^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * Copyright (C) 2011 Intel Corporation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Author:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Dmitry Kasatkin <dmitry.kasatkin@intel.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <linux/err.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/sched.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/cred.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/kernel_read_file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/key-type.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/digsig.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/vmalloc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <crypto/public_key.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <keys/system_keyring.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include "integrity.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) static struct key *keyring[INTEGRITY_KEYRING_MAX];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #ifndef CONFIG_INTEGRITY_TRUSTED_KEYRING
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) "_evm",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) "_ima",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) ".evm",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) ".ima",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) ".platform",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) #define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #define restrict_link_to_ima restrict_link_by_builtin_trusted
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) static struct key *integrity_keyring_from_id(const unsigned int id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) if (id >= INTEGRITY_KEYRING_MAX)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) return ERR_PTR(-EINVAL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) if (!keyring[id]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) keyring[id] =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) request_key(&key_type_keyring, keyring_name[id], NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) if (IS_ERR(keyring[id])) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) int err = PTR_ERR(keyring[id]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) pr_err("no %s keyring: %d\n", keyring_name[id], err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) keyring[id] = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) return ERR_PTR(err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) return keyring[id];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) const char *digest, int digestlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) struct key *keyring;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) if (siglen < 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) keyring = integrity_keyring_from_id(id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) if (IS_ERR(keyring))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) return PTR_ERR(keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) switch (sig[1]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) case 1:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) /* v1 API expect signature without xattr type */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) return digsig_verify(keyring, sig + 1, siglen - 1, digest,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) digestlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) case 2:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) return asymmetric_verify(keyring, sig, siglen, digest,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) digestlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) return -EOPNOTSUPP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) int integrity_modsig_verify(const unsigned int id, const struct modsig *modsig)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) struct key *keyring;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) keyring = integrity_keyring_from_id(id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) if (IS_ERR(keyring))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) return PTR_ERR(keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) return ima_modsig_verify(keyring, modsig);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) static int __init __integrity_init_keyring(const unsigned int id,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) key_perm_t perm,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) struct key_restriction *restriction)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) const struct cred *cred = current_cred();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) KGIDT_INIT(0), cred, perm,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) KEY_ALLOC_NOT_IN_QUOTA, restriction, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) if (IS_ERR(keyring[id])) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) err = PTR_ERR(keyring[id]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) pr_info("Can't allocate %s keyring (%d)\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) keyring_name[id], err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) keyring[id] = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) if (id == INTEGRITY_KEYRING_PLATFORM)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) set_platform_trusted_keys(keyring[id]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) int __init integrity_init_keyring(const unsigned int id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) struct key_restriction *restriction;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) key_perm_t perm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) | KEY_USR_READ | KEY_USR_SEARCH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) if (id == INTEGRITY_KEYRING_PLATFORM) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) restriction = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) if (!restriction)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) restriction->check = restrict_link_to_ima;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) perm |= KEY_USR_WRITE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) return __integrity_init_keyring(id, perm, restriction);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) int __init integrity_add_key(const unsigned int id, const void *data,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) off_t size, key_perm_t perm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) key_ref_t key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) int rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) if (!keyring[id])
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) key = key_create_or_update(make_key_ref(keyring[id], 1), "asymmetric",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) NULL, data, size, perm,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) KEY_ALLOC_NOT_IN_QUOTA);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) if (IS_ERR(key)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) rc = PTR_ERR(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) pr_err("Problem loading X.509 certificate %d\n", rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) pr_notice("Loaded X.509 cert '%s'\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) key_ref_to_ptr(key)->description);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) key_ref_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) int __init integrity_load_x509(const unsigned int id, const char *path)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) void *data = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) size_t size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) key_perm_t perm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) rc = kernel_read_file_from_path(path, 0, &data, INT_MAX, NULL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) READING_X509_CERTIFICATE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) if (rc < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) pr_err("Unable to open file: %s (%d)", path, rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) size = rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) pr_info("Loading X.509 certificate: %s\n", path);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) rc = integrity_add_key(id, (const void *)data, size, perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) vfree(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) int __init integrity_load_cert(const unsigned int id, const char *source,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) const void *data, size_t len, key_perm_t perm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) if (!data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) pr_info("Loading X.509 certificate: %s\n", source);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) return integrity_add_key(id, data, len, perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags