Commit 64724cfc authored by David Howells's avatar David Howells
Browse files

Merge remote-tracking branch 'integrity/next-with-keys' into keys-next 



Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parents 6204e002 7d2ce232

Documentation/kernel-parameters.txt

+5 −0
Original line number Original line Diff line number Diff line
@@ -566,6 +566,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted. 
			possible to determine what the correct size should be.

			possible to determine what the correct size should be.

			This option provides an override for these situations.

			This option provides an override for these situations.





	ca_keys=	[KEYS] This parameter identifies a specific key(s) on

			the system trusted keyring to be used for certificate

			trust validation.

			format: { id:<keyid> | builtin }



	ccw_timeout_log [S390]

	ccw_timeout_log [S390]

			See Documentation/s390/CommonIO for details.

			See Documentation/s390/CommonIO for details.

crypto/asymmetric_keys/asymmetric_keys.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -9,6 +9,8 @@ 
 * 2 of the Licence, or (at your option) any later version.

 * 2 of the Licence, or (at your option) any later version.

 */

 */





int asymmetric_keyid_match(const char *kid, const char *id);



static inline const char *asymmetric_key_id(const struct key *key)

static inline const char *asymmetric_key_id(const struct key *key)

{

{

	return key->type_data.p[1];

	return key->type_data.p[1];

crypto/asymmetric_keys/asymmetric_type.c

+32 −19
Original line number Original line Diff line number Diff line
@@ -22,6 +22,35 @@ MODULE_LICENSE("GPL"); 
static LIST_HEAD(asymmetric_key_parsers);

static LIST_HEAD(asymmetric_key_parsers);

static DECLARE_RWSEM(asymmetric_key_parsers_sem);

static DECLARE_RWSEM(asymmetric_key_parsers_sem);





/*

 * Match asymmetric key id with partial match

 * @id:		key id to match in a form "id:<id>"

 */

int asymmetric_keyid_match(const char *kid, const char *id)

{

	size_t idlen, kidlen;



	if (!kid || !id)

		return 0;



	/* make it possible to use id as in the request: "id:<id>" */

	if (strncmp(id, "id:", 3) == 0)

		id += 3;



	/* Anything after here requires a partial match on the ID string */

	idlen = strlen(id);

	kidlen = strlen(kid);

	if (idlen > kidlen)

		return 0;



	kid += kidlen - idlen;

	if (strcasecmp(id, kid) != 0)

		return 0;



	return 1;

}

EXPORT_SYMBOL_GPL(asymmetric_keyid_match);



/*

/*

 * Match asymmetric keys on (part of) their name

 * Match asymmetric keys on (part of) their name

 * We have some shorthand methods for matching keys.  We allow:

 * We have some shorthand methods for matching keys.  We allow:
@@ -34,9 +63,8 @@ static int asymmetric_key_match(const struct key *key, const void *description) 
{

{

	const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);

	const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);

	const char *spec = description;

	const char *spec = description;

	const char *id, *kid;

	const char *id;

	ptrdiff_t speclen;

	ptrdiff_t speclen;

	size_t idlen, kidlen;





	if (!subtype || !spec || !*spec)

	if (!subtype || !spec || !*spec)

		return 0;

		return 0;
@@ -55,23 +83,8 @@ static int asymmetric_key_match(const struct key *key, const void *description) 
	speclen = id - spec;

	speclen = id - spec;

	id++;

	id++;





	/* Anything after here requires a partial match on the ID string */

	if (speclen == 2 && memcmp(spec, "id", 2) == 0)

	kid = asymmetric_key_id(key);

		return asymmetric_keyid_match(asymmetric_key_id(key), id);

	if (!kid)

		return 0;



	idlen = strlen(id);

	kidlen = strlen(kid);

	if (idlen > kidlen)

		return 0;



	kid += kidlen - idlen;

	if (strcasecmp(id, kid) != 0)

		return 0;



	if (speclen == 2 &&

	    memcmp(spec, "id", 2) == 0)

		return 1;





	if (speclen == subtype->name_len &&

	if (speclen == subtype->name_len &&

	    memcmp(spec, subtype->name, speclen) == 0)

	    memcmp(spec, subtype->name, speclen) == 0)

crypto/asymmetric_keys/x509_public_key.c

+108 −1
Original line number Original line Diff line number Diff line
@@ -18,11 +18,80 @@ 
#include <linux/asn1_decoder.h>

#include <linux/asn1_decoder.h>

#include <keys/asymmetric-subtype.h>

#include <keys/asymmetric-subtype.h>

#include <keys/asymmetric-parser.h>

#include <keys/asymmetric-parser.h>

#include <keys/system_keyring.h>

#include <crypto/hash.h>

#include <crypto/hash.h>

#include "asymmetric_keys.h"

#include "asymmetric_keys.h"

#include "public_key.h"

#include "public_key.h"

#include "x509_parser.h"

#include "x509_parser.h"





static bool use_builtin_keys;

static char *ca_keyid;



#ifndef MODULE

static int __init ca_keys_setup(char *str)

{

	if (!str)		/* default system keyring */

		return 1;



	if (strncmp(str, "id:", 3) == 0)

		ca_keyid = str;	/* owner key 'id:xxxxxx' */

	else if (strcmp(str, "builtin") == 0)

		use_builtin_keys = true;



	return 1;

}

__setup("ca_keys=", ca_keys_setup);

#endif



/*

 * Find a key in the given keyring by issuer and authority.

