From patchwork Mon May 17 22:57:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12263329 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76362C43462 for ; Mon, 17 May 2021 22:58:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 53B826124C for ; Mon, 17 May 2021 22:58:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240069AbhEQW77 (ORCPT ); Mon, 17 May 2021 18:59:59 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:29180 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238925AbhEQW76 (ORCPT ); Mon, 17 May 2021 18:59:58 -0400 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 14HMpu9C001415; Mon, 17 May 2021 22:57:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=X3EFLaNvYo8QfsbeFJooyEAUPjmIFFwRDgcPtI1a/gw=; b=zljxyK+nJQYi4kXzoXzWC4Uxh5cNFufhwiUHMZ8Snngn0kTyf+HCE853bi0V5+1v1cBM XSyPEou0TNFB84mU5ohhluYJ+I2j+TzVoYivxugYnJ3fa05lLzTAhEHyW5QlkVkoq25p psRM0vvKR079xmgmxqTXYb8eSJt4S9RLu+kilwVdO90SwO29h4zqvuqcHaRanKnGEIWD vRJQXDJwSSNlMVi873cz4/xa04+K+1rNQkWzi99SoZqB0ZHgYKYBDLmB8ECsIlVhevMI yifc5BatrNZmZwFopl0JmDLnRQ6DqIE2VIELdtXuWgVpnNN70JKTTd0iGjpt+dsIwslQ kw== Received: from oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 38kfhwgdcd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 17 May 2021 22:57:52 +0000 Received: from userp3030.oracle.com (userp3030.oracle.com [127.0.0.1]) by pps.podrdrct (8.16.0.36/8.16.0.36) with SMTP id 14HMvpId154682; Mon, 17 May 2021 22:57:51 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2174.outbound.protection.outlook.com [104.47.73.174]) by userp3030.oracle.com with ESMTP id 38j3dtss8w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 17 May 2021 22:57:51 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=e5KPTX+KxuGxLrhtCGBqHd/5kuWpHdWDY6AeybQy/Sssr9yp2zlR7O1wLdPdHPF3lvBf7PtQV9OLn8QAJN+KNQ2+ztFsVflr7lzevdfHIkaAMVaY7WM7JshWNDh7uvLbz8wsqV3cBnpE6k2EOcXXkApgQDhIr2qnAmsUfKtRn980KkknopajAR8epIkv5EePpVaqL6sntofclBkO7gSzeF+sbduLAfojepo8LYyiY6Hy4bxrbddyuGHEzCp6QdaxYnHai36kBIiCMtTtL2+RMw9P0FBsMnkxHUP40zlHyJxSe6X3xWerojMd7G4wab66xcVTKo0LB7OUorwnunZVmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X3EFLaNvYo8QfsbeFJooyEAUPjmIFFwRDgcPtI1a/gw=; b=CVECunaj5Gwun2kecYX5d+96PQkm32X50u8YDYo4uN84UNyX3iWnGiPO7HHdmsDhbfl2bksyfGOLcuUKsFB5NUfSegAzxOPW9JjSb/1ycjZUmXn6JchnbCfVwVGr3QuLUO5ptZfg67H0KDzvIjfbetuaoXh0RHTQbt4VjRAjBY6Q8PJdAlvBjUZWhnBy6asxzQ8O5wTu0AsPqQU6UCSTrSVLoFIvYreM7ewN5SWacdE6RU+zoMRJ/xeiQ9Ormo8A3D6WjX1mGeUP7YBSOqj+t9+3yE0QgA2eg2vpgF00enUPdjVgKcLy7laO2iT0gp8sR8CfC4FwBA4Q2BeEZvZqLw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X3EFLaNvYo8QfsbeFJooyEAUPjmIFFwRDgcPtI1a/gw=; b=bosktPpbZ/yFVGP+T5tjZrLCBiJa+tXyKVAgMqW9i2WPGMXwrM6Try5w8CVoZ4fSnMmFBBIbVHy1lwYkvgK6haU5MuDRr6+49su6XSviyWY3oGbO6NL2tyvazfLe3ixoa2l17S+bYdJVte7K4WYqBLMgXnPTnUoYz4nY2mGsaOw= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB4328.namprd10.prod.outlook.com (2603:10b6:610:7e::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4129.26; Mon, 17 May 2021 22:57:48 