| Message ID | 20230425173557.724688-5-roberto.sassu@huaweicloud.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | KEYS: Introduce user mode key and signature parsers | expand |
On 4/25/23 10:35 AM, Roberto Sassu wrote: > From: Roberto Sassu <roberto.sassu@huawei.com> > > Introduce the bpf_verify_umd_signature() kfunc, to verify UMD-parsed > signatures. The parameters and usage are the same as for > bpf_verify_pkcs7_signature(). > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > --- > kernel/trace/bpf_trace.c | 69 ++++++++++++++++++++++++++++++++-------- > 1 file changed, 55 insertions(+), 14 deletions(-) > > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c > index e8da032bb6f..c9cae337596 100644 > --- a/kernel/trace/bpf_trace.c > +++ b/kernel/trace/bpf_trace.c > @@ -1271,7 +1271,7 @@ __bpf_kfunc struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags) > * The key pointer is marked as invalid, to prevent bpf_key_put() from > * attempting to decrement the key reference count on that pointer. The key > * pointer set in such way is currently understood only by > - * verify_pkcs7_signature(). > + * verify_pkcs7_signature() and verify_umd_signature(). > * > * Set *id* to one of the values defined in include/linux/verification.h: > * 0 for the primary keyring (immutable keyring of system keys); > @@ -1317,6 +1317,27 @@ __bpf_kfunc void bpf_key_put(struct bpf_key *bkey) > } > > #ifdef CONFIG_SYSTEM_DATA_VERIFICATION > +static int validate_key(struct bpf_key *trusted_keyring) > +{ > + int ret = 0; > + > + if (trusted_keyring->has_ref) { > + /* > + * Do the permission check deferred in bpf_lookup_user_key(). > + * See bpf_lookup_user_key() for more details. > + * > + * A call to key_task_permission() here would be redundant, as > + * it is already done by keyring_search() called by > + * find_asymmetric_key(). > + */ > + ret = key_validate(trusted_keyring->key); > + if (ret < 0) > + return ret; The above if (ret < 0) return ret; can be removed. > + } > + > + return ret; > +} > + > /** > * bpf_verify_pkcs7_signature - verify a PKCS#7 signature > * @data_ptr: data to verify > @@ -1334,19 +1355,9 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, > { > int ret; > > - if (trusted_keyring->has_ref) { > - /* > - * Do the permission check deferred in bpf_lookup_user_key(). > - * See bpf_lookup_user_key() for more details. > - * > - * A call to key_task_permission() here would be redundant, as > - * it is already done by keyring_search() called by > - * find_asymmetric_key(). > - */ > - ret = key_validate(trusted_keyring->key); > - if (ret < 0) > - return ret; > - } > + ret = validate_key(trusted_keyring); > + if (ret < 0) > + return ret; > > return verify_pkcs7_signature(data_ptr->data, > bpf_dynptr_get_size(data_ptr), > @@ -1356,6 +1367,35 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, > VERIFYING_UNSPECIFIED_SIGNATURE, NULL, > NULL); > } > + > +/** > + * bpf_verify_umd_signature - Verify a UMD-parsed signature > + * @data_ptr: Data to verify > + * @sig_ptr: Signature of the data > + * @trusted_keyring: Keyring with keys trusted for signature verification > + * > + * Verify the UMD-parsed signature *sig_ptr* against the supplied *data_ptr* > + * with keys in a keyring referenced by *trusted_keyring*. > + * > + * Return: 0 on success, a negative value on error. > + */ > +__bpf_kfunc int bpf_verify_umd_signature(struct bpf_dynptr_kern *data_ptr, > + struct bpf_dynptr_kern *sig_ptr, > + struct bpf_key *trusted_keyring) > +{ > + int ret; > + > + ret = validate_key(trusted_keyring); > + if (ret < 0) > + return ret; > + > + return verify_umd_signature(data_ptr->data, > + bpf_dynptr_get_size(data_ptr), > + sig_ptr->data, bpf_dynptr_get_size(sig_ptr), > + trusted_keyring->key, > + VERIFYING_UNSPECIFIED_SIGNATURE, NULL, > + NULL); > +} > #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ > > __diag_pop(); > @@ -1366,6 +1406,7 @@ BTF_ID_FLAGS(func, bpf_lookup_system_key, KF_ACQUIRE | KF_RET_NULL) > BTF_ID_FLAGS(func, bpf_key_put, KF_RELEASE) > #ifdef CONFIG_SYSTEM_DATA_VERIFICATION > BTF_ID_FLAGS(func, bpf_verify_pkcs7_signature, KF_SLEEPABLE) > +BTF_ID_FLAGS(func, bpf_verify_umd_signature, KF_SLEEPABLE) > #endif > BTF_SET8_END(key_sig_kfunc_set) >