 */

static struct key *x509_request_asymmetric_key(struct key *keyring,

					       const char *signer,

					       size_t signer_len,

					       const char *authority,

					       size_t auth_len)

{

	key_ref_t key;

	char *id;



	/* Construct an identifier. */

	id = kmalloc(signer_len + 2 + auth_len + 1, GFP_KERNEL);

	if (!id)

		return ERR_PTR(-ENOMEM);



	memcpy(id, signer, signer_len);

	id[signer_len + 0] = ':';

	id[signer_len + 1] = ' ';

	memcpy(id + signer_len + 2, authority, auth_len);

	id[signer_len + 2 + auth_len] = 0;



	pr_debug("Look up: \"%s\"\n", id);



	key = keyring_search(make_key_ref(keyring, 1),

			     &key_type_asymmetric, id);

	if (IS_ERR(key))

		pr_debug("Request for module key '%s' err %ld\n",

			 id, PTR_ERR(key));

	kfree(id);



	if (IS_ERR(key)) {

		switch (PTR_ERR(key)) {

			/* Hide some search errors */

		case -EACCES:

		case -ENOTDIR:

		case -EAGAIN:

			return ERR_PTR(-ENOKEY);

		default:

			return ERR_CAST(key);

		}

	}



	pr_devel("<==%s() = 0 [%x]\n", __func__,

		 key_serial(key_ref_to_ptr(key)));

	return key_ref_to_ptr(key);

}



/*

/*

 * Set up the signature parameters in an X.509 certificate.  This involves

 * Set up the signature parameters in an X.509 certificate.  This involves

 * digesting the signed data and extracting the signature.

 * digesting the signed data and extracting the signature.
@@ -102,6 +171,40 @@ int x509_check_signature(const struct public_key *pub, 
}

}

EXPORT_SYMBOL_GPL(x509_check_signature);

EXPORT_SYMBOL_GPL(x509_check_signature);





/*

 * Check the new certificate against the ones in the trust keyring.  If one of

 * those is the signing key and validates the new certificate, then mark the

 * new certificate as being trusted.

 *

 * Return 0 if the new certificate was successfully validated, 1 if we couldn't

 * find a matching parent certificate in the trusted list and an error if there

 * is a matching certificate but the signature check fails.

 */

static int x509_validate_trust(struct x509_certificate *cert,

			       struct key *trust_keyring)

{

	struct key *key;

	int ret = 1;



	if (!trust_keyring)

		return -EOPNOTSUPP;



	if (ca_keyid && !asymmetric_keyid_match(cert->authority, ca_keyid))

		return -EPERM;



	key = x509_request_asymmetric_key(trust_keyring,

					  cert->issuer, strlen(cert->issuer),

					  cert->authority,

					  strlen(cert->authority));

	if (!IS_ERR(key))  {

		if (!use_builtin_keys

		    || test_bit(KEY_FLAG_BUILTIN, &key->flags))

			ret = x509_check_signature(key->payload.data, cert);

		key_put(key);

	}

	return ret;

}



/*

/*

 * Attempt to parse a data blob for a key as an X509 certificate.

 * Attempt to parse a data blob for a key as an X509 certificate.

 */

 */
@@ -155,9 +258,13 @@ static int x509_key_preparse(struct key_preparsed_payload *prep) 
	/* Check the signature on the key if it appears to be self-signed */

	/* Check the signature on the key if it appears to be self-signed */

	if (!cert->authority ||

	if (!cert->authority ||

	    strcmp(cert->fingerprint, cert->authority) == 0) {

	    strcmp(cert->fingerprint, cert->authority) == 0) {

		ret = x509_check_signature(cert->pub, cert);

		ret = x509_check_signature(cert->pub, cert); /* self-signed */

		if (ret < 0)

		if (ret < 0)

			goto error_free_cert;

			goto error_free_cert;

	} else if (!prep->trusted) {

		ret = x509_validate_trust(cert, get_system_trusted_keyring());

		if (!ret)

			prep->trusted = 1;

	}

	}





	/* Propose a description */

	/* Propose a description */

include/keys/system_keyring.h

+9 −1
Original line number Original line Diff line number Diff line
@@ -17,7 +17,15 @@ 
#include <linux/key.h>

#include <linux/key.h>





extern struct key *system_trusted_keyring;

extern struct key *system_trusted_keyring;



static inline struct key *get_system_trusted_keyring(void)

{

	return system_trusted_keyring;

}

#else

static inline struct key *get_system_trusted_keyring(void)

{

	return NULL;

}

#endif

#endif





#endif /* _KEYS_SYSTEM_KEYRING_H */
 
#endif /* _KEYS_SYSTEM_KEYRING_H */