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::99fc:aabb:5cff:b177]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::99fc:aabb:5cff:b177%3]) with mapi id 15.20.4129.031; Mon, 17 May 2021 22:57:48 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, dmitry.kasatkin@gmail.com, eric.snowberg@oracle.com, jmorris@namei.org, jarkko@kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, zohar@linux.ibm.com, torvalds@linux-foundation.org, serge@hallyn.com, James.Bottomley@HansenPartnership.com, pjones@redhat.com, glin@suse.com Subject: [RFC PATCH 1/3] keys: Add ability to trust the platform keyring Date: Mon, 17 May 2021 18:57:12 -0400 Message-Id: <20210517225714.498032-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210517225714.498032-1-eric.snowberg@oracle.com> References: <20210517225714.498032-1-eric.snowberg@oracle.com> X-Originating-IP: [148.87.23.5] X-ClientProxiedBy: SN6PR16CA0059.namprd16.prod.outlook.com (2603:10b6:805:ca::36) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from localhost.us.oracle.com (148.87.23.5) by SN6PR16CA0059.namprd16.prod.outlook.com (2603:10b6:805:ca::36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4108.25 via Frontend Transport; Mon, 17 May 2021 22:57:47 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 54bb2b3b-edcd-4c26-0372-08d919873136 X-MS-TrafficTypeDiagnostic: CH2PR10MB4328: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: AAewt9ICMRqTRM4ivndaatqjxEOmKwNp00tyPW5RUfxkMAq8w0yDBZo6cjzVlDAkeWGJYfCqJDJV42RhvLyPvgY1kgnZoHWDbEsco9/BNkrgbACZM0P/YqvQzPUTEuwaGLPbB46dD37fKi4dh+3VPDZe0Dgm6go824G+9rWDx81FERuLQw0IdKp7cGG1fV9kXcBBs2BCA4SVLdNHd0PPIK/W1sqq4IKvqjFBMdmv3yu50SzRphS16HEU6vAtBEf9Gff+MdgAPl2C6nwJCj+ASN3weM1TyzMkIeR1up04mBsA+9yM6JUuhIe/crsjd3fxd4cfhTHUmqfj4DxFiujidJYvA3bC6X0oy71ABt/MjbKhQJ77y6nGr+0dU0s6Kc573X9HxcvEX60VWj5Ij+Mw4S3GO+lyWBTfG8/Mw5ACwo8GAPeM4GZ9ZixsMTxUsz+QctkMarP9YvX07nqBYQxxGnp2HaVDt9La1kaRb5gMA08HqZUAJSAu1owhUef7rnMsFH22O7B0G4RVFd70NJOXUZOEpF28QPZ0NJ5gc3QZ4MLuyTAgY0QCIi4W/WE4hWAx33Bo3J+fiQ18cRnlCeVNTtaTeMDUyeJ6705QOyfVTnsutdozwY8j2+cVpaQx4Ch36porcqHH9pfo1xzIKSy6bQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(346002)(39860400002)(376002)(366004)(136003)(396003)(52116002)(7696005)(66476007)(5660300002)(66556008)(316002)(36756003)(66946007)(86362001)(6666004)(8936002)(6486002)(38100700002)(2906002)(44832011)(38350700002)(26005)(186003)(4326008)(83380400001)(8676002)(1076003)(956004)(7416002)(2616005)(16526019)(478600001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: 6r29TcQW3LHBGPZs9OX7jl8553RWcrobxwDKv4cRmvN9d/jwTsrMBJm+MEIwiqkjdq/4/rN8rueaXBBA1P47nc6s74uEU+QB1AcC3PgEik8W5u+a2P+1s+2We6ZvCrTxoSv8QmMFuU4bTXTgiFI+Lrbvf8UFFKxGm+cIGMN0Zhe2nFtDyPzK9xOQZF3KPg0duljlMKP3zofgYjZ9LmG3bhoYJ07J59/1nlsjFc3U3IIEdXKZ9LStIcjBhkH+58OOUkvM44KTEieRQ9ARY7bqR+Ub1RqRgKgLk5CcWaW+pzmw6sWrt9MeJCiBM+gZg7kEZMb6IFbKmn3TXELCVapqn8x/jsPlba3J8vrzUMEm+Pl/NKz+5LcNJN40XzAo+B+K6VrFRPFvFHka+gRgcEhnXVPMysZNQAVKPvleRpqGdXb7kRvxZUqQXC2rdO45EPTjXuYbefzZk1OQtaHsezmAFTdw+PVbF5XNzh34gsP9n897PEe+UaFiPklLDI7WCXpgOh0zGPevzEzEH2YjSwnz9eJcgaAFm74qZjhGNVHNuj/J1cGHvqejucjLqOqi8WIJzPgB4VNKOr8SqtY6iRW8TiOrDU9