY+1foybfzEs6p3SW2LCg9xy2zq1OM9e88isPpT5Ar1D6KMMyYGn5GYyBchIQhxGRFhhcp2gzEn4tnZyln3sr81JbtXWV7aEFeAS8bv2gcfltJLxIoX1RgxkVW7c3WisC5oCyqE+D9PUHduhR9P5KOVuHhRTKp49bRdFFiK59m26Wp5F5hx1KC1N/bKnKk3pPNtQoFxf/6NnG4UgHzqqkOMyujkctREAew6o81XRcA= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: WrgeNq+91v0vK+F35zxMq/F8g1q6Tv8Pranyh718jLOXxPb8Xcxs6tc4zRlnQca68LDUuYiSHUBvZyrin+FQiKT8uLDZG1j5nAPAqPBbxmHR/LfrC0+/QOPTYH3YjHqlyv5b5FL2+pXqy5fFeNqBKrKdA+Ro3+nMfPk7G8+3KPLR313zm0gI5wiIKkxHGJrQMbWzqJLChksvID/CM9KHhxB1krDAfxotDmCjoPnvsJ58l/q3BQzZr7aQnIAZF7bmx6tnSvdVchztt2FQtcsC8zWAR3OevZYY8VOPu1F2gOn77doayUGnANGWDtWG0SN070IIT5sEqc+gZm1rAHTcpbkr5I1rrFSuaVzheLezn1tiZ5Xrjl8HHeBPBlQuIjSFiKSvWyg3BqD+7JX4T6+C4ObRG+WeFvp+5LojUHd/ZUGQpteB7f0VS8P673UyaDWXFtUvZ/8gNqVy3YRKNKKGeakQ7TbTit2uHdnasAecQ95YUxwMQT8yFvBfGOQRoVbwvSn3Ry14jV1xcK6Vl/1XSya6efHIkPZOUF3ZB1aw0KAFIrU/Dv3yN6Qgbj07wQUFGMSimbOLTKu1VrJQX5tx7mKUKqr6GXv6s9sxVJz2hYQ= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 91c2d175-7772-45ac-8704-08dc41e6f92a X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:06.1183 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /Rjt10SPNusHNgB8sD8FAwbBmnhbVXYGRuf1X3qUhMsop+oVAc1u5V2zPlChYcYYOK5vCAHFy6k9T42f52ceGj0Sdnigbx9aTA5A8wN0q/E= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5119 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxscore=0 spamscore=0 bulkscore=0 phishscore=0 malwarescore=0 suspectscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-ORIG-GUID: petUOOvSs8CXjtihdtNeuzSIqKO4o7RO X-Proofpoint-GUID: petUOOvSs8CXjtihdtNeuzSIqKO4o7RO Introduce a new function to allow a keyring to link to a key contained within one of the system keyrings (builtin, secondary, or platform). Depending on how the kernel is built, if the machine keyring is available, it will be checked as well, since it is linked to the secondary keyring. If the asymmetric key id matches a key within one of these system keyrings, the matching key is linked into the passed in keyring. Signed-off-by: Eric Snowberg --- certs/system_keyring.c | 29 +++++++++++++++++++++++++++++ include/keys/system_keyring.h | 7 ++++++- 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 9de610bf1f4b..b647be49f6e0 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -426,3 +426,32 @@ void __init set_platform_trusted_keys(struct key *keyring) platform_trusted_keys = keyring; } #endif + +/** + * system_key_link - Link to a system key + * @keyring: The keyring to link into + * @id: The asymmetric key id to look for in the system keyring + */ +int system_key_link(struct key *keyring, struct asymmetric_key_id *id) +{ + struct key *tkey; + +#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING + tkey = find_asymmetric_key(secondary_trusted_keys, id, NULL, NULL, false); +#else + tkey = find_asymmetric_key(builtin_trusted_keys, id, NULL, NULL, false); +#endif + if (!IS_ERR(tkey)) + goto found; + + tkey = find_asymmetric_key(platform_trusted_keys, id, NULL, NULL, false); + + if (!IS_ERR(tkey)) + goto found; + + return -1; + +found: + key_link(keyring, tkey); + return 0; +} diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 8365adf842ef..b47ac8e2001a 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -9,6 +9,7 @@ #define _KEYS_SYSTEM_KEYRING_H #include +struct asymmetric_key_id; enum blacklist_hash_type { /* TBSCertificate hash */ @@ -28,7 +29,7 @@ int restrict_link_by_digsig_builtin(struct key *dest_keyring, const union key_payload *payload, struct key *restriction_key); extern __init int load_module_cert(struct key *keyring); - +extern int system_key_link(struct key *keyring, struct asymmetric_key_id *id); #else #define restrict_link_by_builtin_trusted restrict_link_reject #define restrict_link_by_digsig_builtin restrict_link_reject @@ -38,6 +39,10 @@ static inline __init int load_module_cert(struct key *keyring) return 0; } +static inline int system_key_link(struct key *keyring, struct asymmetric_key_id *id) +{ + return 0; +} #endif #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING From patchwork Mon Mar 11 16:11:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589041 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B11534D10A; Mon, 11 Mar 2024 16:19:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.165.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173986; cv=fail; b=aLNwbxdsY0A1A7ijRVSA0rCDVvkCAdAUKLONQGpxJYv1rtTlatwArDkqwRdVfg4Uw/ERLTtPJay0Gg7ftkLSoACU28Beu3HhEwXU4bv7plEI+7cKjpn2V8z/QDn+aUQLJO36sPKA5+5A4pWIn/wc4AqnqOru895GwNeZq7lkTfQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173986; c=relaxed/simple; bh=7yDR4kIqUtPxFlAloY3NRS8HnfjiYCbj9OGKZxdRijI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=tRktBa5IQL/q/k9yJya35PjfP9GWsbPDCqOIEx4yqiIbPH2boZEdM77YjyCr9wN3AS3Fm13687osc4HrBHZusVwMPnIVcti0UHreImuUwX/M9Oh6KtK5JnJJ/twDfGZNWjhLpnTSucLZEoemfkWVl92NOlHvqp8R8+CKPWOjWhI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=V/W4mzV9; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=bw/Wj4Ty; arc=fail smtp.client-ip=205.220.165.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="V/W4mzV9"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="bw/Wj4Ty" Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG0gYj005172; Mon, 11 Mar 2024 16:19:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=9QYlN0NIWhhEn6A0LkCZV5HX1RvYaYaF3wMy3E9zogM=; b=V/W4mzV9vM7IwtlzVp1yJx7KyCnLtiaQfwuSprhxduo44GfJ4uLWKS70i9xud8C/y9/l KjRkOKIRsTjCIIXo+SJ4Si+k9D50Eoscqwvm2o/RPqrf/qV4OeOQC1+MNaAH4xRJcaNE jFsLf0ZfL4Ae/tAJ9A0dw7zhsea6NbNDrqYMRVY2HQSQyx4qyOWbrJkO0DWzVutwSewU 5I6PcbifrhVsNx0olAkEI68Xu7IfEjoYb0/t1JvytqWc2B+Duk0Op78y+jSni+3gNmv8 brYkb9Dat4enJUqOtbHXEaw/JNslzBIrvp61S23JgVMl3gu5jKpXNuSk7ZYo0mbBGI9y Dw== Received: from iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta01.appoci.oracle.com [130.35.100.223]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wrfnbkqb3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:13 +0000 Received: from pps.filterd (iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BGA49l009105; Mon, 11 Mar 2024 16:19:12 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2041.outbound.protection.outlook.com [104.47.66.41]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3wre7c6kba-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:12 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iB4hfiMxZJl4Fr5KbM/O/VeG7Ak/WgP0g6vucBfzy3ljMVoCX3N2cEGt5DzwC8aWFJTJN6D7zITYXNxXaf+YUgb5hY2HauDdpXlXOYGR7mfMP6dkt/Ax2D4ETnEEvqCwz/wEdp5tb9wXSS4MQinj9oHf8fig5u8rwaGrD6y/4guFyBNOmNdxPE6ssoP06B+FvDGWBa2AEy6X0MHWnTEst/Cl0FuN4JVKJ6eKuXuVyn9eWLtaFqRnXDEtkPB1f+0wTVvXj2c0PesuS+pJ4ncpV4unhA/GnM5VknFX+D/J1+/8SnM+DBIsEN1gCHCQH5B04psJI6+bocBsWSAJ+kOtAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9QYlN0NIWhhEn6A0LkCZV5HX1RvYaYaF3wMy3E9zogM=; b=TttzanU7PjgNiCoER35/XYEKqt9uCS3UxWTNvUylPRMcInRqrOQgeJtiL+okasEIetibSMetW4KwZgqyZ6+p7I3dqfGUfUculE9ap05msMvagN7HubCh70iRqqaGPMMyf+TWn9z/lqpo5fGbUDACd+gVUtnZ8iIt2kFYdZYX00R51WKBAA3AgTDadvH9UcBsLOARbALb+E/0Vk5dkjC4Z5WdrE5+cdqShpCBEoq5XfkndLaJXxGUNdp+npyiHNtYAh0x4eJUj5AKPi/xVFNRtlCboIXSW499zy7Ja61DajMShwEH8sj0JM0+s9ic1QRrTfcpn0aIei/x1WSBb0fitw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9QYlN0NIWhhEn6A0LkCZV5HX1RvYaYaF3wMy3E9zogM=; b=bw/Wj4TyhaVrk/zktqyz88vwUlPKntYnbu8fPy4OsmPgXtJqq0tfVtk9W75DaipOK17al94AI5hEoUq+n5Cw41QaeUXuurFGBU0IWM4hAyOy2fQuh8HnEDBgR41smBjRC1x7PrEX4qRhOSXkAf1uqNfedaX0+yBrzBAIumNRUss= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by DS7PR10MB5119.namprd10.prod.outlook.com (2603:10b6:5:297::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:09 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:09 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 2/8] clavis: Introduce a new system keyring called clavis Date: Mon, 11 Mar 2024 12:11:05 -0400 Message-Id: <20240311161111.3268190-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: MN2PR01CA0060.prod.exchangelabs.com (2603:10b6:208:23f::29) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|DS7PR10MB5119:EE_ X-MS-Office365-Filtering-Correlation-Id: e7d2e8c0-3d46-4bd0-31dc-08dc41e6fb58 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: MM8YaDhFiDmWv6x/W4DgSEIbrOBN71dyRq6Kqix+rumtQ04Y/JNMn7v+XzgQGssLPEMksyN+/RaXPeDxD8Beg5azRiSzC+RLjP8m4S08YfAJ7UqiIxkgZi0ejJpIgO7snq3EBJw+k6sulX8/hVUHnohGN21dF6fBam7gEwzyg6997b7+NmT8/uRwE71xu4ABbfxBufadOWiqj0ItFyqurJdRlRwQu6VjqJgjWJ6/SR56Uyk6bLOIU5q1BUl8lAKxGQR04PABiARWb3VXm2E38sn9xEithPpcJ4bn6tYjifLV736V11+1hqeIKlK/I4g+n5sG0jkBFmgh21enxYMLw/I0Zfm1XVB20xsTpJNbS9dkAezZvxcSVG40SQCSpXbWvwFZ8uPeWcEFvyDaTB63T6bpAdG0HBHIm/m3lwr935ZtezYypofVvv7JaxDojMoH1yjil393weBns7+dmwuO+ESpiylaOcwohZ5EilW8oMDZCZMYu5fXHVkxulpLZ76XIfywgNiIa/PBY7N33C7SSk8diPISmMFNke590V59l2Zekk0BwVhVKWC7xJBCRqqp5dLJOhz/WKWu/gqpu+LQjs1H3HqL3d9wH7Algup2OvPoEBIBglox9PfUWFMCsUlEu/wjvsHoRj4cNHl1U6iwX0M4SKOaYqcjD27OTMSNCSU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(1800799015)(7416005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: WFQIFk9sHzm+rsvJXM3AOC92Cmud2uI5kVdZDHiY517N+g6xlP21ZnII1eRjIGnJPdOgzW6JnSWTnmoDMcMDJMxP4krSPSm74mSTNJ+C9QdXiv9HSnFoPeVTaJ08J+vEu6NeAaotB9Fd0kfxcxTJl6xS7KzeRPjWfvUk1xRmuQH6CZP7w1sL3KYPxvuC1/l5XOkp06jWHzwsNogcIvEqGcPVNFThS/h2vPstuQ95wBE69KzjcKEXUE4avsc8XjOouoZZT378rj/G4LxTBvrP5uxsXPt7HyKGHVc0xr1RUj7ZznvEgAvO9KO61fxNZROVAG7vFlT18009iXEZI8Cke4t24KWVG/g+nN9AN9qZx2P5piBCKqH3wUT+yWk4drO8BkKGa/fEpbRApH2M/b5PQwDbDy08KwYRHIkCCfDb0Cy1pHJYsvEoJXS4LKKeKAoBSWG0tfQp4HBZ3ZsvVLlO+26V6Jr17fGQUoUVeIIR0NIep5bW6L/vRiXGqJMvRPfBDZnj73raSJdCndzqEID0V+9qSzLdU8qEz22Ca3t8KRvLpSA80kXX/Sx/YmvPWWXtfl2hbe+A7t93/3GRwiunsVrB3Uc0Ph5H1FkTKhvhBZIPFp3+yr2s60T6Qbiq0qdCWXWxceUhS4m8EsUYajl9ERG+bByLrxqxlXehsiLo524PR6GnAEO5cgfHRd44oMdio/vOO+ikCZQ5YAnOprxAtxCnF+5V5RY4uVaA8mVHbmrWelh2Q14bn2r8eq5qmhPG0te09SuRYcIxKL25f1Q17ICVBdTE5hDf5pPRpFBhGOPmv61GJttSzIFJ71CWeAYS9KEUUfpw8y6tImh2a8YzwTHgtBQZ6ZPrw0HmhvJol1aZDOkHBD7TlzJuBXhzTMLLDKXAzIgGyHO8v8wzJw5+J19r+XkBFU1Spsyt/0Z4ihD4cDn8e6xK+O/5/+TvZTQMjsvPTGxloci3jSHXcQyY9wmxIisOzLZUtnJQnxyaHlTKZyB1pf7qNLHNdvIbvAIbKm6zt8hmx67BIti/tyawgbx2mXa2FXuS+yfpwtykKktYgcrXLS76W5g4f1j0Tl6LobBetTDdPjg0iVGWqHYprAwZNm8LKAOEM5MSsbXAO5J5OtbGLiHkGH6bgfSmB21glQDiRM5kcrFPTRWdwHS974Wn4Djbum5/3/Qpr+q96y8uhWuLqGzw6XAvYkN26+mL60aA53qSFDnz2HZWoMOndxc3eCI8j6ngPmEwEvoQWeTElKXSTqoLXmmRyyGkGQBxDVjU/VKF8iKE8/PJeRopfMPglb7K19IAf+tL6TU/HjDykoaZviSIAndyNokb1jWRCbu0W8U9omxri7hQ0tat9+M1FjTp5Sh0uEOH374g4Q2CTBGHA8QGK41zNKZ6klkUcwsPefXZ7XK4rfxqqtYS7pLP97+yjD06k2MIIQ5KgOnPgFX/vUNougDxlIuARA7yZpgMxOWUoA0Kks+PZDrVevlK9V9WHJjZor3nviygTVMUc4W8vTdROO0VnzX391YTrIIuk38W2kwM6TiQu+UjRp09vRqyraDAleswEj0TF5crS0AJ8vUN/ZwDKEOEX7HYyJVku8mtf4Yrc2YWW3BnZUDgk2GhnM1324Dyj4ycvs8= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: UTg7lLaPpjtuIsmYNBXohJFHL/B0gYYbXM8naF50xRaSVnqgMT196fgKYpBEHZHIRmKOfBVjjbNr/qnjyR5lbPQxJF7OEyrqzbYIyhR2L5opNO01/+03jXRuh0SqHSUemiOOQq8lruSCDPh5sC+BCLjXzFF8o65KnCk0aWPgI1X1Ux23Ug8oXC/jUNvWcyCiArhwEvJio19BBvRmhsuNiS9X5i+Q/bjQflec0CKOFxb+zRgWDJ597rL3kZdn+CbivCvbbyzYL+IBocDO3IisK4y1FV2SjrMTGvWprd4K1/MeGU9NJO5hC22XVqbWs9hw0SUGo3ZOst5rVZESkGu9AQBkm0wt6+yn7bqLCEDpHPorHplh+zerklf6hOFYxjiKXqVEQhHsa47EevBwn6Q+vBsgYdriBxhd2ST3nrgzZoli7/l89ILyWmR7z+OLsWssnc0Ow/Bax2jZgYVa9PX88oopjXXDkG7kT5hIe7O7fl0foMwbS81ivKtxzIf+HuKeZffpRkriIq8YXqjxEr1qe6QIN6eJBKwMeSNiI3Nsmb2368THiP60HyLf4g4ngZKPx+HMRTtzzn9OLuk1xG2edVTRaXQuQCmcR5xuAfdosqc= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: e7d2e8c0-3d46-4bd0-31dc-08dc41e6fb58 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:09.7421 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ybpA38uXAKhbdfQYiEDEA2TDKeTWynhUwIZUpG4vIjlZkMnwdqk52qABmoD2TLp2Z+ely3NLM1a8eM2i+vMHNDsh85RwP2CvCSILbZwGdrw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5119 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 spamscore=0 mlxlogscore=999 bulkscore=0 phishscore=0 malwarescore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-GUID: OKtTK_d_CSPB7W7TppEGT2_C9mdb5RjE X-Proofpoint-ORIG-GUID: OKtTK_d_CSPB7W7TppEGT2_C9mdb5RjE Introduce a new system keyring called clavis. This keyring shall contain a single asymmetric key. This key shall be a linked to a key already contained in one of the system keyrings (builtin, secondary, or platform). The only way to add this key is during boot by passing in the asymmetric key id within the new "clavis=" boot param. If a matching key is found in one of the system keyrings, a link shall be created. This keyring will be used in the future by the new Clavis LSM. Signed-off-by: Eric Snowberg --- include/linux/security.h | 4 ++ security/Kconfig | 1 + security/Makefile | 1 + security/clavis/Kconfig | 9 ++++ security/clavis/Makefile | 3 ++ security/clavis/clavis_keyring.c | 90 ++++++++++++++++++++++++++++++++ security/integrity/iint.c | 2 + 7 files changed, 110 insertions(+) create mode 100644 security/clavis/Kconfig create mode 100644 security/clavis/Makefile create mode 100644 security/clavis/clavis_keyring.c diff --git a/include/linux/security.h b/include/linux/security.h index 8436f9abf43d..94661398708a 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -508,6 +508,7 @@ int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); int security_locked_down(enum lockdown_reason