From patchwork Thu May 12 07:01:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Coiby Xu X-Patchwork-Id: 12847224 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E1C0EC433EF for ; Thu, 12 May 2022 07:02:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=PMZgSjdmEmYyOnAzsUkeT+cDtFVYXbRKeih7Mgvqu/0=; b=MlDVh/+hHo8wna 95VhHL4m8DraSliFpos5aj5PUNu2NGBiKFg/BCg4CiKi8hljWkBjhJJgNwb8Noh3jgA12wgIheALB rQjrAZRWykRxAEGNzsoLcKAsEqkx7KBhIfXc+ae7RdADgMGJXHsvBzlmjuS3rIJbqdYTqrL/oEX+k 910JobHJZBuiz5/T5tjKlEMF3n79mhzJFRyDEYbPBIAxnQ0iphkf4hVCMVit0QgjScmJocu9XGUks X9XvoRr2ha3BqpJGRoFmwl3I4iCjlHnuq8JhBf69zFbpGH3IXXxoBqr6O6EtIo+5PM7U1FmnF1o4Y UtqpE8MbqrtA+YJ0CQrw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1np2pJ-00Ac8T-MN; Thu, 12 May 2022 07:01:34 +0000 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1np2pG-00Ac6a-6m for linux-arm-kernel@lists.infradead.org; Thu, 12 May 2022 07:01:31 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1652338888; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JKiOKumUugp1kOs8tK59Is2frorq+U31ddOByhoWVoE=; b=VS1PijO45EWmcqWpzLD/5LsxzUt8B0GmQpsQ1WB2FwscA0ymf0WhJ+Urp/H+E2zNaM1a5L HAFBW4opkYRiSDW0h9F+0Ub7bAyvOtpN+uZaCgFlPPQNvb9QCxr9qErbuXvB316garsLEd Jv3TxypN9dj+DPXOK1kIWHR+5oMtiI0= Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-12-ZluXMHZ0NdiAON9Wxm04yg-1; Thu, 12 May 2022 03:01:27 -0400 X-MC-Unique: ZluXMHZ0NdiAON9Wxm04yg-1 Received: by mail-pl1-f200.google.com with SMTP id l5-20020a170902ec0500b0015cf1cfa4eeso2294649pld.17 for ; Thu, 12 May 2022 00:01:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=JKiOKumUugp1kOs8tK59Is2frorq+U31ddOByhoWVoE=; b=62YWJGuc0uvBVZ5SBmp7iqw++DEFKJ8XrGFdbYsHAVklA76r92A+6yB/HYQZ/h2lMx 6pLlzsgGea4qi1hvqtkW0eWZcEYPRgq/lFXoCf4UuJDLCuTaaNkHC03aX7Su1t1R9j4u btDddh7ytrkaYg0M529OXK2Z13kH+Vt3iDwNED/HI0M9Ivsk5jqYC6BdbCA3fanOsMfE DUYIa+LLzMd/c5xnzOFKnFiabfMEiUYgVPt+HnQ4bt3LKxDNniozWxInomeWUnD+itis 3FOjOZqGmwCEa8IKWGKgoYFkMGdTxhKSUBwS1USryS2FaZEpvcZ4BW6h/4A7W9l1GBIk 1JIw== X-Gm-Message-State: AOAM532BQJJjsrInhZQhg8IYY2vNuYz3ayl2OyozHGeMfX7N9e+T5uHt ixxEI18rUb+xvMPWnyUs7fAWl2Y9tQc5m4HQ3uQ6lZVEfaBWpe15s7t6vvkqkNVuH6itrkjrzG+ /pil4gpbCjXQJ/o9QQqD8Rxp8soRBSUUE334= X-Received: by 2002:a17:902:f605:b0:154:aa89:bd13 with SMTP id n5-20020a170902f60500b00154aa89bd13mr29620555plg.112.1652338886423; Thu, 12 May 2022 00:01:26 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx7p6JmYZRlOtQ1ku2YL4n0t2C1S4tCCCZSn/J/LOQkQ83QmgHV06bVJ6vgcWXaY/dvfDJR/A== X-Received: by 2002:a17:902:f605:b0:154:aa89:bd13 with SMTP id n5-20020a170902f60500b00154aa89bd13mr29620532plg.112.1652338886107; Thu, 12 May 2022 00:01:26 -0700 (PDT) Received: from localhost ([240e:3a1:2e9:efa0:e73c:e550:ac9e:58fd]) by smtp.gmail.com with ESMTPSA id n10-20020a170902968a00b0015e8d4eb2afsm3015408plp.249.2022.05.12.00.01.