From patchwork Wed Feb 28 17:55:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nayna X-Patchwork-Id: 10249171 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4743D60211 for ; Wed, 28 Feb 2018 17:58:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2FBD228C50 for ; Wed, 28 Feb 2018 17:58:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2487728C6B; Wed, 28 Feb 2018 17:58:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7EEFE28C50 for ; Wed, 28 Feb 2018 17:58:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934489AbeB1R4z (ORCPT ); Wed, 28 Feb 2018 12:56:55 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:47788 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S934270AbeB1R4x (ORCPT ); Wed, 28 Feb 2018 12:56:53 -0500 Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w1SHsgBp006806 for ; Wed, 28 Feb 2018 12:56:52 -0500 Received: from e06smtp13.uk.ibm.com (e06smtp13.uk.ibm.com [195.75.94.109]) by mx0a-001b2d01.pphosted.com with ESMTP id 2gdw7mc7s2-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Wed, 28 Feb 2018 12:56:52 -0500 Received: from localhost by e06smtp13.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 28 Feb 2018 17:56:50 -0000 Received: from b06cxnps4076.portsmouth.uk.ibm.com (9.149.109.198) by e06smtp13.uk.ibm.com (192.168.101.143) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 28 Feb 2018 17:56:48 -0000 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id w1SHulI456295494; Wed, 28 Feb 2018 17:56:47 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5EF8542047; Wed, 28 Feb 2018 17:49:17 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BE93842041; Wed, 28 Feb 2018 17:49:14 +0000 (GMT) Received: from swastik.in.ibm.com (unknown [9.195.33.56]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2018 17:49:14 +0000 (GMT) From: Nayna Jain To: dhowells@redhat.com Cc: keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org, Nayna Jain Subject: [PATCH 1/3] certs: define a trusted platform keyring Date: Wed, 28 Feb 2018 23:25:19 +0530 X-Mailer: git-send-email 2.13.6 X-TM-AS-GCONF: 00 x-cbid: 18022817-0012-0000-0000-000005B717C9 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18022817-0013-0000-0000-0000193318BD Message-Id: <20180228175521.10287-1-nayna@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2018-02-28_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1802280218 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP The kernel can be supplied in SEEPROM or lockable flash memory in embedded devices. Some devices may not support secure boot, but the kernel is trusted because the image is stored in protected memory. That kernel may need to kexec additional kernels, it may be used as a bootloader, for example, or it may need to kexec a crashdump kernel. In such cases, it may want to verify the signature of the next kernel. The kernel, however, cannot directly verify platform keys, and an administrator may therefore not want to trust them for arbitrary usage. In order to differentiate platform keys from other keys and provide the necessary separation of trust, the kernel needs an additional keyring to store platform keys. This patch implements a built-in list of certificates that are loaded onto the trusted platform keyring named ".platform_keys" to facilitate signature verification during kexec. Because the platform keyring are builtin, it cannot be updated from userspace. This keyring can be enabled by setting CONFIG_PLATFORM_KEYRING. The platform certificate can be provided using CONFIG_PLATFORM_TRUSTED_KEYS. Signed-off-by: Nayna Jain --- certs/Kconfig | 17 +++++++++++ certs/Makefile | 13 ++++++++ certs/system_certificates.S | 20 ++++++++++++ certs/system_keyring.c | 74 ++++++++++++++++++++++++++++++++++----------- 4 files changed, 107 insertions(+), 17 deletions(-) diff --git a/certs/Kconfig b/certs/Kconfig index 5f7663df6e8e..608a4358a25e 100644 --- a/certs/Kconfig +++ b/certs/Kconfig @@ -83,4 +83,21 @@ config SYSTEM_BLACKLIST_HASH_LIST wrapper to incorporate the list into the kernel. Each should be a string of hex digits. +config PLATFORM_KEYRING + bool "Provide keyring for platform trusted keys" + depends on KEYS + depends on ASYMMETRIC_KEY_TYPE + help + Provide a separate, distinct keyring for platform trusted keys, which + the kernel automatically populates during initialization from values + embedded during build, used for verifying the kexec'ed kernel image + and, possibly, the initramfs signature. + +config PLATFORM_TRUSTED_KEYS + string "Platform/Firmware trusted X.509 certs." + depends on PLATFORM_KEYRING + help + Provide the filename of a PEM-formatted file containing the platform + trusted X.509 certificates to be loaded in the platform keyring. + endmenu diff --git a/certs/Makefile b/certs/Makefile index 5d0999b9e21b..680903725031 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -104,3 +104,16 @@ targets += signing_key.x509 $(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE $(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) endif # CONFIG_MODULE_SIG + + +ifeq ($(CONFIG_PLATFORM_KEYRING),y) + +$(eval $(call config_filename,PLATFORM_TRUSTED_KEYS)) + +# GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) +$(obj)/system_certificates.o: $(obj)/platform_certificate_list + +targets += platform_certificate_list +$(obj)/platform_certificate_list: scripts/extract-cert $(PLATFORM_TRUSTED_KEYS_FILENAME) FORCE + $(call if_changed,extract_certs,$(CONFIG_PLATFORM_TRUSTED_KEYS)) +endif # CONFIG_PLATFORM_KEYRING diff --git a/certs/system_certificates.S b/certs/system_certificates.S index 3918ff7235ed..b0eb448ee617 100644 --- a/certs/system_certificates.S +++ b/certs/system_certificates.S @@ -14,6 +14,15 @@ __cert_list_start: .incbin "certs/x509_certificate_list" __cert_list_end: +#ifdef CONFIG_PLATFORM_KEYRING + .align 8 + .globl VMLINUX_SYMBOL(platform_certificate_list) +VMLINUX_SYMBOL(platform_certificate_list): +__platform_cert_list_start: + .incbin "certs/platform_certificate_list" +__platform_cert_list_end: +#endif /* CONFIG_PLATFORM_KEYRING */ + #ifdef CONFIG_SYSTEM_EXTRA_CERTIFICATE .globl VMLINUX_SYMBOL(system_extra_cert) .size system_extra_cert, CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE @@ -35,3 +44,14 @@ VMLINUX_SYMBOL(system_certificate_list_size): #else .long __cert_list_end - __cert_list_start #endif + +#ifdef CONFIG_PLATFORM_KEYRING + .align 8 + .globl VMLINUX_SYMBOL(platform_certificate_list_size) +VMLINUX_SYMBOL(platform_certificate_list_size): +#ifdef CONFIG_64BIT + .quad __platform_cert_list_end - __platform_cert_list_start +#else + .long __platform_cert_list_end - __platform_cert_list_start +#endif +#endif /* CONFIG_PLATFORM_KEYRING */ diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 6251d1b27f0c..1900466ed46c 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -19,14 +19,22 @@ #include #include +#define BUILTIN_TRUSTED_KEYRING 0 +#define PLATFORM_KEYRING 1 + static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_PLATFORM_KEYRING +static struct key *platform_keys __ro_after_init; +#endif extern __initconst const u8 system_certificate_list[]; extern __initconst const unsigned long system_certificate_list_size; +extern __initconst const u8 platform_certificate_list[]; +extern __initconst const unsigned long platform_certificate_list_size; /** * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA * @@ -123,6 +131,18 @@ static __init int system_trusted_keyring_init(void) panic("Can't link trusted keyrings\n"); #endif +#ifdef CONFIG_PLATFORM_KEYRING + platform_keys = + keyring_alloc(".platform_keys", + KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), + ((KEY_POS_ALL & ~KEY_POS_SETATTR) | + KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH), + KEY_ALLOC_NOT_IN_QUOTA, + NULL, NULL); + if (IS_ERR(platform_keys)) + panic("Can't allocate platform keyring\n"); +#endif + return 0; } @@ -132,18 +152,19 @@ static __init int system_trusted_keyring_init(void) device_initcall(system_trusted_keyring_init); /* - * Load the compiled-in list of X.509 certificates. + * Load the certificates to the keyring. */ -static __init int load_system_certificate_list(void) +static __init int load_certificate_list(const u8 *p, unsigned long size, + struct key *keyring) { key_ref_t key; - const u8 *p, *end; + const u8 *end; size_t plen; - pr_notice("Loading compiled-in X.509 certificates\n"); + pr_notice("Loading compiled-in X.509 certificates to %s\n", + keyring->description); - p = system_certificate_list; - end = p + system_certificate_list_size; + end = p + size; while (p < end) { /* Each cert begins with an ASN.1 SEQUENCE tag and must be more * than 256 bytes in size. @@ -158,16 +179,17 @@ static __init int load_system_certificate_list(void) if (plen > end - p) goto dodgy_cert; - key = key_create_or_update(make_key_ref(builtin_trusted_keys, 1), - "asymmetric", - NULL, - p, - plen, - ((KEY_POS_ALL & ~KEY_POS_SETATTR) | - KEY_USR_VIEW | KEY_USR_READ), - KEY_ALLOC_NOT_IN_QUOTA | - KEY_ALLOC_BUILT_IN | - KEY_ALLOC_BYPASS_RESTRICTION); + key = key_create_or_update(make_key_ref(keyring, 1), + "asymmetric", + NULL, + p, + plen, + ((KEY_POS_ALL & ~KEY_POS_SETATTR) | + KEY_USR_VIEW | KEY_USR_READ), + KEY_ALLOC_NOT_IN_QUOTA | + KEY_ALLOC_BUILT_IN | + KEY_ALLOC_BYPASS_RESTRICTION); + if (IS_ERR(key)) { pr_err("Problem loading in-kernel X.509 certificate (%ld)\n", PTR_ERR(key)); @@ -185,7 +207,25 @@ static __init int load_system_certificate_list(void) pr_err("Problem parsing in-kernel X.509 certificate list\n"); return 0; } -late_initcall(load_system_certificate_list); + +/* + * Load the compiled-in list of system and platform X.509 certificates. + */ +static __init int load_compiled_certificate_list(void) +{ + /* Loading certs in builtin keyring */ + load_certificate_list(system_certificate_list, + system_certificate_list_size, builtin_trusted_keys); + +#ifdef CONFIG_PLATFORM_KEYRING + /* Loading certs in platform keyring */ + load_certificate_list(platform_certificate_list, + platform_certificate_list_size, platform_keys); +#endif + + return 0; +} +late_initcall(load_compiled_certificate_list); #ifdef CONFIG_SYSTEM_DATA_VERIFICATION