what); int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, size_t *uctx_len, void *val, size_t val_len, u64 id, u64 flags); +void late_init_clavis_setup(void); #else /* CONFIG_SECURITY */ static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data) @@ -2223,6 +2224,9 @@ static inline int security_uring_cmd(struct io_uring_cmd *ioucmd) { return 0; } +static inline void late_init_clavis_setup(void) +{ +} #endif /* CONFIG_SECURITY */ #endif /* CONFIG_IO_URING */ diff --git a/security/Kconfig b/security/Kconfig index 52c9af08ad35..7f5a52b7cefd 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -194,6 +194,7 @@ source "security/yama/Kconfig" source "security/safesetid/Kconfig" source "security/lockdown/Kconfig" source "security/landlock/Kconfig" +source "security/clavis/Kconfig" source "security/integrity/Kconfig" diff --git a/security/Makefile b/security/Makefile index 59f238490665..01eb82bdd74f 100644 --- a/security/Makefile +++ b/security/Makefile @@ -25,6 +25,7 @@ obj-$(CONFIG_SECURITY_LOCKDOWN_LSM) += lockdown/ obj-$(CONFIG_CGROUPS) += device_cgroup.o obj-$(CONFIG_BPF_LSM) += bpf/ obj-$(CONFIG_SECURITY_LANDLOCK) += landlock/ +obj-$(CONFIG_SECURITY_CLAVIS_KEYRING) += clavis/ # Object integrity file lists obj-$(CONFIG_INTEGRITY) += integrity/ diff --git a/security/clavis/Kconfig b/security/clavis/Kconfig new file mode 100644 index 000000000000..ca72a9e43089 --- /dev/null +++ b/security/clavis/Kconfig @@ -0,0 +1,9 @@ +config SECURITY_CLAVIS_KEYRING + bool "Clavis keyring" + depends on SECURITY + help + Enable the clavis keyring. This keyring shall contain a single asymmetric key. + This key shall be linked to a key already contained in one of the system + keyrings (builtin, secondary, or platform). The only way to add this key + is during boot by passing in the asymmetric key id within the "clavis=" boot + param. This keyring is used by the Clavis LSM. diff --git a/security/clavis/Makefile b/security/clavis/Makefile new file mode 100644 index 000000000000..ff19c1e240fd --- /dev/null +++ b/security/clavis/Makefile @@ -0,0 +1,3 @@ +# SPDX-License-Identifier: GPL-2.0 + +obj-$(CONFIG_SECURITY_CLAVIS_KEYRING) += clavis_keyring.o diff --git a/security/clavis/clavis_keyring.c b/security/clavis/clavis_keyring.c new file mode 100644 index 000000000000..9f1aede81992 --- /dev/null +++ b/security/clavis/clavis_keyring.c @@ -0,0 +1,90 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include +#include + +static struct key *clavis_keyring; +static struct asymmetric_key_id *setup_keyid; + +#define MAX_BIN_KID 32 + +static struct { + struct asymmetric_key_id id; + unsigned char data[MAX_BIN_KID]; +} setup_key; + +static int restrict_link_for_clavis(struct key *dest_keyring, + const struct key_type *type, const union key_payload *payload, + struct key *restrict_key) +{ + static bool first_pass = true; + + /* + * Allow a single asymmetric key into this keyring. This key is used as the + * root of trust for anything added afterwards. + */ + if (type == &key_type_asymmetric && dest_keyring == clavis_keyring && first_pass) { + first_pass = false; + return 0; + } + + return -EOPNOTSUPP; +} + +static int __init clavis_param(char *kid) +{ + struct asymmetric_key_id *p = &setup_key.id; + int error, hex_len, ascii_len = strlen(kid); + + if (!kid) + return 1; + + hex_len = ascii_len / 2; + + if (hex_len > sizeof(setup_key.data)) + return 1; + + p->len = hex_len; + error = hex2bin(p->data, kid, p->len); + + if (error < 0) + pr_err("Unparsable clavis key id\n"); + else { + setup_keyid = p; + pr_info("clavis key id: %s\n", kid); + } + + return 1; +} +__setup("clavis=", clavis_param); + +static int __init clavis_keyring_init(void) +{ + struct key_restriction *restriction; + + restriction = kzalloc(sizeof(*restriction), GFP_KERNEL); + if (!restriction) + panic("Can't allocate clavis keyring restriction\n"); + restriction->check = restrict_link_for_clavis; + clavis_keyring = keyring_alloc(".clavis", + GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, current_cred(), KEY_POS_VIEW | + KEY_POS_READ | KEY_POS_SEARCH | KEY_POS_WRITE | KEY_USR_VIEW | + KEY_USR_READ | KEY_USR_SEARCH | KEY_USR_WRITE, + KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_SET_KEEP, + restriction, NULL); + + if (IS_ERR(clavis_keyring)) + panic("Can't allocate clavis keyring\n"); + + return 0; +} + +void __init late_init_clavis_setup(void) +{ + if (!setup_keyid) + return; + + clavis_keyring_init(); + system_key_link(clavis_keyring, setup_keyid); +} diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 068ac6c2ae1e..87a8bfc0662f 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -36,6 +36,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, */ void __init integrity_load_keys(void) { + late_init_clavis_setup(); + ima_load_x509(); if (!IS_ENABLED(CONFIG_IMA_LOAD_X509)) From patchwork Mon Mar 11 16:11:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589039 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DBFF482CD; Mon, 11 Mar 2024 16:19:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.177.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173983; cv=fail; b=V8ZuLdZHGraQP0E6w13e8d32Rng1ZzrVWpmmTRE2GAUWKjuTdWjIY13uerx4hYvjiib/hx9p1Nfp5ZitZiSbMHMsVW0npFhp0w6ERxI7K0Kjx3dsUpvgnOG2NEmHFo4ELN47QYgj8KGNwZGba8YL0n8Foiw16RsfHUsUvOC+6nQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173983; c=relaxed/simple; bh=GSitH76pU34XvEuLyOIIVUd8hHEzgzppgDzxu7zCHss=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=l1L681KrkIwFOJVp+gJehlXfilyx4nVQI4FVQjK+hQ2ZAUjKe+3xVrrGdg2a5GJosT4FGTSeRHvbbX290CuzFhvvzvRDmOOxKuMwcze04z2NpF3hL6C8V86NsV/QqBb4C68SAE0YTfDj/azwdtq6zRAqNMKHyNEKMfyQNbkf8qs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=B6L2vYRW; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=RnFe+kFp; arc=fail smtp.client-ip=205.220.177.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="B6L2vYRW"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="RnFe+kFp" Received: from pps.filterd (m0333520.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG40Rw008069; Mon, 11 Mar 2024 16:19:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=BJr9RcGwSc4JLDRvLoY0l7FQdOkxq7x4rvjsHVHwkLY=; b=B6L2vYRWV3qPhn2jJsLRLZP/j0K3DMKmmcdNiI6FFNDwgY5L7m3RZIDtKdARDNt6ToJo rgASRmGlxtR4qGMWHOSpx4+5CoGrZJjofhiDCiioB0KlTXtNcAaIy0H3U7mHhvXNBCl0 IfnUaTy5hL3aqPFa9AiRnSIcZFp1r71UVPZDhfLqWhX0fT3dc/NdvZPfH7du4YH6tMyY HC1djK2kI64ppqc/NymC8LvlrNtf2VTvzZG828sBeEOptvbSE8btZvLYBbtjcO64ZbdF cACB9lpF3lkd9a8IfsG5P7wOWqi3BdFR9ecCKJwHCur/ee+dK+OmG0ooX9LB7OwsukJF mg== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wrftdbtka-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:17 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BGBYTs033753; Mon, 11 Mar 2024 16:19:16 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2041.outbound.protection.outlook.com [104.47.66.41]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3wre75qxaf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:16 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hNil7QSNVtLPj6L1WSXsh64ySCesvvs5JRKlC1pkPujVh2NFfjOdawKGFEm2wWwBvug9rXhXad00/cJrc49TZfYQPuIrNuvTW+tCtGxthJK/Yj4Ri9Q5na2DH6+6ZIkQviAPIVWv3NZMSHvQv1vt0OKKQZWQvUNWGra3W2OOi+fUzusiOuGylesNWs1oNXxMMiI8FAZNN3NpAmohwSxJC8gwoS1qqBgz9Zm7K4/Cwp9LCMtVlHE1vJJ7JvkExj8KPhoq1pU2qVuV5FnicYt60NrUxPuYeRbxzXkgNSZTlh/9z1q8eW8LeJ8J6KDD9WYe6Bggp8jXRzugmsNrC+3clA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BJr9RcGwSc4JLDRvLoY0l7FQdOkxq7x4rvjsHVHwkLY=; b=XC8hSaPj+AahLRMQKHScud+/spJqfODS050QQtM0/dfUvf2GXNqK2DvpZskqr/u3rDyDQ3mYLyhNf97ASTj57bYEMR+t/ACQRQdfr/dT8dyunPoxPSF+U/KjZYG4qEkM9SSXVKRhb94alX56hgpP4MRjt5LMo6x3SB24MPGbpHIGugB4gJKhWx5dPIlywFrlue6cnQoyJUzF8Pzhq5497I0ZMKIDUNXGYxhN6/yIwsMEUwwvjWRGy04xMpxrMojTgo8bhi/re9RcmJtkN8rUpWWJZ7pPBDVGZ5xr4Y0WcqBG8Is8xLVAeQOYmgs/OhyXevg2DmidZxDbNwAEMrxOow== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BJr9RcGwSc4JLDRvLoY0l7FQdOkxq7x4rvjsHVHwkLY=; b=RnFe+kFpk9x4cpy+rN4FUMJeJLilEazdZl2uNvicd7/KEx6nwSaBLqMvPRrzaDdNJ3wfqzSnvbrVWms+LM6SqsoZpnWslzh5lGoqeQj+GeeLRA79dp1xCURO8LdIs/E2x2wElWjFTY6Ci4cQbK7zWOqsgUTKDwx0B4ar3xCmKuM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by DS7PR10MB5119.namprd10.prod.outlook.com (2603:10b6:5:297::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:13 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:13 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 3/8] efi: Make clavis boot param persist across kexec Date: Mon, 11 Mar 2024 12:11:06 -0400 Message-Id: <20240311161111.3268190-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BL1P222CA0024.NAMP222.PROD.OUTLOOK.COM (2603:10b6:208:2c7::29) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|DS7PR10MB5119:EE_ X-MS-Office365-Filtering-Correlation-Id: 7c14497d-9387-4bab-2e24-08dc41e6fdd2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: D1tv+08ocwCb9HrcmFGJkV4tN5rNfrXts3dbfsv5O4sYiJrCHhiGOKQxxqOqvZ1pyjsabW9U4q/+nffX0G1okz931v9FQVqfxFZEah8wleZ+F+LfxY83nHbiAdMLFSIXzGcL1E1kXxUxrH+md/xntve1RbQ/64v2P7KgfRRDZIUq28Kh6/2wLouhUR8Jc1DIMisZKfgbmMeUbl/rSR2usS/PlV5ZN4QdAburQCZTGomcCDx5fPldNcSYunNQdM0u7HhGwwJaSM9objGGIBbOD6VUpvFH9D/BpgCmv2kJVp1eGX2arK89Ursr0ObeXnvVpJ87ntEY4VZKrjQ8e+UAWqzan3u0spiVZ8YjldhSOeFxR7t0sTdHQfmFcgQE/MVtKtnfs3liXpDnIFxpezbcA6ADwlYQn+L7kBKgeTiUnXeGpFzHvHbMdj3XlDaZ4oHmiH19SJ+sg6XLf34fXzvV8uNb5IrGfy+xGTO6srZkZk2cZCHOwKxOPFS50nfJsrM80Xn3n6ifB/CX7Nas9vUuCPzhLOHMxTKIIE8+T5oKhr0krFt1Ih/pJOtJ95Yc0HtyM2gtUQzz0PpVUH74LQn/7PG63rMS1WerHPHv1dlXhXrcDdpesPSDzTX+jxlXWg0S0VcNL8XDjfrH2kEey32M+IPdOThAYEMX07ia/q80mvE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(1800799015)(7416005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: dBXcXqsO8gWc3koJmA5cyNVK0rog/nPWIxN6Cksd2uqcPzj4KFQtM6+V9PC/1+nurztPH8IiKpxDfAer8iCafFHEfyDwqNXTnFarVEAzE79jLa9yxNGH+GH1BhpMgywQv9a6TiUOzWDgWt537lW/TXvg0XPQAsVs7KWRhKDFrmFBDuJW1vhJHld3uB0xh7quWLDd/nhhzLZKW85fE01eb/bNhQKX5d1Z+/68xa7PUMBeeGroBbSpvu4z+8+liXcxjdg4JuNBXYYEAgvqO+b/LxFgrWZLN0MJhrIRVttmLir60RstBYg0xMpNkB7ve3STPMrPAgOWSEU2Vl08As1ytfnhHNIoFHVjGt5M0jz/tDVb8JrbtJui9erksxmT5joTnXut9gh5G/R6WSoqPowcO+fOTk8qtbcnpY209/nhMVcYjLXeyqgoGyVsm9nJd2Um7xtO/WPXG/4n3RayUFcGMoDl4E0H376mAQihOe6yW4Nxs2y2fpvEUjkw+vgRXkCXSJtSrWs/aYIE17pIsa7yrn3UIBLERzakMF4qzzUDTOnveIxW3J8lWyGSc7v7bz6+XtwEq2NXZ7d0Qa32WhBkV/MLoxiKszW/P6OOshUi6VAFuRmcEudnHjFM7eGy2tHX3st7H/9qFrSQVfoStkL3AFASoomx7rTlJtRWHSSibTgFOJHesHKRv1ulgAH1z0SDzp3ITjf2E1ytpgoX9Po5GduAxpi1CJ5T7yYWOySfTyiSVxq2rZCV5NqgLBl4VbMQm2vDDs0BjPPyK8XwA0IaYhyRO4aTDcHqHaXlLqmvgbJ6ybVfOK7X4gbDzkjlACKd4PCOKmBqb694eruYZVwCZ0TGbF63XjhTWOKnOv8Fezl7D01XCL8MFNIqFmfcuwwoQIbVaZHLqwVszyeGJuKkkyuGAgdt7m/pxt/jEn5SNLmKyMUmJ7fmKAwuE/slnTwZ7yiPc8A6Fj0AAh+nw3fIC0XROCOsTDc0dmi1L9Rxgcp1poNCnwMsCH/kSDSHN0W28LY/QV54XWKUSvXQQ/Pu0dnExOv78MiRvsyIVkwFDa35q36TVuPqPa9hFAJDqoqL+Tf4ovk/38wY9lf8hlZ7mdaM0JkvazLf/0cyqah8oKMT4NWp6HyHQw2neaNJ0HMOY+R24ZYooMjJYm//lGeOVVsv3ZBC91+aDCh2UbLkpC9BHZYaFtwsAKe9aGltPxX0xk11b4VgY+yhJATbzslPaD1Hw37IzBxR1VLc2JV5n7an6NFAKjsbSWeyLB8qQzCz7viO0B45kxGwQj8hLqg703uJ46jUSX3dFkh60MFH+FbW4Ku2szJALDnG4UsUIZZ5AsJqwiKugKjrxrzYvJmjz5+hPPFfHN4CJCVL/THY8ZcyC+Iow/MgyhFHaWeYU07Wlss2yKSlGf2br4EAy2p+nOzlrpHtrzH/2BIY2B/e4PjcTLa2fsdhiX8epMRroZqDtNw9NHw0gqhqv7PsZe1m4p+cmL0bF6PMRXvZKZAaB3tbXmqLLtAsRWvQ0U8+EmMb8eoBfKH2STE20ZSCDfs5+cYOZM5JOreDWpxzv1S/35QwDOgIFbwpSFlQ6GVfOmyf4lSUMfH7ZilDrMzZLU6etFpES/hvCiTm/IASwZWYjDk= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: n2+MLyi8q/7YpbaaJ1e3AEAhC0YZi7liIP0KBPF140f15F2aw9pBfkUsH7lGaWymvKF75oMrT24e4XVYfVaPXdVoe5LhBGfP0MojRfF3Wpwl2cyVNgZ8GZ5NwKwDrNccruSA0iAESKAvfLcQ5SKukStrCD7Au6uhuXa9hr/VPUADmEkhJ2p1aqs9fQZiz5VYA1K+xq0JPnQ84VFB0ceqUGHqXvEAMBqJ3tiV3gf3g9oRMaFPUfVc7acj/43DIUbDK0cc+97/zkoIFVF2vbesBPV+A4nhUyErA1tRiMAMt5yEWt4SSKE5mNdLNSA9YkH2/p4fdAbBGPK0FuJeJTkeYFxh0x9Y9Y4nydS/D+JqnJp+p+ZzPWjL4ohjS6rTngfpIjtvA/c4B1QIj9Q9r7rVm3OTwfSOGlzwdQG7nXZtzv20kpql6cm5paP0VaV5go9Bm2S+uT2dAWvMhSNa9w28RaoF9Jm0/BWI7BWI8MX/38SsmEbRCn4IpnWlbga6GUiQ7RYwyANQ++h3o2WQMXhLlnMTZBd9ZAcKHwFniv85Ebt07p/jeFlCBYBzLrrGXgBfSDnqWDSMoCTpJ7rKchdYGrLYkSQZaDWP4rpmQ0TFg/o= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7c14497d-9387-4bab-2e24-08dc41e6fdd2 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:13.9156 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: NGerSaY2/YGRHSlQAyyAFESyxGcoO0bwGRNuTILy0383Qkl0DP2075bSW+8Pt9QyWBJCrHydVoQg+hr99+6rug/VSH2e94Ck6GbOnYpUQ0Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5119 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 phishscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 bulkscore=0 spamscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-ORIG-GUID: R2b2nbVzclaVKTsPfJ1mirEdEp7IBwFF X-Proofpoint-GUID: R2b2nbVzclaVKTsPfJ1mirEdEp7IBwFF Add the ability for the clavis boot param to persist across kexec. This is done by creating a RT variable before ExitBootServices is called. The new variable is called Clavis with a new GUID 193ccef6-348b-4f1f-a81b-0ea4b899dbf2. This variable does not have NVRAM set, signifying it was created during the Boot Services phase. This variable will persist across a kexec, however it will not persist across a power on reset. This same type of functionality is currently used within EFI shim to mirror MOK variables into the kernel. It is being used