On Tue, 2023-04-25 at 14:25 -0700, Yonghong Song wrote: > > On 4/25/23 10:35 AM, Roberto Sassu wrote: > > From: Roberto Sassu <roberto.sassu@huawei.com> > > > > Introduce the bpf_verify_umd_signature() kfunc, to verify UMD-parsed > > signatures. The parameters and usage are the same as for > > bpf_verify_pkcs7_signature(). > > > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > > --- > > kernel/trace/bpf_trace.c | 69 ++++++++++++++++++++++++++++++++-------- > > 1 file changed, 55 insertions(+), 14 deletions(-) > > > > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c > > index e8da032bb6f..c9cae337596 100644 > > --- a/kernel/trace/bpf_trace.c > > +++ b/kernel/trace/bpf_trace.c > > @@ -1271,7 +1271,7 @@ __bpf_kfunc struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags) > > * The key pointer is marked as invalid, to prevent bpf_key_put() from > > * attempting to decrement the key reference count on that pointer. The key > > * pointer set in such way is currently understood only by > > - * verify_pkcs7_signature(). > > + * verify_pkcs7_signature() and verify_umd_signature(). > > * > > * Set *id* to one of the values defined in include/linux/verification.h: > > * 0 for the primary keyring (immutable keyring of system keys); > > @@ -1317,6 +1317,27 @@ __bpf_kfunc void bpf_key_put(struct bpf_key *bkey) > > } > > > > #ifdef CONFIG_SYSTEM_DATA_VERIFICATION > > +static int validate_key(struct bpf_key *trusted_keyring) > > +{ > > + int ret = 0; > > + > > + if (trusted_keyring->has_ref) { > > + /* > > + * Do the permission check deferred in bpf_lookup_user_key(). > > + * See bpf_lookup_user_key() for more details. > > + * > > + * A call to key_task_permission() here would be redundant, as > > + * it is already done by keyring_search() called by > > + * find_asymmetric_key(). > > + */ > > + ret = key_validate(trusted_keyring->key); > > + if (ret < 0) > > + return ret; > > The above > if (ret < 0) > return ret; > can be removed. Right, thanks! Roberto > > + } > > + > > + return ret; > > +} > > + > > /** > > * bpf_verify_pkcs7_signature - verify a PKCS#7 signature > > * @data_ptr: data to verify > > @@ -1334,19 +1355,9 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, > > { > > int ret; > > > > - if (trusted_keyring->has_ref) { > > - /* > > - * Do the permission check deferred in bpf_lookup_user_key(). > > - * See bpf_lookup_user_key() for more details. > > - * > > - * A call to key_task_permission() here would be redundant, as > > - * it is already done by keyring_search() called by > > - * find_asymmetric_key(). > > - */ > > - ret = key_validate(trusted_keyring->key); > > - if (ret < 0) > > - return ret; > > - } > > + ret = validate_key(trusted_keyring); > > + if (ret < 0) > > + return ret; > > > > return verify_pkcs7_signature(data_ptr->data, > > bpf_dynptr_get_size(data_ptr), > > @@ -1356,6 +1367,35 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, > > VERIFYING_UNSPECIFIED_SIGNATURE, NULL, > > NULL); > > } > > + > > +/** > > + * bpf_verify_umd_signature - Verify a UMD-parsed signature > > + * @data_ptr: Data to verify > > + * @sig_ptr: Signature of the data > > + * @trusted_keyring: Keyring with keys trusted for signature verification > > + * > > + * Verify the UMD-parsed signature *sig_ptr* against the supplied *data_ptr* > > + * with keys in a keyring referenced by *trusted_keyring*. > > + * > > + * Return: 0 on success, a negative value on error. > > + */ > > +__bpf_kfunc int bpf_verify_umd_signature(struct bpf_dynptr_kern *data_ptr, > > + struct bpf_dynptr_kern *sig_ptr, > > + struct bpf_key *trusted_keyring) > > +{ > > + int ret; > > + > > + ret = validate_key(trusted_keyring); > > + if (ret < 0) > > + return