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 May 2022 00:01:25 -0700 (PDT) From: Coiby Xu To: kexec@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org, Michal Suchanek , Baoquan He , Dave Young , Will Deacon , "Eric W . Biederman" , Mimi Zohar , Chun-Yi Lee Subject: [PATCH v8 0/4] use more system keyrings to verify arm64 and s390 kexec kernel image signature Date: Thu, 12 May 2022 15:01:19 +0800 Message-Id: <20220512070123.29486-1-coxu@redhat.com> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=coxu@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220512_000130_418337_CA3BF9DB X-CRM114-Status: GOOD ( 15.51 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Currently, a problem faced by arm64 is if a kernel image is signed by a MOK key, loading it via the kexec_file_load() system call would be rejected with the error "Lockdown: kexec: kexec of unsigned images is restricted; see man kernel_lockdown.7". This happens because arm64 uses only the primary keyring i.e. the .builtin_trusted_keys keyring that contains only kernel built-in keys to verify the kexec kernel image. MOK keys are loaded into the .platform keyring or/and .machine keyring. The .machine keyring is linked to the secondary keyring i.e. .secondary_trusted_keys keyring when the end-user chooses to trust MOK keys. The platform keyring is exclusively used for kexec kernel image verification and .secondary_trusted_keys together with .builtin_trusted_keys are the system trusted keyrings. So obviously there is no reason to not use .secondary_trusted_keys or .platform keyring for kernel image signature verification. Similarly, s390 only uses platform keyring for kernel image signature verification and built-in keys and secondary keyring are not used. This patch set allows arm64 and s390 to use more system keyrings including the .secondary_trusted_keys and .platform keyring to verify kexec kernel image signature as x86 does. The 3rd arm64 patch depends on the first two patches. The 4th s390 patch can be applied independently. v8: - drop "Cc: stable@vger.kernel.org" for the first two prerequisite patches [Baoquan] v7: - drop the Fixes tag for the 2nd patch and add patch prerequisites [Baoquan] - improve cover letter v6: - integrate the first three patches of "[PATCH 0/4] Unifrom keyring support across architectures and functions" from Michal [1] - improve commit message [Baoquan, Michal] - directly assign kexec_kernel_verify_pe_sig to kexec_file_ops->verify_sig [Michal] v5: - improve commit message [Baoquan] v4: - fix commit reference format issue and other checkpatch.pl warnings [Baoquan] v3: - s/arch_kexec_kernel_verify_pe_sig/kexec_kernel_verify_pe_sig [Eric] - clean up arch_kexec_kernel_verify_sig [Eric] v2: - only x86_64 and arm64 need to enable PE file signature check [Dave] [1] https://lore.kernel.org/lkml/cover.1644953683.git.msuchanek@suse.de/ Coiby Xu (3): kexec: clean up arch_kexec_kernel_verify_sig kexec, KEYS: make the code in bzImage64_verify_sig generic arm64: kexec_file: use more system keyrings to verify kernel image signature Michal Suchanek (1): kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification arch/arm64/kernel/kexec_image.c | 11 +----- arch/s390/kernel/machine_kexec_file.c | 18 +++++++--- arch/x86/kernel/kexec-bzimage64.c | 20 +---------- include/linux/kexec.h | 7 ++-- kernel/kexec_file.c | 51 ++++++++++++++++----------- 5 files changed, 50 insertions(+), 57 deletions(-)