here so the clavis boot param can not be changed via kexec. If a different clavis boot param is used, the one stored in the RT variable will be used instead. Enforcement of which boot param to use will be done in a follow on patch. Signed-off-by: Eric Snowberg --- drivers/firmware/efi/Kconfig | 12 +++++++ drivers/firmware/efi/libstub/Makefile | 1 + drivers/firmware/efi/libstub/clavis.c | 33 +++++++++++++++++++ .../firmware/efi/libstub/efi-stub-helper.c | 2 ++ drivers/firmware/efi/libstub/efi-stub.c | 2 ++ drivers/firmware/efi/libstub/efistub.h | 8 +++++ drivers/firmware/efi/libstub/x86-stub.c | 2 ++ include/linux/efi.h | 1 + 8 files changed, 61 insertions(+) create mode 100644 drivers/firmware/efi/libstub/clavis.c diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig index 72f2537d90ca..8dcb5326d05d 100644 --- a/drivers/firmware/efi/Kconfig +++ b/drivers/firmware/efi/Kconfig @@ -186,6 +186,18 @@ config RESET_ATTACK_MITIGATION have been evicted, since otherwise it will trigger even on clean reboots. +config EARLY_CLAVIS + bool "Early clavis" + depends on EFI_STUB + help + Allow the clavis boot param to persist across kexec. This will create a + variable called Clavis with a 193ccef6-348b-4f1f-a81b-0ea4b899dbf2 GUID. + This variable does not have NVRAM set, signifying it was created during + the Boot Services phase. This variable will persist across a kexec, + however it will not persist across a power on reset. During kexec, if + a different clavis boot param is used, the one stored in the RT variable + will be used instead. + config EFI_RCI2_TABLE bool "EFI Runtime Configuration Interface Table Version 2 Support" depends on X86 || COMPILE_TEST diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index 06964a3c130f..c4aef94d877a 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -85,6 +85,7 @@ $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE lib-$(CONFIG_EFI_GENERIC_STUB) += efi-stub.o string.o intrinsics.o systable.o \ screen_info.o efi-stub-entry.o +lib-$(CONFIG_EARLY_CLAVIS) += clavis.o lib-$(CONFIG_ARM) += arm32-stub.o lib-$(CONFIG_ARM64) += kaslr.o arm64.o arm64-stub.o smbios.o lib-$(CONFIG_X86) += x86-stub.o diff --git a/drivers/firmware/efi/libstub/clavis.c b/drivers/firmware/efi/libstub/clavis.c new file mode 100644 index 000000000000..3a715e87a13a --- /dev/null +++ b/drivers/firmware/efi/libstub/clavis.c @@ -0,0 +1,33 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include "efistub.h" + +#define MAX_PARAM_LENGTH 64 +static const efi_char16_t clavis_param_name[] = L"Clavis"; +static const efi_guid_t clavis_guid = LINUX_EFI_CLAVIS_GUID; +static unsigned char param_data[MAX_PARAM_LENGTH]; +static size_t param_len; + +void efi_parse_clavis(char *option) +{ + if (!option) + return; + + param_len = strnlen(option, MAX_PARAM_LENGTH); + memcpy(param_data, option, param_len); +} + +void efi_setup_clavis(void) +{ + efi_status_t error; + + if (param_len) { + error = set_efi_var(clavis_param_name, &clavis_guid, + EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, + param_len, ¶m_data); + } + + if (error) + efi_err("Failed to set Clavis\n"); +} diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c index bfa30625f5d0..0d9c6ac0a652 100644 --- a/drivers/firmware/efi/libstub/efi-stub-helper.c +++ b/drivers/firmware/efi/libstub/efi-stub-helper.c @@ -91,6 +91,8 @@ efi_status_t efi_parse_options(char const *cmdline) } else if (!strcmp(param, "video") && val && strstarts(val, "efifb:")) { efi_parse_option_graphics(val + strlen("efifb:")); + } else if (!strcmp(param, "clavis") && val) { + efi_parse_clavis(val); } } efi_bs_call(free_pool, buf); diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c index f9c1e8a2bd1d..16e50a124ce1 100644 --- a/drivers/firmware/efi/libstub/efi-stub.c +++ b/drivers/firmware/efi/libstub/efi-stub.c @@ -183,6 +183,8 @@ efi_status_t efi_stub_common(efi_handle_t handle, install_memreserve_table(); + efi_setup_clavis(); + status = efi_boot_kernel(handle, image, image_addr, cmdline_ptr); free_screen_info(si); diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h index 212687c30d79..81a1f013f483 100644 --- a/drivers/firmware/efi/libstub/efistub.h +++ b/drivers/firmware/efi/libstub/efistub.h @@ -1060,6 +1060,14 @@ static inline void efi_enable_reset_attack_mitigation(void) { } #endif +#ifdef CONFIG_EARLY_CLAVIS +void efi_parse_clavis(char *option); +void efi_setup_clavis(void); +#else +static inline void efi_parse_clavis(char *option) { } +static inline void efi_setup_clavis(void) { } +#endif + void efi_retrieve_tpm2_eventlog(void); struct screen_info *alloc_screen_info(void); diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c index 0d510c9a06a4..08bd6224d17a 100644 --- a/drivers/firmware/efi/libstub/x86-stub.c +++ b/drivers/firmware/efi/libstub/x86-stub.c @@ -928,6 +928,8 @@ void __noreturn efi_stub_entry(efi_handle_t handle, setup_unaccepted_memory(); + efi_setup_clavis(); + status = exit_boot(boot_params, handle); if (status != EFI_SUCCESS) { efi_err("exit_boot() failed!\n"); diff --git a/include/linux/efi.h b/include/linux/efi.h index c74f47711f0b..d0fe291d433e 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -420,6 +420,7 @@ void efi_native_runtime_setup(void); #define LINUX_EFI_UNACCEPTED_MEM_TABLE_GUID EFI_GUID(0xd5d1de3c, 0x105c, 0x44f9, 0x9e, 0xa9, 0xbc, 0xef, 0x98, 0x12, 0x00, 0x31) #define RISCV_EFI_BOOT_PROTOCOL_GUID EFI_GUID(0xccd15fec, 0x6f73, 0x4eec, 0x83, 0x95, 0x3e, 0x69, 0xe4, 0xb9, 0x40, 0xbf) +#define LINUX_EFI_CLAVIS_GUID EFI_GUID(0x193ccef6, 0x348b, 0x4f1f, 0xa8, 0x1b, 0x0e, 0xa4, 0xb8, 0x99, 0xdb, 0xf2) /* * This GUID may be installed onto the kernel image's handle as a NULL protocol From patchwork Mon Mar 11 16:11:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589042 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C019C4E1CE; Mon, 11 Mar 2024 16:19:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.165.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173987; cv=fail; b=lenjbwdBuYewixGr0OSGmiOcDF/s2kibhpr1pOV94USo/+iTvcFE+hxEVjA8wZNa5F03hfyY5ZeHY61CaKoNPs+0s++rY0Oo2kMNU1Emw0fW9sjpaspVvlWq5Fbd+Pv299LXYHHW89uQb1Rp8tQ5VFGiBK0aKa/O1NwPSgJg44w= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173987; c=relaxed/simple; bh=aOaEFWq48kYowRvINXrbrcN7pk0Q/LJ+r0sLhqGGFpA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=Xh5BRVphJMfYN4kDzcr3cCxBm/03SKL5j9VH0u197U9eJnlCREtudW0lMyn63j9sKucQlwCVn7UOEpyCCf5JYUbTbW75a1vL/m2IdxRz8ZzYVQ7dPvmorLEOaZnkPEkNoOAVLf2dmh9nrt+qtRv2dewdkQovavwhEIFNGuLcmLs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=NrNhSx4k; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=k1RYLIS3; arc=fail smtp.client-ip=205.220.165.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="NrNhSx4k"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="k1RYLIS3" Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG4skU011481; Mon, 11 Mar 2024 16:19:22 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=QJ2mWccsllAndPvjMKTHXgjM/qF2M65Rf0FCdAXn+YU=; b=NrNhSx4k2IwQJaTSBN5AniDze/nIBK689JghuPSEAJ3wrabsIR7M4ZTSOoGYLhaetxqA 6buDuw8v1oYz6MXTbGN8JbES6ZvdFRseHAwt+eTUFogVqG/01RoNw71FEiJrinl1YMfC vf5Aex8xtfitRu1H+WnBmpZs2LJfw9D+9O9YujCCKiSWy79tmVcQEQvqgttLfe30sHlP TZIBldvo6jt+EAqbmpkJhW+jIybzkWkjMfmbS7BcKmGEF1oAHIkqEqd0qHEecvTHStDe r4puJQs4FQzOij2OkDlcbjqz7a3tOVIShEwL7iCk6ijtdNnSI4HvIMW5vgG7xAgouaWC lw== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wrgaukqep-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:21 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BGA08Q033763; Mon, 11 Mar 2024 16:19:21 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2040.outbound.protection.outlook.com [104.47.66.40]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3wre75qxd8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:21 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=j0CXbVPcVrrJco0Nw9K9Pw8P8Asw0Lc1dUCxZBl0bl7Irwc4G5aOqzHOrcQVYnyw26wnDZv3zcJ+LiyJOQ6PUhIe/EYmpTqFohrmbIk5dCv9x4uQfooztcJ8xyw718PZ26HRkf0QPEJDJJbAcxteHUqAjDkPD5i7C4d3YpwW2GgzTbKRPqiAVbeen0c1LjhqEOTtHqnwRYTcoKU6gHT85DPb9aOLqAXPWj+/hLUlDiQyaWkQXwA1ndaCizZzsL/SFjzqDbqu8kMVcBqU9NeUYL6+ov2VpcnYq1J0J6xpgwEJWDwq4Xwc/fgiwZ7e2zsT/uTD4VUNWtx4p7hkw0WxfA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QJ2mWccsllAndPvjMKTHXgjM/qF2M65Rf0FCdAXn+YU=; b=kQhlCwuNX34bPWYXK6NRLcTRB8TD6dsVfUeuJm8OC0ZZzbhwkQsy66atdGR8tZekfh4mICwZfjtWbEarsWlj/Vgq/bKzr+s3NS/GWVszVfFjK/5R8loyYifivbgJXHnOaNHOuyYI+W+eUpXSZ5D3K83qdrJlpIrpjl39wSGphyuWiSt0xhsJUICm5rc0wJ7sObcCeoiJ6uh0CT9dvgwqOCb2ps30+qiKvi4i80KtaQhCNFKcCzD+45rV6NyUiEIC29NBQ5RRsYEkDxrcj4tm9Q1lvBno6uDBpUMJJKL2z5ybV7HJ+qxleZ1qR9bCdG904f9QnSywcHNU3bkWhWZL/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QJ2mWccsllAndPvjMKTHXgjM/qF2M65Rf0FCdAXn+YU=; b=k1RYLIS3NM8nkWHauxdLVJeo8uTAKV6/TnqmGjC0x4UCxJBfWGOpljNf0tZe9U/5nvTaT3WTZPRMuLsEQxx3e/870SWGDiouVSou7P8YkuOGn6GNVpT4HxVPUTEtAZ3RjFNXUbicdAzulN6XL2oYyKszV2YTVfiFevCh8LAxM2A= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by MW6PR10MB7589.namprd10.prod.outlook.com (2603:10b6:303:23b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:18 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:17 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 4/8] clavis: Prevent clavis boot param from changing during kexec Date: Mon, 11 Mar 2024 12:11:07 -0400 Message-Id: <20240311161111.3268190-5-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BL1P222CA0007.NAMP222.PROD.OUTLOOK.COM (2603:10b6:208:2c7::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|MW6PR10MB7589:EE_ X-MS-Office365-Filtering-Correlation-Id: c1c6ed25-889b-4253-69fd-08dc41e70006 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: c2PG2CcMZjIyt94GL0ajhRcJ1aqtStZsUGGfv1CbiVOL9zYWfDB4olfB3QPzFmKiYMyHx0qF4yGNXPJ9qwprrk4fSdu19VfzjBu9KmM4QTnWbUZiGrlSZ0KCDfm38cfvA1LXiHD7zOUTfD3HPY5CqsyYztRO4scewzOqmpL+YtSGzJVtxfkq/aET6KPOSTI5R+J2YNFJEOsJM7g2+FW0qlPwW8gIpwAnxnE9Z7arJcYmwglOAJAn8bu7am5Hrzvzmorp6UNhe7yvipKP8BrgJVqc4ZSj5A+sENdMHeSxXqSYCXXOyWCYOOGau+Z4RwJJpg0or2+GlPkJfb+JnSc960gu4EBsm46Xf7sM9wi3m4CxMkKrAkBFho/LDbKdG9WnjvuA/wsJQh0Kkb3N3K/heQcJvNBlENZEsIc+kBD2jVoAtCkC4n9wYAZKbzJfabqGEszBgeJ60mKLoXDV6Kfz5TGwlKpA41iJdh3g5JBa2bFzrISKzT6RkitZC1Y6Zkk3E7g5hGHWYYH36ktYznbv4d1HpbNnHLr8/FSFEC/LVuuD7mXZuwQYYaCWIx4t9BDazW0my2fM/BRPPlvXtLXpIMgB39v1q0TTfzpShHspb5qF4FXVlKmGNpf0Op+asz01Je7wti8PHU09w1WyNObrc5COh0vskXqsIhgwG6Pc/9M= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(7416005)(1800799015);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: AnRaw8+p4qLF5w/1yJ8XLr8i3WFzb1mhC3b2FbcIq5FO/jZYJ5qE+UHE97tbqY5GE3L2Uj1+LCJGOY5BNLLf0cbV/MowyPTMv4cY1XPNfuWQ2Nq44MpwLmMoFT7J5QLUQSKJsOv13M5ftWaURMG0IK1Af7tgr2EH2wN1qaqcAN3dPJgEJhdpAsVGAGGgoSQKD9AinexsEfVXX9NU1KOVQ89BGKW/hqO0rPrBmXzOI2SdmvV4oOCsMDDKbFE5WlTeYR/GH6B4aB7X5Rrzop42odquq4Io4Qr7rWYgeqQHLy07aPqoOgyvajmUMJwOTbdtt20pxNcw3J/bEYCGJKV7xF10qaf65cw7XBJdq/nayxC218KmTUTGhp0RGWb6aggzdFI/dAnF754AiWR29FYuUAzlcWtHDxCreBuwRk24tDC6xyBjgt6q/rFem77C0ZhSLucikhfSPvQqGDUFfCozDJU0XvwX+rBch88Jor+P/gAKzWp577Gsb49dqoVtvovhOoLdojHcPocm6Rg5OIdNBrOKMRyI01Co8qCwpbtyGV4kyTFeXk29iCo9498U+q6UvqKc5ex90v/ws1I/fq4eCynsbHrkUwPhaxTX3DUF8AzJYzkgNUa2thKLdqUFlTNtXLXVWzLNJkATHFDpwOUHz649Rb0QVYPDYxTD9X0+T4RgmMrgU/XfvlNsRogR0vj1bgW1otSS/6w6gMf70kqs1NlJPjebVsiuNfOov7tgMLDkw7t/6MSaV2zscMsAyJx0FCjnYTzfglO1BOd3Vsh2WthdPFjdDH3ChwCmRk6w23sfk31aSeY+FOe8QGCETuJe9FKOPflo6f0tQG/WwWsFN23MUZu1ag+z+WtWayuCTXk0LEHSSo62uJwL4TZlT6FzdXW8acMzC5G6HbJvEoZhXYZUp/fJ5Y1IEHOpHqRjZzF8UO6+9n38OpbsRSRvpPUh5M3pRtT3Pwahc8kZXGyH58rLu2aJk47Dvh/9haAT2h7oVhJ4hcv5SiZ1DroY9kNMuehzCnXyhbiZs/9t36J6eaj/Hc9SPs/fkP6zgxEWaWb8OStFHUx0GwA6NM1D6PmMKVKDD/UEk9Z9Q2ynbeG7RmN5v4gpURJ50RzSajw4qOoZ4z1Eg2s1C42BBJjdVFn43Exkcw7zpw67p1WpV7ut6z+zTb6l7P0nA3pWDwUsjPjn2sLOFYJoyE8z1VHkBJRgw6OXWuEKJQpdlKNCdCFveZdlAQ7R90d7/toSmjWE/4iWLAHBlW2b33Dcevnbsel+luP9CI/jzg2JdP5bWqTHTtNS5RyCkLpyjRobGxWgdiqVGU1a65QRmLPP1pV9jQ/aB3WZqQ1kaXTvQ33ibbFUZfWEJzGhqkxtnZLDZ9ncSODUUfWVt9sztHNm9J0m2sXg0+jd3KHUCw1JFRWj1PtSkc88Z72nRdZn06oFR2lr2sdllhWQaIvMEAeBIe92cupPXmd2N+4hExCEmMDj6CQ91rkxDrbSQZC8zhUkSW6S0htpTXxxnv+RNWi4VeMYxR/348l+95Ft+OpFVALbNPO5bQInSIKbY4rP80CvT4cBsy2VerMJJbQr8l1m9hi4stRjl2VWBuX7/RHXHxoJROVIY69e7gGxBxnXXZMwagHM1SU= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: XBoyMWBbVFaHrevPRNx3pOycGr0GRl4ka5DzQBiGAD2F7Cm7B/GfuNPekVnoh2eNYA0u6+iuLGJBkP33M5jJqy4wEM81qaY0QbGtARIgs6/wCTqsBoYT7Q5MWBE2ouxjgPujLr4IrIUmvv5rgW7i9KYOfWt7Hpivr6/008qJpT1q2XVvCrsvc3rtWrkj/LjiyL3tl49coYa8PnxR97xrCcH/MT0dWxCmLsRL3Esi4tOeJuGn3RlNFm8Jw4cDDipdDIfz+PbnzON0BWmBFsGxIqLWo2yP+M8iTRzokwpx5qcXh2ZEzuI6iPVt6AIVVsb8jfv4kKPlkrS5VEez5nCqnWpuaE19gSK9Bzk028SuN09A8Oku1gIEVOm3TcsatlMz/R3CDCsPlipCVRsBYRMfQ+69LFyrcHyyyrCc4CVVFJATzpqc0vCZHk8XBiIpnJ4nMi008f3Uj1HhEwY+w+Cw1DA3MotaYz8gP0nQ89/dK+YhPDsU0KEwJ3Kiw7HfzEvZ5008CVqR2EH4ISOMkb6XZkf5TnA32M+S3X1WvkcBWLix64oJP5Cb7k/Kga2Vvj56h6K6JuT7xUEWealJ94jMv22vnLiUVgUVQgSM/hEbDyk= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: c1c6ed25-889b-4253-69fd-08dc41e70006 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:17.5387 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3H+MsUn86e/fpvlsW7AlKjxSBXkhZZio5rurHRI8mPOOaERisAHdZPa2byuhv7XTgfT6hWoP/mrrnalDiJTDxYG+BOLBnvk5RH1icnE54A0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR10MB7589 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 phishscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 bulkscore=0 spamscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-GUID: 7YjW01kYDsusCbQ1C5RMacIYkrWnxePY X-Proofpoint-ORIG-GUID: 7YjW01kYDsusCbQ1C5RMacIYkrWnxePY Use the new Clavis EFI RT variable to validate the clavis boot param didn't change during a reboot. If the boot param is different or missing, use the one stored in EFI instead. This will prevent a pivot in the root of trust for the upcoming Clavis LSM. Signed-off-by: Eric Snowberg --- security/clavis/Makefile | 3 ++ security/clavis/clavis.h | 12 ++++++++ security/clavis/clavis_efi.c | 50 ++++++++++++++++++++++++++++++++ security/clavis/clavis_keyring.c | 17 +++++++++-- 4 files changed, 80 insertions(+), 2 deletions(-) create mode 100644 security/clavis/clavis.h create mode 100644 security/clavis/clavis_efi.c diff --git a/security/clavis/Makefile b/security/clavis/Makefile index ff19c1e240fd..c008cb74c762 100644 --- a/security/clavis/Makefile +++ b/security/clavis/Makefile @@ -1,3 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 obj-$(CONFIG_SECURITY_CLAVIS_KEYRING) += clavis_keyring.o +ifeq ($(CONFIG_EFI),y) +obj-$(CONFIG_SECURITY_CLAVIS_KEYRING) += clavis_efi.o +endif diff --git a/security/clavis/clavis.h b/security/clavis/clavis.h new file mode 100644 index 000000000000..3883c390b9e4 --- /dev/null +++ b/security/clavis/clavis.