fZuwGzOYe0MZPC4dihlvv08iFPa1dJ/RE7iQjYmH02XD25UfpCU7yPDl0uJNItrgFh5tBmrYm4spl73BCzz5buWQW9GdAES95obHrk0epKl5vamxrbvkudpQRSjDCk1f5qyCI4jxNDEhVJ5BzjQ8OAj4/+l0halnuUfEO9EGh3q5+X3c4iLjZ/BNAaMWTJQDOTQ9Z3tD1WjkwkMXGn61JTryM50MZNSbd9wRAbse6Yk0ZJUR+/4SZpN4aslfSRSNsVSVZCMgQCdK57nyCtVrBD7qZsIWCfdOGRIwWq8hlZU1AKYbB63Fng3jLg4I68yghWsB4mPKh7EbTJnonsdCqms76KPykzygLRi76VCuWGdLJvmwE+yvoA7m0UvTpqPL99U2v+6siLtJgeTs+JhDiCccJ/BMQzy1IxBzsCMfKzf5LXdiDzEO7PXABhbGrwvp/aiD+OWVQWvnXrSc6XRW7mytXNntkLNKTHbvubFmTv0MgQ1cMJiY1TGxcIo9002hYcDy0DquwmoH41GC4vHwI+siqZaHvS3MSLiOKYth+xngA+lrSjHoBVZgix306tEs4OBRlyBJpdfi4MmBJfaUXVNgDVWmq8lwKur4EqfqSvNdzbwelGudySAeQr4SIwcT01rxy+8raSzdsNWgcinGix9pmmKGgEODxXg+G2a3gkbTdZukhKza7P4WCZZZH3Wbcru6OaINpIcaxQGMwO55VS/VKY4EGJ59vowxx X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 54bb2b3b-edcd-4c26-0372-08d919873136 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 May 2021 22:57:48.8091 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: N4OIpW1Ypx+hbUzcAaewbD+ADTaXp0lWypDD+2cst4nUcBLK67eSCI2YukEyHCZEcOGTaYbnCS08HzWXpKeMWv2JOiIKCpW7fGb6XpLAGxw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4328 X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9987 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 spamscore=0 mlxlogscore=999 mlxscore=0 adultscore=0 malwarescore=0 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105170162 X-Proofpoint-GUID: OXTfydTxz0CR-lxSkZdtOyM1gtw7WYYj X-Proofpoint-ORIG-GUID: OXTfydTxz0CR-lxSkZdtOyM1gtw7WYYj Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Add the ability to allow the secondary_trusted keyring to trust keys in the platform keyring. This is done by doing a key_link of the platform_trusted_keys to the secondary_trusted_keys. After they are linked, the platform_trusted_keys can be used for validation instead of the secondary_trusted_keys if the user chooses. This functionality will be used in a follow on patch. Signed-off-by: Eric Snowberg --- certs/system_keyring.c | 19 ++++++++++++++++++- include/keys/system_keyring.h | 10 ++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 4b693da488f1..471eb13e3cca 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -23,6 +23,7 @@ static struct key *secondary_trusted_keys; #endif #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING static struct key *platform_trusted_keys; +bool secondary_trusts_platform; #endif extern __initconst const u8 system_certificate_list[]; @@ -67,6 +68,10 @@ int restrict_link_by_builtin_and_secondary_trusted( /* Allow the builtin keyring to be added to the secondary */ return 0; + if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && secondary_trusts_platform) + return restrict_link_by_signature(dest_keyring, type, payload, + platform_trusted_keys); + return restrict_link_by_signature(dest_keyring, type, payload, secondary_trusted_keys); } @@ -227,7 +232,11 @@ int verify_pkcs7_message_sig(const void *data, size_t len, trusted_keys = builtin_trusted_keys; } else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) { #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING - trusted_keys = secondary_trusted_keys; + if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && + secondary_trusts_platform) + trusted_keys = platform_trusted_keys; + else + trusted_keys = secondary_trusted_keys; #else trusted_keys = builtin_trusted_keys; #endif @@ -312,4 +321,12 @@ void __init set_platform_trusted_keys(struct key *keyring) { platform_trusted_keys = keyring; } + +void __init set_trust_platform_keys(void) +{ + secondary_trusts_platform = true; + + if (key_link(platform_trusted_keys, secondary_trusted_keys) < 0) + panic("Can't link trusted keyrings\n"); +} #endif diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index fb8b07daa9d1..ffa5f0173ba8 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -72,4 +72,14 @@ static inline void set_platform_trusted_keys(struct key *keyring) } #endif +#if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \ + defined(CONFIG_SYSTEM_TRUSTED_KEYRING) && \ + defined(CONFIG_SECONDARY_TRUSTED_KEYRING) +extern void __init set_trust_platform_keys(void); +#else +static inline void __init set_trust_platform_keys(void) +{ +} +#endif + #endif /* _KEYS_SYSTEM_KEYRING_H */ From patchwork Mon May 17 22:57:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12263333 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85886C433B4 for ; Mon, 17 May 2021 22:58:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 444C16124C for ; Mon, 17 May 2021 22:58:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344166AbhEQXAB (ORCPT ); Mon, 17 May 2021 19:00:01 -0400 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:55622 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240090AbhEQW77 (ORCPT ); Mon, 17 May 2021 18:59:59 -0400 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 14HMqPh1019678; Mon, 17 May 2021 22:57:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=doW6z1eSes/D926NuQINs2SpAlpC4CXIsIYqzBBo8C8=; b=ej2QLREPtlV9hBMEtpoy3Ta1krLJDIJ70mkil2Ytrt5vxz2e9b/e4nqo/bw4XMf8AI7T jI0RSxqO3gkCg+HlsbDboHi4DW6d5nGEJ2dhspNOPeLTKxROmHimM6P/sfWvY1ai/nwK 0TCGvXqaor1Wj7oALM+bbcI4/wSVUkrkZKKkcwKd/Wyd2rmc+cen91glCaaVjLBTDsM6 lCfdFSLFJdTZNu0IDUs7ujlgIxuHsSc9NS+f3DdKjILAuOQhIgPbp1Em3aHEfOcZI0GR JAzjaJpp3v9uzNeJt0cAvXnmhchzLwuqYOmeEFJ5W2mnin2/OJ7O6ldS/3kqRWJwezoj ew== Received: from oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 38ker18dmn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 17 May 2021 22:57:54 +0000 Received: from userp3030.oracle.com (userp3030.oracle.com [127.0.0.1]) by pps.podrdrct (8.16.0.36/8.16.0.36) with SMTP id 14HMvpIe154682; Mon, 17 May 2021 22:57:52 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2174.outbound.protection.outlook.com [104.47.73.174]) by userp3030.oracle.com with ESMTP id 38j3dtss8w-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 17 May 2021 22:57:52 