diff mbox series

[v6,03/13] KEYS: CA link restriction

Message ID 20210914211416.34096-4-eric.snowberg@oracle.com (mailing list archive)
State New
Headers show
Series Enroll kernel keys thru MOK | expand

Commit Message

Eric Snowberg Sept. 14, 2021, 9:14 p.m. UTC 
Add a new link restriction.  Restrict the addition of keys in a keyring
based on the key to be added being a CA (self-signed).

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v1: Initial version
v2: Removed secondary keyring references
v3: Removed restrict_link_by_system_trusted_or_ca
    Simplify restrict_link_by_ca - only see if the key is a CA
    Did not add __init in front of restrict_link_by_ca in case
      restriction could be resued in the future
v6: Unmodified from v3
---
 crypto/asymmetric_keys/restrict.c | 40 +++++++++++++++++++++++++++++++
 include/crypto/public_key.h       |  5 ++++
 2 files changed, 45 insertions(+)

Comments

kernel test robot Sept. 16, 2021, 4:21 a.m. UTC | #1 
Hi Eric,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f]

url:    https://github.com/0day-ci/linux/commits/Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
base:   6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f
config: arm-randconfig-c002-20210916 (attached as .config)
compiler: arm-linux-gnueabi-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/f65599b2308bdd9f29cfafd3286622f71aafa0b5
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
        git checkout f65599b2308bdd9f29cfafd3286622f71aafa0b5
        # save the attached .config to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=arm SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   arm-linux-gnueabi-ld: crypto/asymmetric_keys/restrict.o: in function `restrict_link_by_ca':
>> restrict.c:(.text+0x344): undefined reference to `public_key_verify_signature'

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
kernel test robot Sept. 16, 2021, 5:46 a.m. UTC | #2 
Hi Eric,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f]

url:    https://github.com/0day-ci/linux/commits/Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
base:   6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f
config: x86_64-randconfig-c022-20210916 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
        # https://github.com/0day-ci/linux/commit/f65599b2308bdd9f29cfafd3286622f71aafa0b5
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
        git checkout f65599b2308bdd9f29cfafd3286622f71aafa0b5
        # save the attached .config to linux build tree
        mkdir build_dir
        make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   ld: crypto/asymmetric_keys/restrict.o: in function `restrict_link_by_ca':
>> crypto/asymmetric_keys/restrict.c:148: undefined reference to `public_key_verify_signature'


vim +148 crypto/asymmetric_keys/restrict.c

   110	
   111	/**
   112	 * restrict_link_by_ca - Restrict additions to a ring of CA keys
   113	 * @dest_keyring: Keyring being linked to.
   114	 * @type: The type of key being added.
   115	 * @payload: The payload of the new key.
   116	 * @trusted: Unused.
   117	 *
   118	 * Check if the new certificate is a CA. If it is a CA, then mark the new
   119	 * certificate as being ok to link.
   120	 *
   121	 * Returns 0 if the new certificate was accepted, -ENOKEY if we could not find
   122	 * a matching parent certificate in the trusted list.  -ENOPKG if the signature
   123	 * uses unsupported crypto, or some other error if there is a matching
   124	 * certificate  but the signature check cannot be performed.
   125	 */
   126	int restrict_link_by_ca(struct key *dest_keyring,
   127				const struct key_type *type,
   128				const union key_payload *payload,
   129				struct key *trust_keyring)
   130	{
   131		const struct public_key_signature *sig;
   132		const struct public_key *pkey;
   133	
   134		if (type != &key_type_asymmetric)
   135			return -EOPNOTSUPP;
   136	
   137		sig = payload->data[asym_auth];
   138		if (!sig)
   139			return -ENOPKG;
   140	
   141		if (!sig->auth_ids[0] && !sig->auth_ids[1])
   142			return -ENOKEY;
   143	
   144		pkey = payload->data[asym_crypto];
   145		if (!pkey)
   146			return -ENOPKG;
   147	
 > 148		return public_key_verify_signature(pkey, sig);
   149	}
   150	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Nayna Sept. 16, 2021, 8:05 p.m. UTC | #3 
On 9/14/21 5:14 PM, Eric Snowberg wrote:
> Add a new link restriction.  Restrict the addition of keys in a keyring
> based on the key to be added being a CA (self-signed).

A self-signed cert can be a root CA cert or a code-signing cert. The way 
to differentiate a CA cert is by checking BasicConstraints CA:TRUE and 
keyUsage:keyCertSign. Refer to Section Basic Constraints and Key Usage 
in the document - https://datatracker.ietf.org/doc/html/rfc5280.

Thanks & Regards,

      - Nayna
diff mbox series

Patch

diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
index 84cefe3b3585..9ae43d3f862b 100644
--- a/crypto/asymmetric_keys/restrict.c
+++ b/crypto/asymmetric_keys/restrict.c
@@ -108,6 +108,46 @@  int restrict_link_by_signature(struct key *dest_keyring,
 	return ret;
 }
 
+/**
+ * restrict_link_by_ca - Restrict additions to a ring of CA keys
+ * @dest_keyring: Keyring being linked to.
+ * @type: The type of key being added.
+ * @payload: The payload of the new key.
+ * @trusted: Unused.
+ *
+ * Check if the new certificate is a CA. If it is a CA, then mark the new
+ * certificate as being ok to link.
+ *
+ * Returns 0 if the new certificate was accepted, -ENOKEY if we could not find
+ * a matching parent certificate in the trusted list.  -ENOPKG if the signature
+ * uses unsupported crypto, or some other error if there is a matching
+ * certificate  but the signature check cannot be performed.
+ */
+int restrict_link_by_ca(struct key *dest_keyring,
+			const struct key_type *type,
+			const union key_payload *payload,
+			struct key *trust_keyring)
+{
+	const struct public_key_signature *sig;
+	const struct public_key *pkey;
+
+	if (type != &key_type_asymmetric)
+		return -EOPNOTSUPP;
+
+	sig = payload->data[asym_auth];
+	if (!sig)
+		return -ENOPKG;
+
+	if (!sig->auth_ids[0] && !sig->auth_ids[1])
+		return -ENOKEY;
+
+	pkey = payload->data[asym_crypto];
+	if (!pkey)
+		return -ENOPKG;
+
+	return public_key_verify_signature(pkey, sig);
+}
+
 static bool match_either_id(const struct asymmetric_key_ids *pair,
 			    const struct asymmetric_key_id *single)
 {
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index f603325c0c30..3ef299e2b008 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -71,6 +71,11 @@  extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring,
 						 const union key_payload *payload,
 						 struct key *trusted);
 
+extern int restrict_link_by_ca(struct key *dest_keyring,
+			       const struct key_type *type,
+			       const union key_payload *payload,
+			       struct key *trust_keyring);
+
 extern int query_asymmetric_key(const struct kernel_pkey_params *,
 				struct kernel_pkey_query *);