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +struct asymmetric_key_id; + +#ifdef CONFIG_EFI +int __init clavis_efi_param(struct asymmetric_key_id *kid, int len); +#else +static inline int __init clavis_efi_param(struct asymmetric_key_id *kid, int len) +{ + return -EINVAL; +} +#endif diff --git a/security/clavis/clavis_efi.c b/security/clavis/clavis_efi.c new file mode 100644 index 000000000000..7bc8ef03794a --- /dev/null +++ b/security/clavis/clavis_efi.c @@ -0,0 +1,50 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include "clavis.h" + +static efi_char16_t clavis_param_name[] = L"Clavis"; +static efi_guid_t clavis_guid = LINUX_EFI_CLAVIS_GUID; + +int __init clavis_efi_param(struct asymmetric_key_id *kid, int len) +{ + unsigned char buf[64]; + unsigned long ascii_len = sizeof(buf); + efi_status_t error; + int hex_len; + u32 attr; + + if (!efi_enabled(EFI_BOOT)) { + pr_info("efi_enabled(EFI_BOOT) not set"); + return -EPERM; + } + + if (!efi_enabled(EFI_RUNTIME_SERVICES)) { + pr_info("%s : EFI runtime services are not enabled\n", __func__); + return -EPERM; + } + + error = efi.get_variable(clavis_param_name, &clavis_guid, &attr, &ascii_len, &buf); + + if (error) { + pr_err("Error reading clavis parm\n"); + return -EINVAL; + } + + if (attr & EFI_VARIABLE_NON_VOLATILE) { + pr_info("Error: NV access set\n"); + return -EINVAL; + } else if (ascii_len > 0) { + hex_len = ascii_len / 2; + + if (hex_len > len) { + pr_info("invalid length\n"); + return -EINVAL; + } + kid->len = hex_len; + return hex2bin(kid->data, buf, kid->len); + } + + pr_info("Error: invalid size\n"); + return -EINVAL; +} diff --git a/security/clavis/clavis_keyring.c b/security/clavis/clavis_keyring.c index 9f1aede81992..c5606ed101f6 100644 --- a/security/clavis/clavis_keyring.c +++ b/security/clavis/clavis_keyring.c @@ -3,6 +3,7 @@ #include #include #include +#include "clavis.h" static struct key *clavis_keyring; static struct asymmetric_key_id *setup_keyid; @@ -82,9 +83,21 @@ static int __init clavis_keyring_init(void) void __init late_init_clavis_setup(void) { - if (!setup_keyid) + int error; + struct { + struct asymmetric_key_id id; + unsigned char data[MAX_BIN_KID]; + } efi_keyid; + struct asymmetric_key_id *keyid = &efi_keyid.id; + + error = clavis_efi_param(keyid, sizeof(efi_keyid.data)); + + if (error && !setup_keyid) return; + if (error) + keyid = setup_keyid; + clavis_keyring_init(); - system_key_link(clavis_keyring, setup_keyid); + system_key_link(clavis_keyring, keyid); } From patchwork Mon Mar 11 16:11:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589043 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C0FD5B697; Mon, 11 Mar 2024 16:19:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.177.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173991; cv=fail; b=K7iEPa9tknULNHFLx30e7gGRhr6Ct2LHWpFJfiegK+gvvM/SHGq1GkybU7dwjgXXcqoYyF64Jws1ZRCWKucmn4z1pw1ZrwW5k4aj+nOmRpu+fWYHma8/lLJU1fEhuLwNtQovLulsamY7w7BJa4O6GvGJhurNErPIy4XhXr2NzY0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173991; c=relaxed/simple; bh=jqfk8OOxs4/Bz/cC5CmbiOlqcono6Pb6OaERcc5bQKs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=Q3bSZ95Rk6ZGa+tGTJjR1B068V6Ms3QaHwPiCkhS8LZqPYOpIdGhx8JeyuNJ4uptuweqw7jn2t0peize6w8QOeulxPNmhH956jAkxnIJqP4Iab+C7f6HsgIBJoCNIOYs7uX93x9aGMbClX6hg1HAw3J17Q/mHXQDy4vB8RhvjFc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=EuOC0uuW; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=d8zBedfq; arc=fail smtp.client-ip=205.220.177.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="EuOC0uuW"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="d8zBedfq" Received: from pps.filterd (m0333520.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG4018008047; Mon, 11 Mar 2024 16:19:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=LexnYcogTGCZEOS7+4Nj7Rx1wuA+oQqYo/tXnUCa9Rk=; b=EuOC0uuWm+UjfUIoLjPQhXQpJ5o+m9uHqfifhf2btCNvNV6WyTMI4n4hjRHgYAVsRGS2 Mb9yeFlJmO07GSfoFQilX0wkiNkhYFveR5wxZq50ITaHgfUTRdgrBtncZv9yBWB9pX+/ XLNXtiDEI9xRuW9Ru9y8aHKg1oKlB390vvv8VnR39h5TY8v8Rw0WNxuS6BYDt0CnEvMw yMxGxqZiXDIptQ+vBHFYN1LOYnRCZL7yxjo7eDkpnMYhvndT6Sf3TpdxLMTNYTx3/qrL kBFpKV+q9RL6RzRzZNRsBD+m5of1sBSkq0BliUUJu6JQrsK/43Sgzgy5wUuHjPqbPYal eg== Received: from iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta02.appoci.oracle.com [147.154.18.20]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wrftdbtkg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:26 +0000 Received: from pps.filterd (iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BFpu1D028554; Mon, 11 Mar 2024 16:19:25 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2040.outbound.protection.outlook.com [104.47.66.40]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3wre75yf24-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:25 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=L4FyB3daBE2CXosLqsewxeju1hv0BN+nweZ5wtJ6thZanHFf4YJSpb8Msq5U1rBaymJXmcgOiPwCLmQkzfHYcd7lFMwoD/NMs4oyNIH+oJVUR9zPb8wmSkNMMyyXB1usQ1QLCzeBCb2BHu4lLuCxGdLyGu304KvHDy5wm4aSpqafuFC79oIL+gSOh5x/bDkP0lDfiAcurgy0Z/8H7vmXwTeOCOXwte2/ADImjMnM4fFR989x1WUbLBcvA5xA6Y9YJ6Y0ondXiqNXPdL+ZArmQmhVDs479PXGq8eq1CVyd6ZyShzaivYJ0E5JquHa70rs+ycCbUCEnJtXj9G4pqP98w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LexnYcogTGCZEOS7+4Nj7Rx1wuA+oQqYo/tXnUCa9Rk=; b=QP9GeK2Ja8Jo/nYQhWK+I8nRjQiES5KIR/OQURuJQC4WWtsFGaLNnW/xwALrLtRgtrCKFE2Ao2tQwZNJrNWqD68z0g8X9h1uXc0GON0WyRVcZGWfVhIubCbEKfrzTK/S+cwk9me4E2ViN+W6F9kjsrgDjXJzBg3RyPuVZcLR5upCKj12uO8orAw01iy58PhMZT3vW/fCSOFpNBVlHFDdI1U9q7yihE5zyuBxAkBjvFzwuaFjB3cnlFeNGWt8xtIpni6EvE+ubyECvAlNhSfUAyHBg3C7LEKBsje33PlRI6bLCSliPpA4YY8fPtlatBTkEqK3MtBttsarH+KzNgdKHA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LexnYcogTGCZEOS7+4Nj7Rx1wuA+oQqYo/tXnUCa9Rk=; b=d8zBedfqbXHtImYRfQpfJf4jRVhp2N9gH7Qdeulylq+BS5I32Iyrb+580oGq4fa4klwJ1+jeqx8yc58bDr8B/DAoc6T/mKUnYWirsIO9D2CA44RJdhoj4i7lYXFAKgpS8UotTtapNp1rQ84inIUdBIfKilxh61Hw3LFNMQ+CH/U= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by MW6PR10MB7589.namprd10.prod.outlook.com (2603:10b6:303:23b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:23 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:21 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 5/8] keys: Add new verification type (VERIFYING_CLAVIS_SIGNATURE) Date: Mon, 11 Mar 2024 12:11:08 -0400 Message-Id: <20240311161111.3268190-6-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BLAPR03CA0032.namprd03.prod.outlook.com (2603:10b6:208:32d::7) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|MW6PR10MB7589:EE_ X-MS-Office365-Filtering-Correlation-Id: 17afa830-f135-4fb1-ec38-08dc41e7023f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: lDzveHQTxMNtEwsAQUf7OfdcRDEKhZJ7KmKzOf4cqYup/HDT9e44zeEPF4++pZ1MFdOPB8Cir8y5i0+GYmsLjnFnHcw5hg+5B7W6MHpYGE7q4VO0DyYdAby/t2n/IpmyN3rZBbPCamqpT8N5CAkW32hxPeswZX5fNJAPr6nJq/sPWA6ddnS9X1pp7bmP95eLQsA/8sB8VdsPiPgrF9vzo0n6WpBywVnd0+a2LYy4Gmji6jfnAcagnER5A5g6YFLviIXRLBiIhhMLhzMz3WBfMDrWvag/5dnLj9hOu9t/MGezulTGta25nPttuzltAxf0sjbMpUX4/OFYFGh/ecZkuUn2l8lcrGLBYQ7uRR3Phb6BzMUWBCTCq8svHPfgvMuhnIfMZXrUCxmGQBCCPW8QAWncIOg6PBQTFlmdKut2DRa/Ifb/Wn2KnM1vRgVVSPFGaSNrkVEba6vySR2bJq3WhHX43uvNLnpfLGjtXmmJyyAJpuVz11dG3dEEMuJsowfX8P9HXeOg23uEuRJgwyTdxfoapSscwsp8dQ7GopDV0ChVdiSLDHQmj66ndRvkXm+6U7NR2Gp7lFFHQinrnGgTNZBD8vWEdsvD6olghZ/ES6WtjGIaYSEWQS2MBgFewY2W+FKpgf2NT19wvUw57MBC4hCli2qkfcl4JR4EhrfL2wA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(7416005)(1800799015);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Uq0Mg8gQxLmDzp+/sRwtqqTcxMr9oStDKK5j8bK7NtZwkf6+IXzXmLZTTu0nxN4iFtGyZ2XfmT7sIwPO3g180bv8omst58fHTFluolk1+lzVa/CD5r+6zHsuAWZVx1/uZo2jTDRnGzpgABQ+r6ZCw2gx7VMGGpIupDN+5fqzHRhIVO7/5yOqln286Ffj2+L8xofJPCH3TiFqyR8Ez8bh0bOkVMtcXDDCJk3Y/OwD8Wv4E2PaW33RASZcvkLHE89bYVTSmm1CiPsVnxO/k8UJGf5WjXHLMgcGf6UT/Xe2evN+TpdDcYZ6TidF0IBdN2+bSjtedyJ0dv6X98nQlVOGHhXXcpb+TscEae8fYZ3k5a0r5f4mviZIY4BVtr/IYd2lDUQQ4t9WvwaewdaK6Jd4N2nLZ6sPt7NoqwfL26r/Ho467aLdVcXS/ShNHYl6WRdesulFZfrhDo7xi3hp6Nbtk1DKVWiuJVz7q2D84rLjA2DK36TEWJMGUOQ76VbbTY/8KrDqMlgNq3UTUOUbyhL+hs5MsZRULjhXyOMiosLJl6RgoqqxYVMU7uqJbiXYIriTjpVo19iAiH+Nmew7RAYOMNsLLgbhHknYOMBj6lQCvjwonFqrweFd+HAoHrDbQsgg7KgtZfmYoVVccY8VGQg0ei06WeIG4oamKI2yBQTE8+uGVfhEZ+2vY1bSBrUs70yVvVv39MDeixkOXd87OoO23c0G12FmRzJ1WvSfkU/zNdVe2YV76mcCRNc/xnHxqMpgotjg/9IT9ucTTwZpLxVrB/R84IJuu5qUL8N+NHK81/yhgQ8yWO2cx3ou5apJ2oPyK7O2bddj7vAHxRnQk+SqJbscy/SybZLf+n5zMBYLsT+DD3L9FOF3BpAgxX+Vze/jbSi6qlygcJlEoSH4fqWM69IinwdxFeCXqJzDAopGRHAOKDfp2OsDQIIkA7YxY+NyBLbqflO7Rv/JR0nLscdUnq1G8ar5cPoRYXqSo/5zy3kBfGXDTisbvrkgFXJUoBkxPhQlO6/cikeMoD4EFKfVWhKKPQdmnWZVzWvDy5jxWfrFU3wQqXlJMlPBRWJRhCJ5jZu3keify5GzWjzMO37QhV7jQvsI7Prdxha7ePTAYVWdAUUsPwM/5ZxYAstyjQmjSpI4I0wmmxlAJiEElCKXsRY9GMiJoiJGR83hQs7pKa+Q4nvlIs62esdxdfQ/VQo65TQUj3vFs/42cDniRdlEqqugNHBM4QQQNaM92h4cMmp7YKeNdsQXmnn8YD9rqcQ5Kh380MVF56jFr25ec4WPQj5RGRZjrFJDWi4GBcypduWNvh+YIMfakqe9J+S9SoEwmBI3+o/4f7Q+XzUticnVlg7+Xuvcg+86D6h1bwHE8JIJC09KAfH2Gstk4SUU9M1LENfb6PHW9K6eXwUMfasEh1Htl1vZgrS21SCcUHGfZdPpnMwVYN8nptbR/k30PsLH4e2h4XxMVKX0tMhcHIdHUGUJ2pmVqZln7foLbRba2VH43CugTRwbEPNwQiz8XfYp2Wg9Z7QjjVLNEaGL1qYnlqSAXCQ3bXH0tVMD1qnRYFhTVmK+ZBqBxbMRin5Xt7REvMbloiD67A7+heimJP30NoaH8VofxB2EabWhJC8zr0E= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: hm+ubv5aMdDmvFUPPh/oFnthJKl9M9xKPPYzTHi8HmTiAu2pjyIp3Yxg9QwlZUbs+wIbkxjFfiZZ87gP5dHpze446C1DUVpjWw+pwEJSm7KTSy9NbsY2n+pB2/b29aLZ8qNJzcXU6kutb0WdulrmSfFF2rid6uwHj3ffv4sEiVIEUBRkSf4iPbICyLnU14/3Oao+nV39bBOUWx/Etb+bS3pnVYmlcu6o9KswD17xS00SHZcPXOLCbW+fUIaiq9C+tKKfsAuC/adf/Hk6gROpYR64/UVhDC/ND44aQooP/NF1SjmjE0GByZ24DFUj0S4giCURg3knxmOzKPCc2R0DAOgSVs8fAmAssFZhlhDnaCHgIKFuZJDePX6tVk576fzil+ub8i7osTo3ZxlVTnpQ8KqWGSn+kVGjFVmEvYIN9qQK7gO06Rpljn48sSAWywM4yOiGDImefmVjemh7iMPriIdNm1zUzrDPqQDww/ljP21uuVs05bGEwQE9iSI6kORGdys1DNSYwND9tBdgpRR4/4m87CKEaVFfRc6SzSiudWF2/Unl+mzWaIC2BfwSp9LjljVzPu0LKKwl1DnnOlFhYUNDPxXN0YYkJpAfeYy4Bc8= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 17afa830-f135-4fb1-ec38-08dc41e7023f X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:21.3903 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: VyGq7RwxX9u4wrig3Vf5FGmqJXmTJvkaFicTv06cyzatVkxOmoKKWk9BWdn63y+/NZDe1V40/BZi5cy7MMwmEjAd9ENDsbQrk4smj3IaWgk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR10MB7589 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0 adultscore=0 mlxscore=0 phishscore=0 spamscore=0 suspectscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-ORIG-GUID: hF3u4WBFwUOXt5CDHYvShcPIuFuAleQ- X-Proofpoint-GUID: hF3u4WBFwUOXt5CDHYvShcPIuFuAleQ- Add a new verification type called VERIFYING_CLAVIS_SIGNATURE. This new usage will be used for validating keys added to the new clavis lsm keyring. This will be introduced in a follow-on patch. Signed-off-by: Eric Snowberg --- crypto/asymmetric_keys/asymmetric_type.c | 1 + crypto/asymmetric_keys/pkcs7_verify.c | 1 + include/linux/verification.h | 1 + 3 files changed, 3 insertions(+) diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c index a5da8ccd353e..7fdc006f18d6 100644 --- a/crypto/asymmetric_keys/asymmetric_type.c +++ b/crypto/asymmetric_keys/asymmetric_type.c @@ -25,6 +25,7 @@ const char *const key_being_used_for[NR__KEY_BEING_USED_FOR] = { [VERIFYING_KEY_SIGNATURE] = "key sig", [VERIFYING_KEY_SELF_SIGNATURE] = "key self sig", [VERIFYING_UNSPECIFIED_SIGNATURE] = "unspec sig", + [VERIFYING_CLAVIS_SIGNATURE] = "clavis sig", }; EXPORT_SYMBOL_GPL(key_being_used_for); diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c index f0d4ff3c20a8..1dc80e68ce96 100644 --- a/crypto/asymmetric_keys/pkcs7_verify.c +++ b/crypto/asymmetric_keys/pkcs7_verify.c @@ -428,6 +428,7 @@ int pkcs7_verify(struct pkcs7_message *pkcs7, } /* Authattr presence checked in parser */ break; + case VERIFYING_CLAVIS_SIGNATURE: case VERIFYING_UNSPECIFIED_SIGNATURE: if (pkcs7->data_type != OID_data) { pr_warn("Invalid unspecified sig (not pkcs7-data)\n"); diff --git a/include/linux/verification.h b/include/linux/verification.h index cb2d47f28091..970f748b5cc9 100644 --- a/include/linux/verification.h +++ b/include/linux/verification.h @@ -36,6 +36,7 @@ enum key_being_used_for { VERIFYING_KEY_SIGNATURE, VERIFYING_KEY_SELF_SIGNATURE, VERIFYING_UNSPECIFIED_SIGNATURE, + VERIFYING_CLAVIS_SIGNATURE, NR__KEY_BEING_USED_FOR }; extern const char *const key_being_used_for[NR__KEY_BEING_USED_FOR]; From patchwork Mon Mar 11 16:11:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589045 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AD6B85E07E; Mon, 11 Mar 2024 16:19:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.177.