@@ -624,6 +624,12 @@
cio_ignore= [S390]
See Documentation/arch/s390/common_io.rst for details.
+ clavis= [SECURITY,EARLY]
+ Identifies a specific key contained in one of the system
+ keyrings (builtin, secondary, or platform) to be used as
+ the Clavis root of trust.
+ Format: { <keyid> }
+
clearcpuid=X[,X...] [X86]
Disable CPUID feature X for the kernel. See
arch/x86/include/asm/cpufeatures.h for the valid bit
@@ -23,6 +23,14 @@ enum integrity_status {
#ifdef CONFIG_INTEGRITY
extern void __init integrity_load_keys(void);
+#ifdef CONFIG_SECURITY_CLAVIS
+void late_init_clavis_setup(void);
+#else
+static inline void late_init_clavis_setup(void)
+{
+}
+#endif
+
#else
static inline void integrity_load_keys(void)
{
@@ -192,6 +192,7 @@ source "security/yama/Kconfig"
source "security/safesetid/Kconfig"
source "security/lockdown/Kconfig"
source "security/landlock/Kconfig"
+source "security/clavis/Kconfig"
source "security/integrity/Kconfig"
@@ -25,6 +25,7 @@ obj-$(CONFIG_SECURITY_LOCKDOWN_LSM) += lockdown/
obj-$(CONFIG_CGROUPS) += device_cgroup.o
obj-$(CONFIG_BPF_LSM) += bpf/
obj-$(CONFIG_SECURITY_LANDLOCK) += landlock/
+obj-$(CONFIG_SECURITY_CLAVIS) += clavis/
# Object integrity file lists
obj-$(CONFIG_INTEGRITY) += integrity/
new file mode 100644
@@ -0,0 +1,9 @@
+config SECURITY_CLAVIS
+ bool "Clavis keyring"
+ depends on SECURITY
+ help
+ Enable the clavis keyring. This keyring shall contain a single asymmetric key.
+ This key shall be linked to a key already contained in one of the system
+ keyrings (builtin, secondary, or platform). The only way to add this key
+ is during boot by passing in the asymmetric key id within the "clavis=" boot
+ param. This keyring is required by the Clavis LSM.
new file mode 100644
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+
+obj-$(CONFIG_SECURITY_CLAVIS) += clavis_keyring.o
new file mode 100644
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/security.h>
+#include <linux/integrity.h>
+#include <keys/asymmetric-type.h>
+#include <keys/system_keyring.h>
+
+static struct key *clavis_keyring;
+static struct asymmetric_key_id *setup_keyid;
+
+#define MAX_BIN_KID 32
+
+static struct {
+ struct asymmetric_key_id id;
+ unsigned char data[MAX_BIN_KID];
+} setup_key;
+
+static int restrict_link_for_clavis(struct key *dest_keyring, const struct key_type *type,
+ const union key_payload *payload, struct key *restrict_key)
+{
+ static bool first_pass = true;
+
+ /*
+ * Allow a single asymmetric key into this keyring. This key is used as the
+ * root of trust for anything added afterwards.
+ */
+ if (type == &key_type_asymmetric && dest_keyring == clavis_keyring && first_pass) {
+ first_pass = false;
+ return 0;
+ }
+
+ return -EOPNOTSUPP;
+}
+
+static int __init clavis_param(char *kid)
+{
+ struct asymmetric_key_id *p = &setup_key.id;
+ int error, hex_len, ascii_len = strlen(kid);
+
+ if (!kid)
+ return 1;
+
+ hex_len = ascii_len / 2;
+
+ if (hex_len > sizeof(setup_key.data))
+ return 1;
+
+ p->len = hex_len;
+ error = hex2bin(p->data, kid, p->len);
+
+ if (error < 0) {
+ pr_err("Unparsable clavis key id\n");
+ } else {
+ setup_keyid = p;
+ pr_info("clavis key id: %s\n", kid);
+ }
+
+ return 1;
+}
+__setup("clavis=", clavis_param);
+
+static int __init clavis_keyring_init(void)
+{
+ struct key_restriction *restriction;
+
+ restriction = kzalloc(sizeof(*restriction), GFP_KERNEL);
+ if (!restriction)
+ panic("Can't allocate clavis keyring restriction\n");
+ restriction->check = restrict_link_for_clavis;
+ clavis_keyring =
+ keyring_alloc(".clavis", GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, current_cred(),
+ KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH | KEY_POS_WRITE |
+ KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH | KEY_USR_WRITE,
+ KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_SET_KEEP,
+ restriction, NULL);
+
+ if (IS_ERR(clavis_keyring))
+ panic("Can't allocate clavis keyring\n");
+
+ return 0;
+}
+
+void __init late_init_clavis_setup(void)
+{
+ if (!setup_keyid)
+ return;
+
+ clavis_keyring_init();
+ system_key_link(clavis_keyring, setup_keyid);
+}
@@ -36,6 +36,8 @@ int integrity_kernel_read(struct file *file, loff_t offset,
*/
void __init integrity_load_keys(void)
{
+ late_init_clavis_setup();
+
ima_load_x509();
if (!IS_ENABLED(CONFIG_IMA_LOAD_X509))
Introduce a new system keyring called clavis. This keyring shall contain a single asymmetric key. This key shall be a linked to a key already contained in one of the system keyrings (builtin, secondary, or platform). The only way to add this key is during boot by passing in the asymmetric key id within the new "clavis=" boot param. If a matching key is found in one of the system keyrings, a link shall be created. This keyring will be used in the future by the new Clavis LSM. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> --- .../admin-guide/kernel-parameters.txt | 6 ++ include/linux/integrity.h | 8 ++ security/Kconfig | 1 + security/Makefile | 1 + security/clavis/Kconfig | 9 ++ security/clavis/Makefile | 3 + security/clavis/clavis_keyring.c | 90 +++++++++++++++++++ security/integrity/iint.c | 2 + 8 files changed, 120 insertions(+) create mode 100644 security/clavis/Kconfig create mode 100644 security/clavis/Makefile create mode 100644 security/clavis/clavis_keyring.c