ret; > > + > > + return verify_umd_signature(data_ptr->data, > > + bpf_dynptr_get_size(data_ptr), > > + sig_ptr->data, bpf_dynptr_get_size(sig_ptr), > > + trusted_keyring->key, > > + VERIFYING_UNSPECIFIED_SIGNATURE, NULL, > > + NULL); > > +} > > #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ > > > > __diag_pop(); > > @@ -1366,6 +1406,7 @@ BTF_ID_FLAGS(func, bpf_lookup_system_key, KF_ACQUIRE | KF_RET_NULL) > > BTF_ID_FLAGS(func, bpf_key_put, KF_RELEASE) > > #ifdef CONFIG_SYSTEM_DATA_VERIFICATION > > BTF_ID_FLAGS(func, bpf_verify_pkcs7_signature, KF_SLEEPABLE) > > +BTF_ID_FLAGS(func, bpf_verify_umd_signature, KF_SLEEPABLE) > > #endif > > BTF_SET8_END(key_sig_kfunc_set) > >
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index e8da032bb6f..c9cae337596 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -1271,7 +1271,7 @@ __bpf_kfunc struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags) * The key pointer is marked as invalid, to prevent bpf_key_put() from * attempting to decrement the key reference count on that pointer. The key * pointer set in such way is currently understood only by - * verify_pkcs7_signature(). + * verify_pkcs7_signature() and verify_umd_signature(). * * Set *id* to one of the values defined in include/linux/verification.h: * 0 for the primary keyring (immutable keyring of system keys); @@ -1317,6 +1317,27 @@ __bpf_kfunc void bpf_key_put(struct bpf_key *bkey) } #ifdef CONFIG_SYSTEM_DATA_VERIFICATION +static int validate_key(struct bpf_key *trusted_keyring) +{ + int ret = 0; + + if (trusted_keyring->has_ref) { + /* + * Do the permission check deferred in bpf_lookup_user_key(). + * See bpf_lookup_user_key() for more details. + * + * A call to key_task_permission() here would be redundant, as + * it is already done by keyring_search() called by + * find_asymmetric_key(). + */ + ret = key_validate(trusted_keyring->key); + if (ret < 0) + return ret; + } + + return ret; +} + /** * bpf_verify_pkcs7_signature - verify a PKCS#7 signature * @data_ptr: data to verify @@ -1334,19 +1355,9 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, { int ret; - if (trusted_keyring->has_ref) { - /* - * Do the permission check deferred in bpf_lookup_user_key(). - * See bpf_lookup_user_key() for more details. - * - * A call to key_task_permission() here would be redundant, as - * it is already done by keyring_search() called by - * find_asymmetric_key(). - */ - ret = key_validate(trusted_keyring->key); - if (ret < 0) - return ret; - } + ret = validate_key(trusted_keyring); + if (ret < 0) + return ret; return verify_pkcs7_signature(data_ptr->data, bpf_dynptr_get_size(data_ptr), @@ -1356,6 +1367,35 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL); } + +/** + * bpf_verify_umd_signature - Verify a UMD-parsed signature + * @data_ptr: Data to verify + * @sig_ptr: Signature of the data + * @trusted_keyring: Keyring with keys trusted for signature verification + * + * Verify the UMD-parsed signature *sig_ptr* against the supplied *data_ptr* + * with keys in a keyring referenced by *trusted_keyring*. + * + * Return: 0 on success, a negative value on error. + */ +__bpf_kfunc int bpf_verify_umd_signature(struct bpf_dynptr_kern *data_ptr, + struct bpf_dynptr_kern *sig_ptr, + struct bpf_key *trusted_keyring) +{ + int ret; + + ret = validate_key(trusted_keyring); + if (ret < 0) + return ret; + + return verify_umd_signature(data_ptr->data, + bpf_dynptr_get_size(data_ptr), + sig_ptr->data, bpf_dynptr_get_size(sig_ptr), + trusted_keyring->key, + VERIFYING_UNSPECIFIED_SIGNATURE, NULL, + NULL); +} #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ __diag_pop(); @@ -1366,6 +1406,7 @@ BTF_ID_FLAGS(func, bpf_lookup_system_key, KF_ACQUIRE | KF_RET_NULL) BTF_ID_FLAGS(func, bpf_key_put, KF_RELEASE) #ifdef CONFIG_SYSTEM_DATA_VERIFICATION BTF_ID_FLAGS(func, bpf_verify_pkcs7_signature, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_verify_umd_signature, KF_SLEEPABLE) #endif BTF_SET8_END(key_sig_kfunc_set)