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173995; cv=fail; b=ZDHjcWXHuzStZi3L2VasAA5mSl4VciMGCbc9xFyROjnfyzozt0HkB766WFw4MgPEGY+fR2PrcPDr8Zoy4AKQIDCWsPktPnONwyncnDeCnJrc0wN9wSSnYgM2oRRLNHGjB9iW1ZgEL3iNX1sfapCFZQBBSQs20NpdLqJ6Lz50JEo= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173995; c=relaxed/simple; bh=xcrhHqLX1QxvBXLNbERqRhW3R9fU/hZftTHRlhmOTjM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=H39slwnLoivsbtkOkOJpIRGre0ZuxlnMBDTkR/ydvbN82f3wsUvJAxrdWHynTfO9UYq0WG1typHp2uDZ4mPaJCO/h6xylMoSTWaTe8n+mgGpIH5Vlj1tbf1ji3kM2cqHd94xW9QuXvQy0O2Ef2TP+msw83X8GzaeQuBQMY8dVlM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=eXmnghvy; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=sUZ0cbqa; arc=fail smtp.client-ip=205.220.177.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="eXmnghvy"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="sUZ0cbqa" Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG46Rs011922; Mon, 11 Mar 2024 16:19:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=lE3zGi4lx+LX4xh6HplVkjuqDf23NSoKJ1pIIqNEmH8=; b=eXmnghvyqxY56qagtRq9Zw64OicbEd2qbCYvXMX62HPZENT4SzWB29Xz8rJHFP0emfMr nXh/9SduNUBxSHEao+nMGwBVAWvZw7S3fp6ZhXn5xHsOMDTNV+qGJdkIGY1Czp9h0PAE yG2CtuphLAuO+SbhdSJEvWo7V5NTY7wKvkS56gkDPcJw2SPDo/izKWaLAFioqUXHSiEK iCX7vr7uwlcOm8kKChejoBhdlN7ICpO1x5kvk39J5ZxuJKPx/UysJwUOOXCvvlvaKhSO gnqBPC1bsSrj8TR2HXZ82iXpxI4RLShDcB8S3K/s4a6aCtAfq8A1diLv1ulGryO4FeGu /A== Received: from iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta03.appoci.oracle.com [130.35.103.27]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wre6ebskn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:28 +0000 Received: from pps.filterd (iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG7DMk037978; Mon, 11 Mar 2024 16:19:27 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2041.outbound.protection.outlook.com [104.47.66.41]) by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3wre75yaua-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:27 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iz4AYFPH8sdo3u90Z/CTmWRCh5o2Vd8YJWwITcionmFEkEC18H8C4n6yEVQUfMoWff0J+/7vx0JoWLk2eMbIO5p/e/B83r6G/SAX5lRq5tJ09TlNjG2UpnOTjDfpl9nuUCNKbvs25zxPmYf7a89xyEHRb8qiiOHW0/V8uxkJFsmxkQvKle32WT9IIgN9f2ssB73jjzrtHSHSK3NCscU2XCreilQ/R7yQ4rYhZqdcrFCTZ+WR18M+qZQlcCeK8aQMjV0dawO7Zi9uuqzrnqOWw0Yd2cVFvTxa46EOs4NNtikkIQQBcNzvSdefl4y+cYEoEECxDoupcdpOEtkOiAe74Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lE3zGi4lx+LX4xh6HplVkjuqDf23NSoKJ1pIIqNEmH8=; b=bC0jbtv2JdOzB+nNpfOG3r1IS7cSwnohuToPYA4CCz92EX3nie0kt+fB1SPiMxq4Mhi170266srdkN7rFPzwQH/PrEK3ckruHd5PKaEf85+OD3l6C7EbPjP4lTeys4tnDuvTbfxIS+0RZtU2Sg8Hv/ds8bAD2oYIvRBkFw9AkvQOEvmLvDoLRzIE6G44fyrZWCexXyI8Y/fpZCG+Skd4UW5qbu6UYxBQEw/9AM55CCfdXVEw3ymyPSZGjKJCkf7KV07bwKfaOHJGAnSxB71UHGYWM8VfgDks05kBkvOuAXTI0rd8DeEDtZTD3YVzyRYbJ4UjZE4FUmKpxLLquOPv1g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lE3zGi4lx+LX4xh6HplVkjuqDf23NSoKJ1pIIqNEmH8=; b=sUZ0cbqaYo+aTfO8v67aVeBPd8w6ZhM1JQelDA3towc5Wd0LSNMyNfsfzrYeY4+gRzP72/qCLPjuEF98EjX5xm9Ebr+Z65T+s1+4ZXPDLRX8uF6XfGGgjsNWzHgkfRqQfgxsG4rXfJ8kA8/WuoBPQ2XsGA+axZi8OKr4Ckh4AqU= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by MW6PR10MB7589.namprd10.prod.outlook.com (2603:10b6:303:23b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:25 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:25 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 6/8] keys: Add ability to track intended usage of the public key Date: Mon, 11 Mar 2024 12:11:09 -0400 Message-Id: <20240311161111.3268190-7-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BLAPR05CA0013.namprd05.prod.outlook.com (2603:10b6:208:36e::28) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|MW6PR10MB7589:EE_ X-MS-Office365-Filtering-Correlation-Id: 184d2b49-4e09-4190-b7b2-08dc41e7048b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: RzyadAldFzjpXeIb1ufuyUeGYRkTl0rS4gY9b6VKC1zvuSlwMw8dm2iEr+BZ4DMyKB0pR+Z+KkM1f177JT3v+BvUfHXXPEoDzyoZC1fkV26W8U0jzS+GhI5PekmQOymwOXRoGOn1Lmqy9iog38EWfS7Doyz/0pf1Tb2SFuZ47s6PFQ1bAQW2YtFyzFXao2tv+j8pcCxvEujY6WYuCELv9OLVYZLKCz56mD7gBHT6I0AMBPusfFtHthBHyzSjQfPTYuZjE/JuSN5aKKeXCCVctMmBeMFAnw0iUkZDu3LH+piy7wyV1iHCMT/80c7+uYCtCDDkIbPBkVW34eSiJZsuUApn2EDFlm0JbzIRBUGQ8evaOWbuFbMhLz28jfA/qRJVstFCa5GJZK5/HE+UMukGBZoq4ruGeu8fb1YBXWUcySHjLpjt1bDC61n1/BF6zPgB/hdlY8FHBeq1phn+hEr2yTK5h8x4WxKSh5/CFKzSGP8BSHjcddAcVn004NA0c33ELnxvOl/nv87fmfQR0TmF30yFcyQFWQki77IEEV+y/OshJZPe2jwxPddO07mnn40MUXLMTHE0r2ED5fMXS+93nqXgjsXaJ8pUwKppnD+PG4LrtwLjUM7JbRYN6tGHuuNbJJEOZM0YjLHQ31sNZwqjSlf9EoRadA4M/pnLpH+ngeM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(7416005)(1800799015);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ph3P5hCXQ2liPkTTaqGm3dwW9+2/XcnKHx0X4lzKmvPh56/eksJJAmEhFdjd7pGG5dreavXZDG04xAYDcmiknGUk205H8qNUp9iPav3AT7wiIEc60o5VB/1vmetTPo7pPx5qHN4F9CCFtP1VEwX7JlXfev69/sL6Hst8f6Y+TWMjAtjyPutlB9QI/3HTA9H3bXXOVYCzUAMcggYKDvSk85kbqPGFXTnhdWOeAf+2RBxk3Rj7fhSVpQpNPjl36OADJuBVZTdPrL14wbkKsgkClNP0r1GIP1vyoVt/+N0fNXr0O/6iBlz3dcWwZLjPDmGwJMmeolcTiTCPuJ8GV8mTYYYPfAp3TPn90GDCayV+nA1wD3WuwHKorjhZAXpisgTqLBeHTePjEQtHA2vA95UgJvPUf4XhovvSiecVk+YWjIYDoNASybths5Qq/2TtPhC2H+SxBLbRCCnguDvm3+l/HxzEQKCPH1Lj508wX9VkGcz4yq4+UKroqp55v6YL9CyWW1lxSL2QLvIHWJpbmSbXdGjCrN7onnKvDaJXiHw7/1Kix9EbGL1ESQpeMkmmfUl9Ncyd/I3VscIGIH332ZBxFGS/BCAhFLOPG/KHw2mC8tkAYKwrC4RQTuLKSkRJNlmYdKeT2fiDOgfN4jvNSGGWszxkhNd7y38Cff14wPGdlwhjX9DK0jH+r07/EhOppyluOewGusWpSWOpoZqEs7P+UNSBOnRxgS5+HVnqc98YeqoMKrTQQVd3/RKWH9+NFY+AC9z4AuCzKcMsj8b4L5kTQkaWO66HzQ2pLvU9+EXZAMrgrfwZM0FrXvJ9QEQOLgs8VSrbfVSr4Vpryux0M8cLTh8pcH18caS0ZX029EoJTWJ7l2q5nPfxJ1cYdzadVU2mHQnkYycoaJKC2B8A3TPPxb3HiXmCr1tRhSRQ33ngLOWcM/TDcxeqDCElI2WFgYgpfFhpEm38vKhG6qVunzqP7ot7t7O0LQH521pGSJNOh2QIp4ZOzSh+DVwwgLVaTMJkjNx4uukUZ97Md9eV5tUYREcIQ8Lqyka90oblMzyeHlR07wfYLJw0AdCYMyjUmvDO7KrxuplEqgAcYZeouNdSh4JywrS/RNFUcxI3pp3pcFsXnzhdvQO8LIyK3Tb5WKwFCdtj8/sxbmBAhLbZSk3O25hyImHFDV35jwA+OurqloS0wqhSmnOwCbxUallb6cDBPZN8Ea5TdPqIwer8AQIOL7adnCluICrs2kNNQQFJMmhr1kwHTElRN+bpIf6cNaIHldYdFrERm9qLEFiVchJZ7dPPJ8VZQo1ouC4lj/deys2TbfUmHUHOSBnE940uXS+e77SN7vyj6i687HvdP/fnfl1wDDcn1+CBaSJ2Tf22Aib2Rz3pqzm7SXPYEG1N6h8EFjCuH0nk3FAi1K20L8hgCxc8AQtqiQIYKkA6begpzHqkRTwdsLmC5/4rAy05vQ7P9FuNe212vN8SEMZlFIWuiYskdBWwAtFKjTL6rgOqb2cjn5Y/AXLZWrtyev+pIVzPSeXiCg56GyogUPHos49iPbZhHxGbgyyUphvntiomHTQaZm6JSfk9yQiZAchefILT//Cyruwt4nS81CLvdSeJ6tPehWtpOsT6zBYYhoxnEC8= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: C1ongw3z/d5O8w3EF5ul18Wg39gaOoBNkhFwl3VlVohchSRz3iCNovH/x2VBV1WOutGTl2TF24f4hFuMFtx7XtGCym8RXrKjB4R0vvtuwIzi404/xd9vKZB+lIogLGDe8OEcZ7QKWSMeoKkGUZd5RKfXysB8t72vsihiFRMzQCcuIRp9yEvMUVE5vwMCRNRdDO0GkJQGCSj2P5XFTusut93qU+nOv69jRTdYpLjGQDq4HBP2ue50yDWZsC3uYgfzJ5OcA9sOuf5xqhnvMSOXrNypZ5WWQils5Qg3Sdcu5pYqU043sAzUqm/1iLC2hdYkdw2krhAXrrlDF+ND5k0BVW6qIu/LY6m6Hb0yDamFc1hMAPcZCs3BnwEyI0YtkANAIgeIw8Yiu2cMSKkZAlGV9WUOzNpo5bNtkFTubCZAbVi6tE78bT1Ef4OXPqrNA7mxjYtS3e5TuyfmNeUqUGUFXtb5XieKwRHi3+acl8pRpiY5LwvdJ1MNPvQTTn+T28fZtwe/6qurSR0G3L7fK2VB7Dpo0d7ReRcwnhoSvHxrLmGsPBjtcylodx8GgPVqLxRXbnNJIN/tXdc1k+XAXbji9sO/WinFwChPMwEx1plpB4M= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 184d2b49-4e09-4190-b7b2-08dc41e7048b X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:25.1908 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: J0K1DBHSsYzkzpChCxjHtI0LMmLn9E5LLLXB8FPY/fe5MBeq3HbKCHJALViPDB8ZN/rcpcOsYIBH/BgA83HowVVvADzmTX9tLqoX5Cfluto= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR10MB7589 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 suspectscore=0 malwarescore=0 spamscore=0 mlxscore=0 adultscore=0 mlxlogscore=999 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-GUID: v3HYcdjVo_CUrjQAjCGV1A_0Af7hpTLR X-Proofpoint-ORIG-GUID: v3HYcdjVo_CUrjQAjCGV1A_0Af7hpTLR Add two new fields in public_key_signature to track the intended usage of the signature. Also add a flag for the revocation pass. During signiture validation, two verifications can take place for the same signature. One to see if it verifies against something on the .blacklist keyring and the other to see if it verifies against the supplied keyring. The flag is used to determine which stage the verification is in. Signed-off-by: Eric Snowberg --- certs/blacklist.c | 3 +++ crypto/asymmetric_keys/pkcs7_trust.c | 20 ++++++++++++++++++++ crypto/asymmetric_keys/pkcs7_verify.c | 4 ++++ include/crypto/pkcs7.h | 3 +++ include/crypto/public_key.h | 4 ++++ 5 files changed, 34 insertions(+) diff --git a/certs/blacklist.c b/certs/blacklist.c index 675dd7a8f07a..dd34e56a6362 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -17,6 +17,7 @@ #include #include #include +#include #include "blacklist.h" /* @@ -289,7 +290,9 @@ int is_key_on_revocation_list(struct pkcs7_message *pkcs7) { int ret; + pkcs7_set_usage_flag(pkcs7, PKS_REVOCATION_PASS); ret = pkcs7_validate_trust(pkcs7, blacklist_keyring); + pkcs7_clear_usage_flag(pkcs7, PKS_REVOCATION_PASS); if (ret == 0) return -EKEYREJECTED; diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c index 9a87c34ed173..64d70eb68864 100644 --- a/crypto/asymmetric_keys/pkcs7_trust.c +++ b/crypto/asymmetric_keys/pkcs7_trust.c @@ -131,6 +131,26 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7, return 0; } +void pkcs7_clear_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage) +{ + struct pkcs7_signed_info *sinfo; + + for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { + if (sinfo->sig) + clear_bit(usage, &sinfo->sig->usage_flags); + } +} + +void pkcs7_set_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage) +{ + struct pkcs7_signed_info *sinfo; + + for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { + if (sinfo->sig) + set_bit(usage, &sinfo->sig->usage_flags); + } +} + /** * pkcs7_validate_trust - Validate PKCS#7 trust chain * @pkcs7: The PKCS#7 certificate to validate diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c index 1dc80e68ce96..44b8bd0ad4d8 100644 --- a/crypto/asymmetric_keys/pkcs7_verify.c +++ b/crypto/asymmetric_keys/pkcs7_verify.c @@ -455,6 +455,10 @@ int pkcs7_verify(struct pkcs7_message *pkcs7, return ret; } actual_ret = 0; + if (sinfo->sig) { + sinfo->sig->usage = usage; + set_bit(PKS_USAGE_SET, &sinfo->sig->usage_flags); + } } kleave(" = %d", actual_ret); diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h index 38ec7f5f9041..6c3c9061b118 100644 --- a/include/crypto/pkcs7.h +++ b/include/crypto/pkcs7.h @@ -32,6 +32,9 @@ extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7, extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7, struct key *trust_keyring); +extern void pkcs7_set_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage); +extern void pkcs7_clear_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage); + /* * pkcs7_verify.c */ diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index 462f8a34cdf8..3ddfbc20a55f 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -48,6 +48,10 @@ struct public_key_signature { const char *pkey_algo; const char *hash_algo; const char *encoding; + u32 usage; /* Intended usage */ + unsigned long usage_flags; +#define PKS_USAGE_SET 0 +#define PKS_REVOCATION_PASS 1 }; extern void public_key_signature_free(struct public_key_signature *sig); From patchwork Mon Mar 11 16:11:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589046 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C5785EE8F; Mon, 11 Mar 2024 16:19:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.177.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173999; cv=fail; b=jGZTRn7lxQjBG7LM/8tLMZKpsNvW3bWQ4u0eb6U0owHGQTIQZLv/xO0MKBmr/jnR+gIuMLgMn5bMriD/q805BAzfJtODfYrepDtJIyFA+coUn9nby+kTJes5nXHAREf4ehg232r6N0pBufS9SgtKhY4UgMmst3p7sj7lZPU+jbs= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710173999; c=relaxed/simple; bh=wm8Dj8dSJjDG8brSc5THtJSt5alYIS+iFN9VploHjrQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=afVRN9cDDe/8mPkaDPOG02LuHpRQdqK0fiN/pJxyZk2N+TJvNE/h4/bwiwuBRDzBGaTaZcGCjluqG2MhxKp4Fkn/gv8MHoz7Vi7w906wGfmBzhiwyl1mjkFbhDq0KPUSB5nAqdvM2EWl9+X9tZvnXiVbwavba5j63Bz44aWxe8U= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=SzzriLYK; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=gky1epG/; arc=fail smtp.client-ip=205.220.177.