| Message ID | 20180316203837.10174-6-bauerman@linux.vnet.ibm.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | Appended signatures support for IMA appraisal | expand |
On Fri, 2018-03-16 at 17:38 -0300, Thiago Jung Bauermann wrote: > IMA will need to obtain the keyring used to verify file signatures so that > it can verify the module-style signature appended to files. > > Signed-off-by: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> > --- > security/integrity/digsig.c | 28 +++++++++++++++++++++------- > security/integrity/integrity.h | 6 ++++++ > 2 files changed, 27 insertions(+), 7 deletions(-) > > diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c > index 6f9e4ce568cd..e641a67b9fc7 100644 > --- a/security/integrity/digsig.c > +++ b/security/integrity/digsig.c > @@ -48,11 +48,10 @@ static bool init_keyring __initdata; > #define restrict_link_to_ima restrict_link_by_builtin_trusted > #endif > > -int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > - const char *digest, int digestlen) > +struct key *integrity_keyring_from_id(const unsigned int id) > { > - if (id >= INTEGRITY_KEYRING_MAX || siglen < 2) > - return -EINVAL; > + if (id >= INTEGRITY_KEYRING_MAX) > + return ERR_PTR(-EINVAL); > > if (!keyring[id]) { > keyring[id] = > @@ -61,17 +60,32 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > int err = PTR_ERR(keyring[id]); > pr_err("no %s keyring: %d\n", keyring_name[id], err); > keyring[id] = NULL; > - return err; > + return ERR_PTR(err); > } > } > > + return keyring[id]; > +} > + > +int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > + const char *digest, int digestlen) > +{ > + struct key *keyring; > + > + if (siglen < 2) > + return -EINVAL; > + > + keyring = integrity_keyring_from_id(id); > + if (IS_ERR(keyring)) > + return PTR_ERR(keyring); > + > switch (sig[1]) { > case 1: > /* v1 API expect signature without xattr type */ > - return digsig_verify(keyring[id], sig + 1, siglen - 1, > + return digsig_verify(keyring, sig + 1, siglen - 1, > digest, digestlen); > case 2: > - return asymmetric_verify(keyring[id], sig, siglen, > + return asymmetric_verify(keyring, sig, siglen, > digest, digestlen); > } > > diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h > index 79799a0d9195..2d245f44ca26 100644 > --- a/security/integrity/integrity.h > +++ b/security/integrity/integrity.h > @@ -150,6 +150,7 @@ int integrity_kernel_read(struct file *file, loff_t offset, > > #ifdef CONFIG_INTEGRITY_SIGNATURE > > +struct key *integrity_keyring_from_id(const unsigned int id); > int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > const char *digest, int digestlen); > > @@ -157,6 +158,11 @@ int __init integrity_init_keyring(const unsigned int id); > int __init integrity_load_x509(const unsigned int id, const char *path); > #else > > +static inline struct key *integrity_keyring_from_id(const unsigned int id) > +{ > + return ERR_PTR(-EINVAL); > +} > + > static inline int integrity_digsig_verify(const unsigned int id, > const char *sig, int siglen, > const char *digest, int digestlen) >
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 6f9e4ce568cd..e641a67b9fc7 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -48,11 +48,10 @@ static bool init_keyring __initdata; #define restrict_link_to_ima restrict_link_by_builtin_trusted #endif -int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, - const char *digest, int digestlen) +struct key *integrity_keyring_from_id(const unsigned int id) { - if (id >= INTEGRITY_KEYRING_MAX || siglen < 2) - return -EINVAL; + if (id >= INTEGRITY_KEYRING_MAX) + return ERR_PTR(-EINVAL); if (!keyring[id]) { keyring[id] = @@ -61,17 +60,32 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, int err = PTR_ERR(keyring[id]); pr_err("no %s keyring: %d\n", keyring_name[id], err); keyring[id] = NULL; - return err; + return ERR_PTR(err); } } + return keyring[id]; +} + +int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, + const char *digest, int digestlen) +{ + struct key *keyring; + + if (siglen < 2) + return -EINVAL; + + keyring = integrity_keyring_from_id(id); + if (IS_ERR(keyring)) + return PTR_ERR(keyring); + switch (sig[1]) { case 1: /* v1 API expect signature without xattr type */ - return digsig_verify(keyring[id], sig + 1, siglen - 1, + return digsig_verify(keyring, sig + 1, siglen - 1, digest, digestlen); case 2: - return asymmetric_verify(keyring[id], sig, siglen, + return asymmetric_verify(keyring, sig, siglen, digest, digestlen); } diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 79799a0d9195..2d245f44ca26 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -150,6 +150,7 @@ int integrity_kernel_read(struct file *file, loff_t offset, #ifdef CONFIG_INTEGRITY_SIGNATURE +struct key *integrity_keyring_from_id(const unsigned int id); int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, const char *digest, int digestlen); @@ -157,6 +158,11 @@ int __init integrity_init_keyring(const unsigned int id); int __init integrity_load_x509(const unsigned int id, const char *path); #else +static inline struct key *integrity_keyring_from_id(const unsigned int id) +{ + return ERR_PTR(-EINVAL); +} + static inline int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, const char *digest, int digestlen)
IMA will need to obtain the keyring used to verify file signatures so that it can verify the module-style signature appended to files. Signed-off-by: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> --- security/integrity/digsig.c | 28 +++++++++++++++++++++------- security/integrity/integrity.h | 6 ++++++ 2 files changed, 27 insertions(+), 7 deletions(-)