From patchwork Tue Jan 11 18:36:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nayna Jain X-Patchwork-Id: 12710341 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B4BDC433EF for ; Tue, 11 Jan 2022 18:37:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345411AbiAKShJ (ORCPT ); Tue, 11 Jan 2022 13:37:09 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:25674 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241327AbiAKShJ (ORCPT ); Tue, 11 Jan 2022 13:37:09 -0500 Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20BIVlLa032525; Tue, 11 Jan 2022 18:37:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=pp1; bh=1VAPgis7HD/1t1YbL6qX5csf/GGTN0INMcKQ2ZvaZzg=; b=qzPP3F9zMkLX/Y4jcKufFGAirD1X8ILiZ7ubNOwhhr14HG72gIF4lE8dvqDZmRHg3Ug1 8JHAsFp0uwX5SiMHSLPKL8Vt2tLNPTGMXCQ5wuz15x/6pNNWZLWXJisHPQA8DUU6ESE3 xzX4QryA2nofBk+PKAjFRon5+ot1sHXbhiS83+xMvLV5LfFHX/VmLdhkXbw3ndm/TYR8 fBzFGvGRZuoDdOTNJU70o8mINwtT5glKqfaYut+it9L4449ya7GNt51H3c3DYDvfk28X jH8YmetzQ2sU2M2YiGvfKeBpyuwN7KwRnefJbT0Lrr65FWTbowA1/QQtaVhfJetkJv8f aA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3dh9fwt1a2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 11 Jan 2022 18:37:04 +0000 Received: from m0098394.ppops.net (m0098394.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 20BIXj8s008085; Tue, 11 Jan 2022 18:37:03 GMT Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com with ESMTP id 3dh9fwt19f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 11 Jan 2022 18:37:03 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 20BIQnrK018636; Tue, 11 Jan 2022 18:37:01 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma04ams.nl.ibm.com with ESMTP id 3df28931wv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 11 Jan 2022 18:37:01 +0000 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 20BIaw3o46924146 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 11 Jan 2022 18:36:58 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4B80011C04C; Tue, 11 Jan 2022 18:36:58 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 00E1511C04A; Tue, 11 Jan 2022 18:36:56 +0000 (GMT) Received: from li-4b5937cc-25c4-11b2-a85c-cea3a66903e4.ibm.com.com (unknown [9.211.85.241]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 11 Jan 2022 18:36:55 +0000 (GMT) From: Nayna Jain To: linux-integrity@vger.kernel.org, keyrings@vger.kernel.org Cc: dhowells@redhat.com, zohar@linux.ibm.com, jarkko@kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dimitri.ledkov@canonical.com, seth@forshee.me, Nayna Jain Subject: [PATCH v8 0/3] integrity: support including firmware ".platform" keys at build time Date: Tue, 11 Jan 2022 13:36:44 -0500 Message-Id: <20220111183647.977037-1-nayna@linux.ibm.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: tdgA4dnUAXF2Usk07g0DEQh_y-o8XMC3 X-Proofpoint-ORIG-GUID: qmSt03qo3oqxoawmkWQdB4KzSKRxNXj1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.790,Hydra:6.0.425,FMLib:17.11.62.513 definitions=2022-01-11_04,2022-01-11_01,2021-12-02_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 bulkscore=0 adultscore=0 mlxlogscore=999 spamscore=0 mlxscore=0 clxscore=1015 priorityscore=1501 lowpriorityscore=0 impostorscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2201110100 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Some firmware support secure boot by embedding static keys to verify the Linux kernel during boot. However, these firmware do not expose an interface for the kernel to load firmware keys onto the ".platform" keyring, preventing the kernel from verifying the kexec kernel image signature. This patchset exports load_certificate_list() and defines a new function load_builtin_platform_cert() to load compiled in certificates onto the ".platform" keyring. Changelog: v8: * Includes Jarkko's feedback on patch description and removed Reported-by for Patch 1. v7: * Incldues Jarkko's feedback on patch description for Patch 1 and 3. v6: * Includes Jarkko's feedback: * Split Patch 2 into two. * Update Patch description. v5: * Renamed load_builtin_platform_cert() to load_platform_certificate_list() and config INTEGRITY_PLATFORM_BUILTIN_KEYS to INTEGRITY_PLATFORM_KEYS, as suggested by Mimi Zohar. v4: * Split into two patches as per Mimi Zohar and Dimitri John Ledkov recommendation. v3: * Included Jarkko's feedback ** updated patch description to include approach. ** removed extern for function declaration in the .h file. * Included load_certificate_list() within #ifdef CONFIG_KEYS condition. v2: * Fixed the error reported by kernel test robot * Updated patch description based on Jarkko's feedback. Nayna Jain (3): certs: export load_certificate_list() to be used outside certs/ integrity: make integrity_keyring_from_id() non-static integrity: support including firmware ".platform" keys at build time certs/Makefile | 5 ++-- certs/blacklist.c | 1 - certs/common.c | 2 +- certs/common.h | 9 ------- certs/system_keyring.c | 1 - include/keys/system_keyring.h | 6 +++++ security/integrity/Kconfig | 10 +++++++ security/integrity/Makefile | 17 +++++++++++- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 6 +++++ .../integrity/platform_certs/platform_cert.S | 23 ++++++++++++++++ .../platform_certs/platform_keyring.c | 26 +++++++++++++++++++ 12 files changed, 92 insertions(+), 16 deletions(-) delete mode 100644 certs/common.h create mode 100644 security/integrity/platform_certs/platform_cert.S