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="SzzriLYK"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="gky1epG/" Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG46pc011913; Mon, 11 Mar 2024 16:19:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=NwhN4z/bJE5kk6l+0B7GBx7x2kvY02UB36GOgIBztC8=; b=SzzriLYKDeqiyvM2kq2VZv1jMiMufWCBavJ8qppmAXNWJVtwFYJ2T0fASoL94TViZGhw 5aTGBlp3QXchXO0LKIK7AxDp98CMpaQxyxyjHS9iO37t5954JdIrrkVam0xUF0CDlhRj REH+mL1OTxGsfW9hO8CHrTEVDrie4n5rDslp+yOduWh9/01CVcfxUtIbGw1Lo5uvYpYX 6+0OyplxjoFVWFm3QfMXXMIUss/Lg+Sm/ni9u/xK4gwn+38H7pL0ryFQSFw7bbFLYIiX jYsXuaSzyoh4ZGi1FiG6WXOXRJNmS8E1jAPnjARGuzNOKRXp4a3ktoxonwXegxjS4UUT lg== Received: from iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta02.appoci.oracle.com [147.154.18.20]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wre6ebsks-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:32 +0000 Received: from pps.filterd (iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BFvUUD028739; Mon, 11 Mar 2024 16:19:32 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2041.outbound.protection.outlook.com [104.47.66.41]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3wre75yf79-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:31 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WsCff1boM2wE3e2xhlS+YqJ7qxZrA69KbEwpKorhG6KveD2p1KG/ryKfUH63ogqB4kxxATEm9Z/ls6HVBf90uUnI3ca/O2Ipi2Kk8H3m612x7LbAYQPJuNrkPrZ/OUHtk2fAGGQqVv2PiwPIVoeGmWfpJBw9gOdZ4E6ZiG44jsycYTaKQys4Acd/DYFabefQYSe/vL0GB2pFNr8olpJc9CDcmrH3MgEZBHu0Wu0FjexcS+9feP9ZUsitBE9O5dTdOKB/zSk66ofiC6OiWsc1LclnKx3m6rEpCfhG6RCpnW1WsEjwUxpsDNQ2e7wkXJo9qtb8k+9GulTgY5AtHYkyUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NwhN4z/bJE5kk6l+0B7GBx7x2kvY02UB36GOgIBztC8=; b=lYpZ8szgE7Af/gp8ImMPT4RYgg0N5pFRlDgtwyYUj3PAw5M0ZVsY2flolGLZGkM+ogqbS9O/PhaYmmzKQz//Xjdc2hTyNp6w7Wzsf2/oRQzUf34AoBHTCS7ZReIA4PaIKmXLm6n0H59zyLVLutje3249O2AXoocm8cGmYbcWhBJ1YtmQ6bsx63L4U0oWxBZllT1hyf2+s9geVsFW49bsFk4N/eb7SCt1XfUwI09hFQZ8qrXNZnKZQ5PSmGz/hb/oSKKo7W92l6Rmy2ANnTps0PcR+HUwUhB8oiCsxda1aohxKMJCO6mzB7y6BJJVqECA30UXfcS1mo+0Q6Q4Hr4b8w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NwhN4z/bJE5kk6l+0B7GBx7x2kvY02UB36GOgIBztC8=; b=gky1epG/4v1Y+ai0HIio+AaymDrxCebgdizKOpxV91h7Z1mPnxfkXjEo4bDWN1MKogyLv/rAdUquPWxSf0YafYTGIvW3OzksrpUJeV86c8J4c/hVIWP4EPPzwA3tiEWv6iwIK/x4jHkRUPzGALJKgRv6PTF+ePhXr5aPIwvBPuM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by MW6PR10MB7589.namprd10.prod.outlook.com (2603:10b6:303:23b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:29 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:29 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 7/8] clavis: Introduce a new key type called clavis_key_acl Date: Mon, 11 Mar 2024 12:11:10 -0400 Message-Id: <20240311161111.3268190-8-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BLAPR03CA0034.namprd03.prod.outlook.com (2603:10b6:208:32d::9) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|MW6PR10MB7589:EE_ X-MS-Office365-Filtering-Correlation-Id: 23afda7b-2f1f-4edf-b1fa-08dc41e706dd X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: aV797qFYRqzOLoGyjpgfyZ1wXBNhdjFB67RTbYhFRd1kYODxYQt6hUrR3qxpaTulDq+3g+i3FvLcubXXc2lfGuTTzOhX1VDAFEm1P9fw2a22I1mkmTBW0MQWqp8BWsVzdpFawvkxf3+Ay6gtcyU8TamgxTKSBbmcfPmijYAZTnnaw3wm8R0FgsidF5RvMnVaQ0xiF+wOxDLN731bFLwDAQQ9gLJJ9ytaK4y+YKw/Vj49TEzD9YKlUON/vwsdxTDLq9751vpfa+wg7niRIh9QnfOwoitz9TkEy1wnpJS+T67C4WLP1ON6YdNvxUZ1qmSYB6m6ryINilm7S52fBHubw60CXiX+uhb+kTWu6yjaViKkOR4lvlM4CkuuLqZGJ+AF/w/QvRUEg2ix//Ygj4XPQpusIY5TUD8DjT4iFpID0AWr7CKaM2gv9WLbppBuhNhIMKLJaw+EHMUz2srE775gDAlMAhD9rvISJhg58ZPl05416ImbstN6QOpcktHiZxjHs7lwiuRMkb3xemSc61wWUrhWv7IaZifNQnHYRFeWJ0PYnd6E+ZWnrwEFoQSfi8H1UCSPvw1UqjQlwsMThMBEFMKCWpr4ptgrpWUWeHgzXjBHXrrdFX3XQkBSvzOFoNLNHqGueE1QYqfL1JMn3TEw8rI8maC0Ge48HPjg1FZ3mpM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(7416005)(1800799015);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Zsy5914wzKOsrF7V8jdxP6ThZKvy9jgDKV56u5HmD2F5PcJ3Ci9cZTimcZiKjAArQNAytRNSJ4Bu2nFy1D3IhS+ak64DTj+CqhGWdZRxVHRaF7+Hfny15/3hnBugwtXH0FQAGCPGvj4Eh/mrITqcdES5Pg3T+aF9+yiMUGS88ypgaoyK1W94FT/855wpXBj5Ead+A5F21dt74YivnMafvzuo0MpztYgPEgQrz8C81wykIrZf1Uq5EMQ457qD96XaSDAmVzZ8wxpbyBEtULtimimeQb5gcoLRRlJ8tAKK25NkPQ3KI3DJJUU4GcUYTId8f+H+NkoNf7JSCSdDlWqWIVaKr8WtKP7rA7Nm2Dyma2o+WcY6llgXOS6xafof4s9+YoxybKhTMpeflja7FHpRyFz7Cnnl5MqX5VSqS5SHKgBwoDpO350J3gRRxTON3rECAm3dabgS2e5+yV2m0hafix6QFtGfCwbsML2N5GzCxNNImpK/P0+pRC4zFJNcfyRGR9CTUbuZhnh6+IYJX0p25PfN+JgVKopBYckWuFXLZH5sQkX5xz/aE8ulRCr5nrAdTj6TNpteZv2b7ZdnMROU5/eYVtYCYJr1XRjKau2L99HEHTrxHfvb8/3nY1i0hO6MaadV2SzQhl/pn8nBcvEonvgUA6Oipv1hEJPp3KiUJLiEj/rqJQgePfAz0aGa6fJmi97BolEo3NsEJF2xLOeJKJBQZiqhhFKdeokvf2a+8gC01AlMez15khp39u0SFp2GhuLjWS4nAqxkKhyjrW8MGhpdolzOhbhCoreRgeIO/++Mg0r6f03LJwB4daqea16BG11PWFGWNvsH5YrWmm7jyhDB7jBmURGN2q1w5epp+VbESGR6lxrRtwbeWL3L5MAjFtpQX22n8BBsBUXtwxreTo6j62PiGs9q17cGeRfDWaA+xSJXImMsz2oNVgyFqTICc44KMztF9iUghC81485XL3X8weRnwgmRedLFSFXYdR5pWsfJJkKIznuUtyvcFxQAFEkd0wwP1pDlhcqIPtjK1CyMV+b1qajXPj09gbQb8GXBh213HyIkysx5+aMKMQlFYPoGiGRsH1DvrOK0aECPHzG+C0/UWhXGDrS7SNMatKdc4SkG7P3KwiVjWQFDocw6y9izRkAX0pL4+1iYlXz5z/YkqLzXeTOdkfOVtu6qAToarxpgbUo5ZxoLjHy1DvXsIWtaJyF+YfmZ7NFfk3quP5PXat7g4DlrkbU+h57W5392uRqIfCanIrIzl3c9QA17FZmoIwl3F/P3b9wsAcSQUUW8CkOIOWgb8yFHrPGow138lDSzx54Nio383pARrsAQpJMIBN+iI0k8he7VGKHynAPDRFHzowMt3Ta4StRns0o9DhG25D/OxMqpGhYogMf1MDjmjUp8lGaWDYcGoDeSzPMpYewCOMbUfE8ZtSxSdRo1uGRKX79CIhA2p0jB8qpEXCaQQ47ZK0ohmb5M0ck/exRYCqJKtFP3GSQ8EaRUFwK6okURjgLGvNoflpg1/VF1n4WfvSUOLPWdwo1S6DZNK05eyM1NqDqnoiiNMAhCyrUhL51CwiaVZkglVV6ppe3PywnN/kAPmh1UTQ9BPXIdpnOwBeBIGhKI0rUOXoqsUIY= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: d0Xe0k7heDXZq8cwcBsODmtnHPBOKxTV7nApRcz8ySTfGZoSnz44TXYqiFx4PvialERqxMrFj9HAE0MM+NoZpjp9J4vZUVZU72AOfCuctj7a8dTh8DWlJm2JzdaLhQRfzyhh98YEPIYeGnoy25OqdPR4ihRhANaPGQg3anZU9TxspjWkiFEIYc3wif4atJoGHJVt8hprUlpF/WpIYlLC2XrIrIscjNJWlNYXJmJWkcyCsN5qZ2BmciAv6oR1pcQfiCc5g9uMkYsaV1eWy1HjdIWkTnNwqNfKep+bPtG5Xg68ffrk0pkhwioekFsFkANQrm2j534Q6G2D9EcX9rSYoN2UGJrLsS1DcgGokK0CLENvOjgfj8BBXe9Z4lks6MyyDD76eZTen0BzKIwWNcbTXT3wwFzCbS+0Gu/gC39cmEDYOJydqES1kz7YfuHrGz4u5DL/b1gLmXdn/Pj/bltiG8LlWUSof+UvAkmVx6IxtGbm+l+t5rHXy7G77IqqxUrFMxkzNiUMdhuP5/ZuqGmr4S330fdH12mdzuKTMbsrA7wEdbQku8FHG2/6R06rhTzh+ja1Wjwg8lGUgNXXvaQF8/6VnW21ONOwrjgKCzHY1VM= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 23afda7b-2f1f-4edf-b1fa-08dc41e706dd X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:29.1449 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ETvNDQK1WzKK7uUihWGHTKLoJu4yvWhqMFte/eWH1H/cLQIO4HpRXQdlBEFTjPB9zAtJnWSA581laBKtth3+jtNaCa63G/3X3c78CIqxMFY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR10MB7589 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0 adultscore=0 mlxscore=0 phishscore=0 spamscore=0 suspectscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-GUID: S5r15CYYLK2A0Vrt1f7wUis8c-3gORHC X-Proofpoint-ORIG-GUID: S5r15CYYLK2A0Vrt1f7wUis8c-3gORHC Introduce a new key type for keyring access control. The new key type is called clavis_key_acl. The clavis_key_acl contains the subject key identifer along with the allowed usage type for the key. The format is as follows: XX:YYYYYYYYYYY XX - Single byte of the key type VERIFYING_MODULE_SIGNATURE 00 VERIFYING_FIRMWARE_SIGNATURE 01 VERIFYING_KEXEC_PE_SIGNATURE 02 VERIFYING_KEY_SIGNATURE 03 VERIFYING_KEY_SELF_SIGNATURE 04 VERIFYING_UNSPECIFIED_SIGNATURE 05 : - ASCII colon YY - Even number of hexadecimal characters representing the key id This key type will be used in the clavis keyring for access control. To be added to the clavis keyring, the clavis_key_acl must be S/MIME signed by the sole asymmetric key contained within it. Below is an example of how this could be used. Within the example, the key (b360d113c848ace3f1e6a80060b43d1206f0487d) is already in the machine keyring. The intended usage for this key is to validate a signed kernel for kexec: echo "02:b360d113c848ace3f1e6a80060b43d1206f0487d" > kernel-acl.txt The next step is to sign it: openssl smime -sign -signer clavis-lsm.x509 -inkey clavis-lsm.priv -in \ kernel-acl.txt -out kernel-acl.pkcs7 -binary -outform DER \ -nodetach -noattr The final step is how to add the acl to the .clavis keyring: keyctl padd clavis_key_acl "" %:.clavis < kernel-acl.pkcs7 Afterwards the new clavis_key_acl can be seen in the .clavis keyring: keyctl show %:.clavis Keyring keyring: .clavis \_ asymmetric: Clavis LSM key: 4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8 \_ clavis_key_acl: 02:b360d113c848ace3f1e6a80060b43d1206f0487d Signed-off-by: Eric Snowberg --- security/clavis/clavis_keyring.c | 127 +++++++++++++++++++++++++++++++ 1 file changed, 127 insertions(+) diff --git a/security/clavis/clavis_keyring.c b/security/clavis/clavis_keyring.c index c5606ed101f6..0ab2341d47b8 100644 --- a/security/clavis/clavis_keyring.c +++ b/security/clavis/clavis_keyring.c @@ -1,13 +1,18 @@ // SPDX-License-Identifier: GPL-2.0 #include +#include #include +#include #include +#include +#include #include "clavis.h" static struct key *clavis_keyring; static struct asymmetric_key_id *setup_keyid; +#define MAX_ASCII_KID 64 #define MAX_BIN_KID 32 static struct { @@ -15,6 +20,123 @@ static struct { unsigned char data[MAX_BIN_KID]; } setup_key; +static int pkcs7_preparse_content(void *ctx, const void *data, size_t len, + size_t asn1hdrlen) +{ + struct key_preparsed_payload *prep = ctx; + const void *saved_prep_data; + size_t saved_prep_datalen; + const char *p; + char *desc; + int ret, i; + + /* clavis_free_prepase will free this */ + desc = kmalloc(len, GFP_KERNEL); + + if (!desc) + return -ENOMEM; + memcpy(desc, data, len); + + /* remove any white space */ + for (i = 0, p = desc; i < len; i++, p++) { + if (isspace(*p)) + desc[i] = 0; + } + + prep->description = desc; + saved_prep_data = prep->data; + saved_prep_datalen = prep->datalen; + prep->data = desc; + prep->datalen = len; + ret = user_preparse(prep); + prep->data = saved_prep_data; + prep->datalen = saved_prep_datalen; + return ret; +} + +static void key_acl_free_preparse(struct key_preparsed_payload *prep) +{ + kfree(prep->description); + user_free_preparse(prep); +} + +static int key_acl_preparse(struct key_preparsed_payload *prep) +{ + /* Only allow the description to be set via the pkcs7 data contents */ + if (prep->orig_description) + return -EINVAL; + + return verify_pkcs7_signature(NULL, 0, prep->data, prep->datalen, clavis_keyring, + VERIFYING_CLAVIS_SIGNATURE, pkcs7_preparse_content, + prep); +} + +static int key_acl_instantiate(struct key *key, struct key_preparsed_payload *prep) +{ + key->perm |= KEY_USR_READ; + key->perm |= KEY_USR_SEARCH; + set_bit(KEY_FLAG_KEEP, &key->flags); + return generic_key_instantiate(key, prep); +} + +static void key_acl_destroy(struct key *key) +{ + /* It should not be possible to get here */ + pr_info("destroy clavis_key_acl denied\n"); +} + +static void key_acl_revoke(struct key *key) +{ + /* It should not be possible to get here */ + pr_info("revoke clavis_key_acl denied\n"); +} + +static int key_acl_update(struct key *key, struct key_preparsed_payload *prep) +{ + return -EPERM; +} + +static int key_acl_vet_description(const char *desc) +{ + unsigned char data[MAX_BIN_KID]; + int ascii_len, hex_len, error; + + ascii_len = strlen(desc); + + /* + * clavis_acl format: + * xx:yyyyyyyyy... + * + * xx - Single byte of the key type + * : - Ascii colon + * yyyy - Even number of hexadecimal characters representing the keyid + */ + if (ascii_len < 5 || ascii_len > (MAX_ASCII_KID + 3) || desc[2] != ':') + return -EINVAL; + + /* move past the colon */ + ascii_len -= 3; + hex_len = ascii_len / 2; + error = hex2bin(data, desc+3, hex_len); + + if (error < 0) + pr_err("Unparsable clavis key id\n"); + + return error; +} + +static struct key_type clavis_key_acl = { + .name = "clavis_key_acl", + .preparse = key_acl_preparse, + .free_preparse = key_acl_free_preparse, + .instantiate = key_acl_instantiate, + .update = key_acl_update, + .revoke = key_acl_revoke, + .destroy = key_acl_destroy, + .vet_description = key_acl_vet_description, + .read = user_read, +}; + static int restrict_link_for_clavis(struct key *dest_keyring, const struct key_type *type, const union key_payload *payload, struct key *restrict_key) @@ -30,6 +152,8 @@ static int restrict_link_for_clavis(struct key *dest_keyring, return 0; } + if (type == &clavis_key_acl) + return 0; return -EOPNOTSUPP; } @@ -64,6 +188,9 @@ static int __init clavis_keyring_init(void) { struct key_restriction *restriction; + if (register_key_type(&clavis_key_acl) < 0) + panic("Can't allocate clavis key type\n"); + restriction = kzalloc(sizeof(*restriction), GFP_KERNEL); if (!restriction) panic("Can't allocate clavis keyring restriction\n"); From patchwork Mon Mar 11 16:11:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 13589047 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6C255FB83; Mon, 11 Mar 2024 16:20:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.177.32 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710174007; cv=fail; b=YlA6rg6BF2mLwZLZFstn/wl9wZjWtyO5C9YrFP3PdKDM04vwbb0Sm/RrN1RU9LfArkusRTa310aLld8n2gEYyQ4zzM6PnyIkYafpoXemEy/7LCtfiytxRgCkgBLWxSctkj5b4RQ3YXzO5nL16z4YWyNxVOnAu3ODlxj+ZRWR3B8= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710174007; c=relaxed/simple; bh=Gdbw7drNWUl4BvbCb9zrBchuA2i9EvdrTIr/j9yX2H0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: Content-Type:MIME-Version; b=rfT4EdEw6oRCbTL9QV4oQZL3XorfxnMjWGDwBbAN4+ZQmRlm/MAsV5gUStz6Sym7QavX3C/dO3zDQg5zrGzb4gIrPV/8punHkmgY+Dk0T9Z9al0vIm5kvevRyXNJzIKM38Vks/wedA/veXN3G4cTr44n4eAlL2f+mv0/rTH51tw= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=oAHzprVP; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=alxH3Rob; arc=fail smtp.client-ip=205.220.177.