| Message ID | 20210914211416.34096-4-eric.snowberg@oracle.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Enroll kernel keys thru MOK | expand |
Hi Eric,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f]
url: https://github.com/0day-ci/linux/commits/Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
base: 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f
config: arm-randconfig-c002-20210916 (attached as .config)
compiler: arm-linux-gnueabi-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/f65599b2308bdd9f29cfafd3286622f71aafa0b5
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
git checkout f65599b2308bdd9f29cfafd3286622f71aafa0b5
# save the attached .config to linux build tree
mkdir build_dir
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=arm SHELL=/bin/bash
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
arm-linux-gnueabi-ld: crypto/asymmetric_keys/restrict.o: in function `restrict_link_by_ca':
>> restrict.c:(.text+0x344): undefined reference to `public_key_verify_signature'
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Hi Eric,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f]
url: https://github.com/0day-ci/linux/commits/Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
base: 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f
config: x86_64-randconfig-c022-20210916 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/f65599b2308bdd9f29cfafd3286622f71aafa0b5
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
git checkout f65599b2308bdd9f29cfafd3286622f71aafa0b5
# save the attached .config to linux build tree
mkdir build_dir
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
ld: crypto/asymmetric_keys/restrict.o: in function `restrict_link_by_ca':
>> crypto/asymmetric_keys/restrict.c:148: undefined reference to `public_key_verify_signature'
vim +148 crypto/asymmetric_keys/restrict.c
110
111 /**
112 * restrict_link_by_ca - Restrict additions to a ring of CA keys
113 * @dest_keyring: Keyring being linked to.
114 * @type: The type of key being added.
115 * @payload: The payload of the new key.
116 * @trusted: Unused.
117 *
118 * Check if the new certificate is a CA. If it is a CA, then mark the new
119 * certificate as being ok to link.
120 *
121 * Returns 0 if the new certificate was accepted, -ENOKEY if we could not find
122 * a matching parent certificate in the trusted list. -ENOPKG if the signature
123 * uses unsupported crypto, or some other error if there is a matching
124 * certificate but the signature check cannot be performed.
125 */
126 int restrict_link_by_ca(struct key *dest_keyring,
127 const struct key_type *type,
128 const union key_payload *payload,
129 struct key *trust_keyring)
130 {
131 const struct public_key_signature *sig;
132 const struct public_key *pkey;
133
134 if (type != &key_type_asymmetric)
135 return -EOPNOTSUPP;
136
137 sig = payload->data[asym_auth];
138 if (!sig)
139 return -ENOPKG;
140
141 if (!sig->auth_ids[0] && !sig->auth_ids[1])
142 return -ENOKEY;
143
144 pkey = payload->data[asym_crypto];
145 if (!pkey)
146 return -ENOPKG;
147
> 148 return public_key_verify_signature(pkey, sig);
149 }
150
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
On 9/14/21 5:14 PM, Eric Snowberg wrote: > Add a new link restriction. Restrict the addition of keys in a keyring > based on the key to be added being a CA (self-signed). A self-signed cert can be a root CA cert or a code-signing cert. The way to differentiate a CA cert is by checking BasicConstraints CA:TRUE and keyUsage:keyCertSign. Refer to Section Basic Constraints and Key Usage in the document - https://datatracker.ietf.org/doc/html/rfc5280. Thanks & Regards, - Nayna
diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c index 84cefe3b3585..9ae43d3f862b 100644 --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -108,6 +108,46 @@ int restrict_link_by_signature(struct key *dest_keyring, return ret; } +/** + * restrict_link_by_ca - Restrict additions to a ring of CA keys + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @trusted: Unused. + * + * Check if the new certificate is a CA. If it is a CA, then mark the new + * certificate as being ok to link. + * + * Returns 0 if the new certificate was accepted, -ENOKEY if we could not find + * a matching parent certificate in the trusted list. -ENOPKG if the signature + * uses unsupported crypto, or some other error if there is a matching + * certificate but the signature check cannot be performed. + */ +int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring) +{ + const struct public_key_signature *sig; + const struct public_key *pkey; + + if (type != &key_type_asymmetric) + return -EOPNOTSUPP; + + sig = payload->data[asym_auth]; + if (!sig) + return -ENOPKG; + + if (!sig->auth_ids[0] && !sig->auth_ids[1]) + return -ENOKEY; + + pkey = payload->data[asym_crypto]; + if (!pkey) + return -ENOPKG; + + return public_key_verify_signature(pkey, sig); +} + static bool match_either_id(const struct asymmetric_key_ids *pair, const struct asymmetric_key_id *single) { diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index f603325c0c30..3ef299e2b008 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -71,6 +71,11 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring, const union key_payload *payload, struct key *trusted); +extern int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring); + extern int query_asymmetric_key(const struct kernel_pkey_params *, struct kernel_pkey_query *);
Add a new link restriction. Restrict the addition of keys in a keyring based on the key to be added being a CA (self-signed). Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> --- v1: Initial version v2: Removed secondary keyring references v3: Removed restrict_link_by_system_trusted_or_ca Simplify restrict_link_by_ca - only see if the key is a CA Did not add __init in front of restrict_link_by_ca in case restriction could be resued in the future v6: Unmodified from v3 --- crypto/asymmetric_keys/restrict.c | 40 +++++++++++++++++++++++++++++++ include/crypto/public_key.h | 5 ++++ 2 files changed, 45 insertions(+)