From patchwork Fri Mar 4 17:54:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nayna Jain X-Patchwork-Id: 12769690 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0F1DC4332F for ; Fri, 4 Mar 2022 17:54:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236174AbiCDRzQ (ORCPT ); Fri, 4 Mar 2022 12:55:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46426 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229608AbiCDRzQ (ORCPT ); Fri, 4 Mar 2022 12:55:16 -0500 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DA3701B8CAE; Fri, 4 Mar 2022 09:54:27 -0800 (PST) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 224GnVEl014690; Fri, 4 Mar 2022 17:54:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : mime-version; s=pp1; bh=ddnQcWmxR5yIRPFKEzafRdeHmN6llHVQgmZpng9Of8A=; b=n/09CYqAm5Axx0r0yNVbqPm047UllmQhpOt1py/kpZ4s8/Dj8F/uaQqMUEAeyP3oU9QC 9Q7lr4DYlsQwZxh04SWZPxAjuSnwJUGW0/tC8x+jdfENLlVkC/FI0fto4+rLVQ74Zn84 mcdegj8yWoz6qCkEd/07kUSaDrL3mWWjPpwDBuWIbrLcs+9K+ZtLsdj5jvNLpPd5+EJ6 PIRtRx6mGfNTJjSGIZqvQ0AZ9vzgFFzwUjQsylPn1+qRgdXD4TiticFDKd2JBxpujXxL p1gQ/TMQuhv+DzGOIEtFD+OAKGTP/IyxITmvmNyVZPStOXySiq6KN+L1EE3DD80rLdh7 Hw== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3ekpmph5cg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 04 Mar 2022 17:54:23 +0000 Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 224HoB8T006584; Fri, 4 Mar 2022 17:54:22 GMT Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0a-001b2d01.pphosted.com with ESMTP id 3ekpmph5c0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 04 Mar 2022 17:54:22 +0000 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 224HnJLs002169; Fri, 4 Mar 2022 17:54:20 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma02fra.de.ibm.com with ESMTP id 3ek4k4j1tt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 04 Mar 2022 17:54:20 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 224HsGLW58327396 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 4 Mar 2022 17:54:17 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DD064A405F; Fri, 4 Mar 2022 17:54:16 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0CCDAA4054; Fri, 4 Mar 2022 17:54:14 +0000 (GMT) Received: from li-4b5937cc-25c4-11b2-a85c-cea3a66903e4.ibm.com.com (unknown [9.211.34.89]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 4 Mar 2022 17:54:13 +0000 (GMT) From: Nayna Jain To: linux-integrity@vger.kernel.org, keyrings@vger.kernel.org Cc: dhowells@redhat.com, zohar@linux.ibm.com, jarkko@kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dimitri.ledkov@canonical.com, seth@forshee.me, rnsastry@linux.ibm.com, Nayna Jain Subject: [PATCH v9 0/3] integrity: support including firmware ".platform" keys at build time Date: Fri, 4 Mar 2022 12:54:00 -0500 Message-Id: <20220304175403.20092-1-nayna@linux.ibm.com> X-Mailer: git-send-email 2.27.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: P2-douyNUXyUCqEqacUZ6ZIPKLRi9Gib X-Proofpoint-ORIG-GUID: Y3HzdXXFTR7uK56j5kJ595at_wEoweIV X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.816,Hydra:6.0.425,FMLib:17.11.64.514 definitions=2022-03-04_07,2022-03-04_01,2022-02-23_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 malwarescore=0 mlxlogscore=999 impostorscore=0 spamscore=0 phishscore=0 adultscore=0 suspectscore=0 priorityscore=1501 clxscore=1011 bulkscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2203040088 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Some firmware support secure boot by embedding static keys to verify the Linux kernel during boot. However, these firmware do not expose an interface for the kernel to load firmware keys onto the ".platform" keyring, preventing the kernel from verifying the kexec kernel image signature. This patchset exports load_certificate_list() and defines a new function load_builtin_platform_cert() to load compiled in certificates onto the ".platform" keyring. Changelog: v9: * Rebased on tpmdd master branch repo - git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git v8: * Includes Jarkko's feedback on patch description and removed Reported-by for Patch 1. v7: * Incldues Jarkko's feedback on patch description for Patch 1 and 3. v6: * Includes Jarkko's feedback: * Split Patch 2 into two. * Update Patch description. v5: * Renamed load_builtin_platform_cert() to load_platform_certificate_list() and config INTEGRITY_PLATFORM_BUILTIN_KEYS to INTEGRITY_PLATFORM_KEYS, as suggested by Mimi Zohar. v4: * Split into two patches as per Mimi Zohar and Dimitri John Ledkov recommendation. v3: * Included Jarkko's feedback ** updated patch description to include approach. ** removed extern for function declaration in the .h file. * Included load_certificate_list() within #ifdef CONFIG_KEYS condition. v2: * Fixed the error reported by kernel test robot * Updated patch description based on Jarkko's feedback. Nayna Jain (3): certs: export load_certificate_list() to be used outside certs/ integrity: make integrity_keyring_from_id() non-static integrity: support including firmware ".platform" keys at build time certs/Makefile | 5 ++-- certs/blacklist.c | 1 - certs/common.c | 2 +- certs/common.h | 9 ------- certs/system_keyring.c | 1 - include/keys/system_keyring.h | 6 +++++ security/integrity/Kconfig | 10 +++++++ security/integrity/Makefile | 15 ++++++++++- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 6 +++++ .../integrity/platform_certs/platform_cert.S | 23 ++++++++++++++++ .../platform_certs/platform_keyring.c | 26 +++++++++++++++++++ 12 files changed, 90 insertions(+), 16 deletions(-) delete mode 100644 certs/common.h create mode 100644 security/integrity/platform_certs/platform_cert.S base-commit: c9e54f38976a1c0ec69c0a6208b3fd55fceb01d1