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="oAHzprVP"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="alxH3Rob" Received: from pps.filterd (m0333520.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42BG40Fd008055; Mon, 11 Mar 2024 16:19:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=yiSsCBRB4tozPQEV+8nvvEDL6JPy5alzC2vv5xc0rLE=; b=oAHzprVPWrR1uxSvus1Ws/wLPCkijuX3vi/H7Wz2Sv5/CS6HR3yzN48lvAgc9enhTCJ6 M24lk2Y7NFAcC4CsHCUxo35z+7NHjlL/nD3tnoTbN9P7VQ8H6M07cEd7eE6Zvl959DqI KNAE2LHuzrbeCYHljKlBJiuJAnQsPwix+FSX5yz1Su0H+S5wOqfj0Eeak9DMFEOxdSRb Egc9LHYj/hHAz6gF/sINlrrMLv8vqH8cxgrKGIZuKVSj3q4sgou7KMDFzaZ8x4ojMe4D fFrFbc01iOeItIBFlKQ95jrT30CRTbr91Z2cMsGc0+sfYG+PLGX5EEHfPKDIgsKr2y/Q /g== Received: from phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta02.appoci.oracle.com [147.154.114.232]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3wrftdbtm1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:38 +0000 Received: from pps.filterd (phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42BGAZPv019729; Mon, 11 Mar 2024 16:19:37 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2041.outbound.protection.outlook.com [104.47.66.41]) by phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3wre75yw8y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 11 Mar 2024 16:19:37 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=O2GrxpI/67W74j2QxKhOEXaQ8OjNX+N8dmSISq0V12eslcl8795kcwu8NqP0CLdJE2RmQT1jGFrXNGNPR1rckQFAGkQJ2v1y17Pc19WI8RA/4VJBSIp+S4v0+ygw9rQiiITDt9vLp96zegbpzEYTuMOd4pVINcsQ/aN0CpUEpdvXfT0cxt5PCib4zU1wNHCP2XD9REsoeFQq05rxC6eSEEsJr3fnGXxcs6QoVEb9fK+KIMjVm5oaWROrS8fqNEvRHVf7LfOQm3de6z7hDn3JpomCasdLH5RqMBzypQG3266ljpQOfi2OeZzLrCKWjckXnCKiC0KaR9wEBFgUeCLUgw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=yiSsCBRB4tozPQEV+8nvvEDL6JPy5alzC2vv5xc0rLE=; b=CydUNS+n4s6Ad9sTWoBKthBQSdFef/29F2Dal4HawMuDVa8acj9z+Le8oQlPRuhl5+rQQMgDpi6XKmU3kQbIKd9WcONj/FM+6wwBiVHpUKTEFprhpyK5YYoPY7/R+TGK9FIH/3jjISF/jJaeAEr525PqN+b+Dq3WtWZqKeFMTIpfj92vrEDDYXH8eDCD4Bs8FfMEpZOW8Ja+WjS+Q4I5MwuZ9aE9G+Mu+LhbYdz/NCwWv9p1mF60NARk9eCHuXAz911AJDW0PkXaRxQdL/IpVy9XtELe0zNepxrOJy+qf1iaal9L5ZZJm86PUhPRC7pVeTCi27BEni4U3SAY8jOZwQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yiSsCBRB4tozPQEV+8nvvEDL6JPy5alzC2vv5xc0rLE=; b=alxH3Rob4wfRs4CwdIKcMxnG/fFOO8aLiwEjDJnhOCMenxR5f2ZF4VOSa/bAnqR0aFJUkeMWQVCkTLlDyMPSCZIqkIBDOufD6M/4sxXowudHi88EFpBZIhiEtJD/jsP0ov6GfQIjgX4dswpSEZcHZm3GQkHSqmrVnN/36g+vooc= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by MW6PR10MB7589.namprd10.prod.outlook.com (2603:10b6:303:23b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.36; Mon, 11 Mar 2024 16:19:34 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::9ade:bfad:c78e:e1f9%7]) with mapi id 15.20.7362.035; Mon, 11 Mar 2024 16:19:34 +0000 From: Eric Snowberg To: linux-security-module@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, roberto.sassu@huawei.com, dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com, stefanb@linux.ibm.com, eric.snowberg@oracle.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Subject: [PATCH RFC 8/8] clavis: Introduce new LSM called clavis Date: Mon, 11 Mar 2024 12:11:11 -0400 Message-Id: <20240311161111.3268190-9-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com> References: <20240311161111.3268190-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BL0PR03CA0022.namprd03.prod.outlook.com (2603:10b6:208:2d::35) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|MW6PR10MB7589:EE_ X-MS-Office365-Filtering-Correlation-Id: cd958dd8-bec1-40de-e047-08dc41e709be X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Ui6Ef8s5YWdXQZi2sqpX8FOMU8cngw4xz9E1AeGcu+WIzJPOWylTsE197/zUyvFDPXM+BNDI0+L7M7d7M8Aj/76elOYFaHAvbrI7sz3Xm2+AgLm0OFvK9dNA25BZinZE5NWDDV36PUeomFt7UlVqIgmgfzlPb/JhwB8A018MhBZ30hvllhQxVlNkOgv1Yr5oQqkKg+/xMFm554IQY7KvKAlaWNe+PaG4vu8ax/KrHI89gboKmst2SY59x9M/8ct2VL0kAWfYgbiOK341viw8UOJUOphU+8We3RE6qidhV4QcT3bKuKYvDrxgC9LZ1Gm32rk3eIpClo23q9M2kC6agTcHE8MkmTVUUITbmBK9CvmzrLkuqOfyxztrmfvoMLOH1yQPZI5eIm2JqeI9LviL60YG7tAy1wwf0DmrIl23OyozctUc/7xwUGQHnM+OHbpgj6Jr9GAT2JdMBpT6vdW5VkvcR2SP7dbGW1g7PxnNNyKg47cK1vE0l196h/n24L6bH9wUIG62UHcmMtAHyUvcRbb4C2EjANcycF5W4oaDUV7YX1M+0ghmXy36QMETo9l9eyXF0w8u+xZhX+sZSQkk+4xvixlEXki4FV2fvpBCUBT1jirhjbYXv+pN4qrudOsX/zH/ViohV5/8241DYRjnzvTMCmLPyv566r4VZv5F+FM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(7416005)(1800799015);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: uWYaHs+Xk8wAAKIgxcmqq0U1edl5y0mizPj/aft5hr6FLfJKZdTU05L8mv1E733IfUj8gPE3grkGU8nELvti+BVazAS2gxGz9YPUV9KpGcEDtJETFnamBFi5JoElKIA23vnXeJpzEqVzyCurN++VMj0ioqJ5UDij+hyiPijcJmxhN4KrqyG0U87UBHqoNFbyqPTGkaAwDTa2T0gx6a5yjRTXovgMzDMbU+v0BUqGDZtzq6SxfnE820YAW/zGc5UP9TlsrRcRMGrp3FgcxJHqbZgGozzcL99KzRYEIjZcjdE2KV23ZYxAjOyRF0hvOpLBze7N0y2vv/6srC8llypxANZpqcm7bGxmBfr28qyRcb61O+8mgN6+8SomSFYcesv+22KJaY3aAEbAH9b3BXoM/BH9DKOSgOEyWGRoPHZL+U8t0GZC1/XctBZGBgxUQaj08QsJjlsb+jPbvWoSgeYgqLFdXzlY8SHErPjS35gUK3OP2ZpW/yTcPD2QXnZPkZ90XHiMfiTy1VijSkXQkyCiKe6zhUiuvUnOw2tq7CPDt8QQg0/orqRi3vVsZ4u5xylRzL02lWz/Myz8jJKIMox9f4r87qMlUKn4MZONnN88kTNYVWErQdCH84vJilBj3ZrPPUkdXoqYgETZoKt4NJOVrBKy9jc34eXtwF1xuDidBaUyUYOaiYh3j0nsn+GWK5MdTwQISsS0N/IWZzpBTonUwVxiIZqsar35ub030wFaiTVW9+VK+u5gZpxZK6whv6JjqyJOf8RYEwR/6kZOUoJoVZTC2fI3XJEBXi8QP8qhnBqn2ETFybAEGUtH25Jb1jwWVURtkUGGExnYbNGGZFGUphg8cLA8WtlFmjkMwZaX/YEuJpvTk0y5rChF/ARqj9mPBNE981+zR7PYhnXnR5im9qNjZd1D26OB8AerimU73wQAD05eSGZ630bFsS0HskJ76VvB8ew8KGr5IXSjioqZWbcvxMiedq+AlbAO3znz4+g6tZHBPuBNmO4iT7WtWvrqpBlsadPB8t5CaLyEq6+M+gGjFX0m3DKPYf3KHapjMHrKd4T9E9pf76rvbS9sx3oAbx/6UxGftnrgF9ofCjhDBRRZoHcfkaJ9JypkEwORI+Nwk2AwFl4BBPgVbJE6LQBcIEO2OvrMejz02szAwo86sSDY91LLHhPrtTKYAwjE4STKLFl7dt55hN+Fsa8fBWa2HUuD+LN7EPCEWQbKV4FaTTWUFgAvP+/WPV157oc2zwOVPIfUlJAbyyZCNBoWkzFig7gkT8hmdgm1vwSUilcBhiDCW5kM524MUgbeN5m57m4X4p9SvrCsacWtEssHTXxKOcJjGalWoLRIQcuLIrGG3Cd94SI5QmOFZnMElesCS+GDFM/x4DUnJnpZxLPz5M2iUvzsF1yIjmAStIBprqC0/eXVwNm9lSxPMmPRHwhwv9Y7d0Mtk3QfpDBQFEJe99gUDfs13crEouolgJ0+FAHAWKvy+2gUUHML/MqoNy4YfsuMoG19hOvCe5+el6FMNARYdRNXj3odlGNgiDHgiVntptRR/LWkaS9NZEhaM6qaOt3Aqsg/0lxeUcojzVgp+wVvEk3czTO/bKI1/wDAJHp4U1ZDSDgKigq0eAMrhlPJ8io= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 2y6jpZNgDcL3M5fGTm3stNAV1/BvV+HAx/xt9iCI8+ov9Pn8K/zywDyWRN7SV3iT6yMmMERciPRkI2IwnVLUEJca+BEmNrYeYXrDzDb1IL65n+8DnXl05yADn2duJU2CZdjaPTZskRgKCsF6qSVMa7hbKHkVNPN3QLzMXaN3RWmeGD9+7X/3Bl7psY8S7U7DwgAtH3KiOpnWvs/z0XJhXROtvyelrLIisopnvFoFpBxdromGw8XkOumkJTxoUzSW7bdnOsLGMWomwU/5hk5ef53jcv3/p+VqjGGUjgYXoZkWEhkro/swB3HSY7TYB430vKzoCscGgVjFkf8WMI9p8XIbDID1Y4wAVjt4typGhMRy+dx0Kc9y0JzUCWWMdHeGmYVZSZFv2OuEkCDdtQaQlFuzEynRvEu+PQYg11t1Xxwj8e9ODRnKOzFgJjeAVDbdiIKiguAUUVBGDYmpervbV3AL5PnF94xkqUXOOWLXnuDThqQMfTFFbQ+nTOTGE4IncNGIAmEpe3YLxDxxAlWW5pHqh5b+MAv6suNgrMYytnaRWrmYSNlgXRSbNNzKioJ2K+G4ZM5h+6kQPh8a56NgL6wUSFr3xuvZIDXrxDrLsZg= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: cd958dd8-bec1-40de-e047-08dc41e709be X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:34.4161 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jyekq031puD2fcNai342ejk4ljJ/7vma1wwGwCFM+XqaZbwFlg/66cc8cw51sGyBsXCxsB8952gDC9huNnaak+iqrqF/zHPpy2GY2NrR9II= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR10MB7589 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxscore=0 spamscore=0 bulkscore=0 phishscore=0 malwarescore=0 suspectscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2403110124 X-Proofpoint-ORIG-GUID: yp_kGNpu5uEgkzokwEIWNP_r3M4OQNE1 X-Proofpoint-GUID: yp_kGNpu5uEgkzokwEIWNP_r3M4OQNE1 Introduce a new LSM called clavis. The motivation behind this LSM is to provide access control for system keys. The access control list is contained within a keyring call .clavis. During boot if the clavis= boot arg is supplied with a key id contained within any of the current system keyrings (builtin, secondary, machine, or platform) it shall be used as the root of trust for validating anything that is added to the ACL list. The first restriction introduced with this LSM is the ability to enforce key usage. The kernel already has a notion of tracking key usage. This LSM adds the ability to enforce this usage based on the system owners configuration. Each system key may have one or more uses defined within the ACL list. When this LSM is enabled, only the builtin keys are available for loading kernel modules and doing a kexec. Until an entry is added to the .clavis keyring, no other system key may be used for any other purpose. In the future it is envisioned this LSM could be enhanced to provide access control for UEFI Secure Boot Advanced Targeting (SBAT). Using the same clavis= boot param and storing the additional contents within the new RT UEFI var, SBAT restrictions could be maintained across kexec. Signed-off-by: Eric Snowberg --- Documentation/admin-guide/LSM/clavis.rst | 190 +++++++++++++++++++++++ MAINTAINERS | 7 + crypto/asymmetric_keys/signature.c | 4 + include/linux/lsm_hook_defs.h | 2 + include/linux/security.h | 7 + include/uapi/linux/lsm.h | 1 + security/Kconfig | 10 +- security/clavis/Makefile | 1 + security/clavis/clavis.c | 25 +++ security/clavis/clavis.h | 4 + security/clavis/clavis_keyring.c | 83 ++++++++++ security/security.c | 16 +- 12 files changed, 344 insertions(+), 6 deletions(-) create mode 100644 Documentation/admin-guide/LSM/clavis.rst create mode 100644 security/clavis/clavis.c diff --git a/Documentation/admin-guide/LSM/clavis.rst b/Documentation/admin-guide/LSM/clavis.rst new file mode 100644 index 000000000000..b0a73defb4fc --- /dev/null +++ b/Documentation/admin-guide/LSM/clavis.rst @@ -0,0 +1,190 @@ +.. SPDX-License-Identifier: GPL-2.0 + +===== +Clavis +===== + +Clavis is a Linux Security Module that provides mandatory access control to +system kernel keys (i.e. builtin, secondary, machine and platform). These +restrictions will prohit keys from being used for validation. Upon boot, the +Clavis LSM is provided a key id as a boot param. This single key is then +used as the root of trust for any access control modifications made going +forward. Access control updates must be signed and validated by this key. + +Clavis has its own keyring. All ACL updates are applied through this keyring. +The update must be signed by the single root of trust key. + +When enabled, all system keys are prohibited from being used until an ACL is +added for it. There is two exceptions to this rule, builtin keys may be used +to validate both signed kernels and modules. + +Adding system kernel keys can only be performed by the machine owner, this +could be through the Machine Owner Key (MOK) or the UEFI Secure Boot DB. It +is possible the machine owner and system administrator may be different +people. The system administrator will not be able to make ACL updates without +them being signed by the machine owner. + +On UEFI platforms, the root of trust key shall survive a kexec. Trying to +defeat or change it from the command line is not allowed. The original boot +param is stored in UEFI and will always be referenced following a kexec. + +The Clavis LSM contains a system keyring call .clavis. It contains a single +asymmetric key that is use to validate anything added to it. This key can only +be added during boot and must be a preexisting system kernel key. If the +clavis= boot param is not used, the keyring does not exist and the feature +can not be used until the next power on reset. + +The only user space components are OpenSSL and the keyctl utility. A new +key type call clavis_key_acl is used for ACL updates. Any number of signed +clavis_key_acl entries may be added to the .clavis keyring. The clavis_key_acl +contains the subject key identifer along with the allowed usage type for +the key. + +The format is as follows: +:: + + XX:YYYYYYYYYYY + + XX - Single byte of the key type + VERIFYING_MODULE_SIGNATURE 00 + VERIFYING_FIRMWARE_SIGNATURE 01 + VERIFYING_KEXEC_PE_SIGNATURE 02 + VERIFYING_KEY_SIGNATURE 03 + VERIFYING_KEY_SELF_SIGNATURE 04 + VERIFYING_UNSPECIFIED_SIGNATURE 05 + : - ASCII colon + YY - Even number of hexadecimal characters representing the key id + +The clavis_key_acl must be S/MIME signed by the sole asymmetric key contained +within the .clavis keyring. + +In the future if new features are added, new key types could be created. + +Usage Examples +============== + +How to create a signing key: +---------------------------- + +:: + + cat < clavis-lsm.genkey + [ req ] + default_bits = 4096 + distinguished_name = req_distinguished_name + prompt = no + string_mask = utf8only + x509_extensions = v3_ca + [ req_distinguished_name ] + O = TEST + CN = Clavis LSM key + emailAddress = john.doe@foo.com + [ v3_ca ] + basicConstraints=CA:TRUE + subjectKeyIdentifier=hash + authorityKeyIdentifier=keyid:always,issuer + keyUsage=digitalSignature + EOF + + openssl req -new -x509 -utf8 -sha256 -days 3650 -batch \ + -config clavis-lsm.genkey -outform DER \ + -out clavis-lsm.x509 -keyout clavis-lsm.priv + +How to get the Subject Key Identifier +------------------------------------- +:: + + openssl x509 -in ./clavis-lsm.x509 -inform der \ + -ext subjectKeyIdentifier -nocert \ + | tail -n +2 | cut -f2 -d '='| tr -d ':' + 4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8 + +How to enroll the signing key into the MOK +------------------------------------------ + +The key must now be added to the machine or platform keyrings. This +indicates the key was added by the system owner. To add to the machine +keyring on x86 do: +:: + + mokutil --import ./clavis-lsm.x509 + +and then reboot and enroll the key through the MokManager. + +How to enable the Clavis LSM +---------------------------- + +Add the key id to the clavis= boot param. With the example above the +key id is the subject key identifer: 4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8 + +Add the following boot param: +:: + + clavis=4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8 + +After booting there will be a single key contained in the .clavis keyring: +:: + + $ keyctl show %:.clavis + Keyring + 254954913 ----swrv 0 0 keyring: .clavis + 301905375 ---lswrv 0 0 \_ asymmetric: TEST: Clavis LSM key: 4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8 + +The original clavis= boot param will persist across any kexec. Changing it or +removing it has no effect. + + +How to sign an entry to be added to the .clavis keyring: +------------------------------------------------------- + +In this example we have 3 keys in the machine keyring. Our Clavis LSM key, a +key we want to use for kernel verification and a key we want to use for module +verification. +:: + + $ keyctl show %:.machine + Keyring + 999488265 ---lswrv 0 0 keyring: .machine + 912608009 ---lswrv 0 0 \_ asymmetric: TEST: Module Key: 17eb8c5bf766364be094c577625213700add9471 + 646229664 ---lswrv 0 0 \_ asymmetric: TEST: Kernel Key: b360d113c848ace3f1e6a80060b43d1206f0487d + 1073737099 ---lswrv 0 0 \_ asymmetric: TEST: Clavis LSM key: 4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8 + +To update the .clavis kerying acl list. First create a file containing the +key usage type followed by a colon and the key id that we want to allow to +validate that usage. In the first example we are saying key +17eb8c5bf766364be094c577625213700add9471 is allowed to validate kernel modules. +In the second example we are saying key b360d113c848ace3f1e6a80060b43d1206f0487d +is allowed to validate signed kernels. + +:: + + echo "00:17eb8c5bf766364be094c577625213700add9471" > module-acl.txt + echo "02:b360d113c848ace3f1e6a80060b43d1206f0487d" > kernel-acl.txt + +Now both these files must be signed by the key contained in the .clavis keyring: + +:: + + openssl smime -sign -signer clavis-lsm.x509 -inkey clavis-lsm.priv -in module-acl.txt \ + -out module-acl.pkcs7 -binary -outform DER -nodetach -noattr + + openssl smime -sign -signer clavis-lsm.x509 -inkey clavis-lsm.priv -in kernel-acl.txt \ + -out kernel-acl.pkcs7 -binary -outform DER -nodetach -noattr + +Afterwards the ACL list in the clavis keyring can be updated: +:: + + keyctl padd clavis_key_acl "" %:.clavis < module-acl.pkcs7 + keyctl padd clavis_key_acl "" %:.clavis < kernel-acl.pkcs7 + + keyctl show %:.clavis + + Keyring + 254954913 ----swrv 0 0 keyring: .clavis + 301905375 ---lswrv 0 0 \_ asymmetric: TEST: Clavis LSM key: 4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8 + 1013065475 --alswrv 0 0 \_ clavis_key_acl: 02:b360d113c848ace3f1e6a80060b43d1206f0487d + 445581284 --alswrv 0 0 \_ clavis_key_acl: 00:17eb8c5bf766364be094c577625213700add9471 + +Now the 17eb8c5bf766364be094c577625213700add9471 key can be used for +validating kernel modules and the b360d113c848ace3f1e6a80060b43d1206f0487d +key can be used to validate signed kernels. diff --git a/MAINTAINERS b/MAINTAINERS index 960512bec428..64725ea4f881 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5137,6 +5137,13 @@ F: scripts/Makefile.clang F: scripts/clang-tools/ K: \b(?i:clang|llvm)\b +CLAVIS LINUX SECURITY MODULE +M: Eric Snowberg +L: linux-security-module@vger.kernel.org +S: Maintained +F: Documentation/admin-guide/LSM/clavis.rst +F: security/clavis + CLK API M: Russell King L: linux-clk@vger.kernel.org diff --git a/crypto/asymmetric_keys/signature.c b/crypto/asymmetric_keys/signature.c index 398983be77e8..19892e1aa18b 100644 --- a/crypto/asymmetric_keys/signature.c +++ b/crypto/asymmetric_keys/signature.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include "asymmetric_keys.h" @@ -153,6 +154,9 @@ int verify_signature(const struct key *key, ret = subtype->verify_signature(key, sig); + if (!ret) + ret = security_key_verify_signature(key, sig); + pr_devel("<==%s() = %d\n", __func__, ret); return ret; } diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 7e4683035d34..d18bf16feb2c 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -408,6 +408,8 @@ LSM_HOOK(int, 0, key_getsecurity, struct key *key, char **buffer) LSM_HOOK(void, LSM_RET_VOID, key_post_create_or_update, struct key *keyring, struct key *key, const void *payload, size_t payload_len, unsigned long flags, bool create) +LSM_HOOK(int, 0, key_verify_signature, const struct key *key, + const struct public_key_signature *sig) #endif /* CONFIG_KEYS */ #ifdef CONFIG_AUDIT diff --git a/include/linux/security.h b/include/linux/security.h index 94661398708a..e672a180714d 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -62,6 +62,7 @@ enum fs_value_type; struct watch; struct watch_notification; struct lsm_ctx; +struct public_key_signature; /* Default (no) options for the capable function */ #define CAP_OPT_NONE 0x0 @@ -2009,6 +2010,7 @@ void security_key_post_create_or_update(struct key *keyring, struct key *key, const void *payload, size_t payload_len, unsigned long flags, bool create); +int security_key_verify_signature(const struct key *key, const struct public_key_signature *sig); #else static inline int security_key_alloc(struct key *key, @@ -2043,6 +2045,11 @@ static inline void security_key_post_create_or_update(struct key *keyring, bool create) { } +static inline int security_key_verify_signature(const struct key *key, + const struct public_key_signature *sig) +{ + return 0; +} #endif #endif /* CONFIG_KEYS */ diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h index 33d8c9f4aa6b..3a60c4ff5186 100644 --- a/include/uapi/linux/lsm.h +++ b/include/uapi/linux/lsm.h @@ -64,6 +64,7 @@ struct lsm_ctx { #define LSM_ID_LANDLOCK 110 #define LSM_ID_IMA 111 #define LSM_ID_EVM 112 +#define LSM_ID_CLAVIS 113 /* * LSM_ATTR_XXX definitions identify different LSM attributes diff --git a/security/Kconfig b/security/Kconfig index 7f5a52b7cefd..f158c0e6b8dc 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -234,11 +234,11 @@ endchoice config LSM string "Ordered list of enabled LSMs" - default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK - default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR - default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO - default "landlock,lockdown,yama,loadpin,safesetid,bpf" if DEFAULT_SECURITY_DAC - default "landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf" + default "clavis,landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK + default "clavis,landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR + default "clavis,landlock,lockdown,yama,loadpin,safesetid,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO + default "clavis,landlock,lockdown,yama,loadpin,safesetid,bpf" if DEFAULT_SECURITY_DAC + default "clavis,landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf" help A comma-separated list of LSMs, in initialization order. Any LSMs left off this list, except for those with order diff --git a/security/clavis/Makefile b/security/clavis/Makefile index c008cb74c762..60f72cf96886 100644 --- a/security/clavis/Makefile +++ b/security/clavis/Makefile @@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 obj-$(CONFIG_SECURITY_CLAVIS_KEYRING) += clavis_keyring.o +obj-$(CONFIG_SECURITY_CLAVIS_KEYRING) += clavis.o ifeq ($(CONFIG_EFI),y) obj-$(CONFIG_SECURITY_CLAVIS_KEYRING) += clavis_efi.o endif diff --git a/security/clavis/clavis.c b/security/clavis/clavis.c new file mode 100644 index 000000000000..040337dbd8d9 --- /dev/null +++ b/security/clavis/clavis.c @@ -0,0 +1,25 @@ +// SPDX-License-Identifier: GPL-2.0 +// +#include +#include +#include "clavis.h" + +static struct security_hook_list clavis_hooks[] __ro_after_init = { + LSM_HOOK_INIT(key_verify_signature, clavis_sig_verify), +}; + +const struct lsm_id clavis_lsmid = { + .name = "clavis", + .id = LSM_ID_CLAVIS, +}; + +static int __init clavis_lsm_init(void) +{ + security_add_hooks(clavis_hooks, ARRAY_SIZE(clavis_hooks), &clavis_lsmid); + return 0; +}; + +DEFINE_LSM(clavis) = { + .name = "clavis", + .init = clavis_lsm_init, +}; diff --git a/security/clavis/clavis.h b/security/clavis/clavis.h index 3883c390b9e4..886a85d82518 100644 --- a/security/clavis/clavis.h +++ b/security/clavis/clavis.h @@ -1,5 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0 */ +struct key; +struct public_key_signature; struct asymmetric_key_id; #ifdef CONFIG_EFI @@ -10,3 +12,5 @@ static inline int __init clavis_efi_param(struct asymmetric_key_id *kid, int len return -EINVAL; } #endif + +int clavis_sig_verify(const struct key *key, const struct public_key_signature *sig); diff --git a/security/clavis/clavis_keyring.c b/security/clavis/clavis_keyring.c index 0ab2341d47b8..cc4527b417e1 100644 --- a/security/clavis/clavis_keyring.c +++ b/security/clavis/clavis_keyring.c @@ -12,6 +12,7 @@ static struct key *clavis_keyring; static struct asymmetric_key_id *setup_keyid; +static int clavis_init; #define MAX_ASCII_KID 64 #define MAX_BIN_KID 32 @@ -227,4 +228,86 @@ void __init late_init_clavis_setup(void) clavis_keyring_init(); system_key_link(clavis_keyring, keyid); + clavis_init = true; +} + +int clavis_sig_verify(const struct key *key, const struct public_key_signature *sig) +{ + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key); + const struct asymmetric_key_subtype *subtype; + const struct asymmetric_key_id *newkid; + char *buf_ptr, *ptr; + key_ref_t ref; + int i, buf_len; + + if (!clavis_init) + return 0; + + if (key->type != &key_type_asymmetric) + return -EKEYREJECTED; + subtype = asymmetric_key_subtype(key); + if (!subtype || !key->payload.data[0]) + return -EKEYREJECTED; + if (!subtype->verify_signature) + return -EKEYREJECTED; + + /* Allow sig validation when not using a system keyring */ + if (!test_bit(PKS_USAGE_SET, &sig->usage_flags)) + return 0; + + if (test_bit(KEY_FLAG_BUILTIN, &key->flags) && sig->usage == VERIFYING_MODULE_SIGNATURE) + return 0; + + if (test_bit(KEY_FLAG_BUILTIN, &key->flags) && sig->usage == VERIFYING_KEXEC_PE_SIGNATURE) + return 0; + + /* The previous sig validation is enough to get on the clavis keyring */ + if (sig->usage == VERIFYING_CLAVIS_SIGNATURE) + return 0; + + if (test_bit(PKS_REVOCATION_PASS, &sig->usage_flags)) + return 0; + + for (i = 0, buf_len = 0; i < 3; i++) { + if (kids->id[i]) { + newkid = (struct asymmetric_key_id *)kids->id[i]; + if (newkid->len > buf_len) + buf_len = newkid->len; + } + } + + if (!buf_len) + return -EKEYREJECTED; + + /* Allocate enough space for the conversion to ascii plus the header. */ + buf_ptr = kmalloc(buf_len * 2 + 4, GFP_KERNEL | __GFP_ZERO); + + if (!buf_ptr) + return -ENOMEM; + + for (i = 0; i < 3; i++) { + if (kids->id[i]) { + newkid = (struct asymmetric_key_id *)kids->id[i]; + if (!newkid->len) + continue; + + ptr = buf_ptr; + ptr = bin2hex(ptr, &sig->usage, 1); + *ptr++ = ':'; + ptr = bin2hex(ptr, newkid->data, newkid->len); + *ptr = 0; + ref = keyring_search(make_key_ref(clavis_keyring, true), &clavis_key_acl, + buf_ptr, false); + + if (!IS_ERR(ref)) + break; + } + } + + kfree(buf_ptr); + + if (IS_ERR(ref)) + return -EKEYREJECTED; + + return 0; } diff --git a/security/security.c b/security/security.c index 4cb832b00c40..d1da60a1b7a4 100644 --- a/security/security.c +++ b/security/security.c @@ -50,7 +50,8 @@ (IS_ENABLED(CONFIG_BPF_LSM) ? 1 : 0) + \ (IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0) + \ (IS_ENABLED(CONFIG_IMA) ? 1 : 0) + \ - (IS_ENABLED(CONFIG_EVM) ? 1 : 0)) + (IS_ENABLED(CONFIG_EVM) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_CLAVIS_KEYRING) ? 1 : 0)) /* * These are descriptions of the reasons that can be passed to the @@ -5313,6 +5314,19 @@ void security_key_post_create_or_update(struct key *keyring, struct key *key, call_void_hook(key_post_create_or_update, keyring, key, payload, payload_len, flags, create); } + +/** + * security_key_verify_signature - verify signature + * @key: key + * @public_key_signature: signature + * + * See wheather signature verification is allowed based on the ACL for + * key usage. + */ +int security_key_verify_signature(const struct key *key, const struct public_key_signature *sig) +{ + return call_int_hook(key_verify_signature, key, sig); +} #endif /* CONFIG_KEYS */ #ifdef CONFIG_AUDIT