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=VYkBnMEMWGftKSAr4BoOd0UgWip88WqO+32F0lScXMWP08ZhNWJawEIj0RvMC35+ld88YISoC4AIske9z0dLjmcdZ9Ec1XU3aV/sZZgItLUdWfI1Inh9rB6BYC2HRF97M5OlYrgQ8/RVMCbxqGsfP5z5TGYeJJW3yCVprTK+cGJGsFCfQAT1c2ObfUbU0vrMsCqk7Q24w24GgthW2/dyeTR+zSCvSSuAr7P1sJM08tE/kz4flD7/eI3b2ZhdD5fBCMiRZIv1wkNaY3/zURvv+jGNPjeknDDRVQ9KY/xAJdy8wmE58PxPnNyiR1aNab994Yma00J/RHTfQZ/4JmA1Yg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=doW6z1eSes/D926NuQINs2SpAlpC4CXIsIYqzBBo8C8=; b=FoFPaTogXrDO3ai2812qQUsaQFQ79097cwtDlwLV3AdiQU0hDbD2W+8G03BhVLHq/CjxsMTt1Sy6NTyDH7xsJFcKvbp3TmmxjDYFTq+TGc7HIMej7liNcEc1zRl4Y0MM8hUKX7/6yuR5IGaEYYn42Mab3wfpNORbDZB9yw1SA9wzxbRwjRuzgj9ipG46ynwKrNV18nIQqZu7MjyblqSY1/PMf50K4nL8+w8jP1CswfjHkBNd4SYsGctTLG7wZGzDGxmMFvANzPi6X6Cp2uHmfjPd8KksKqJDiOb4qJwF9M95ycb22hDFfLwD4cnsCXAnj9/snekcnIOKPAUBz+9x1w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=doW6z1eSes/D926NuQINs2SpAlpC4CXIsIYqzBBo8C8=; b=m3gA5ogQX5oi3bNhbBfmtsu6DQ04K3O2JKOEuTRCIh2/XfUxeZJ/sdIlhQhgLIeLXA3HEqkIOqLNoEFq3uoRzApsnUJd9E99dfZiVh+RMrrYNS2kqnAMfKykKUqxdiPKU/c6HztbPmG0KR0IFlJ/wH+wkYeVmvAyzTUifznjLmM= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB4328.namprd10.prod.outlook.com (2603:10b6:610:7e::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4129.26; Mon, 17 May 2021 22:57:50 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::99fc:aabb:5cff:b177]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::99fc:aabb:5cff:b177%3]) with mapi id 15.20.4129.031; Mon, 17 May 2021 22:57:50 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, dmitry.kasatkin@gmail.com, eric.snowberg@oracle.com, jmorris@namei.org, jarkko@kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, zohar@linux.ibm.com, torvalds@linux-foundation.org, serge@hallyn.com, James.Bottomley@HansenPartnership.com, pjones@redhat.com, glin@suse.com Subject: [RFC PATCH 2/3] keys: Trust platform keyring if MokTrustPlatform found Date: Mon, 17 May 2021 18:57:13 -0400 Message-Id: <20210517225714.498032-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210517225714.498032-1-eric.snowberg@oracle.com> References: <20210517225714.498032-1-eric.snowberg@oracle.com> X-Originating-IP: [148.87.23.5] X-ClientProxiedBy: SN6PR16CA0059.namprd16.prod.outlook.com (2603:10b6:805:ca::36) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from localhost.us.oracle.com (148.87.23.5) by SN6PR16CA0059.namprd16.prod.outlook.com (2603:10b6:805:ca::36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4108.25 via Frontend Transport; Mon, 17 May 2021 22:57:49 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2d83b15b-6a8b-4d25-9c6a-08d919873242 X-MS-TrafficTypeDiagnostic: CH2PR10MB4328: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: j8Wozw6FjfQ8ByMOffeY7Rc68Lb/wVFgLB1VZ1mNxqh7ZuTmRyymLzK4j8eM5XJCbHLLGHDSkh1xUhUXjBoBjlLFKyR3b+/OdotuGkPwxPt3yXwhFpW4mAxuIaDFoJYr7P41j/phrq1FLTXFi5n9JfI6DXLfRuH6nldeKhHmPL0mNTxETJ90fv67Gcs/UYLB1hpcus6+5m0bKZ4IGaZt/TNa7+WboVV5OBcwdEWqS+CrHNX85CAe8TN5r6B5ctAn1/ndfNgsoajCZnDc59Mze1kRqQHDkUG5bsdK4sHFLmYrH52rhM1crmhQb8SzGrwUsrY8yG9UbMyTPKnS3twC8XVqYHi2AN/msttDSfXf+aB/E+vLy600ZhU2qulHjUsHhBkPgIteqSdpYl+Rsk1ic0b044Zf3zF4s8mm4Ho8HkExM3V8n69cJ1tj3CH4hZ4tbdfe+BNkXkyiC8T0xpoQs6txs4rIGuQHS/+n8OWqORTS1ckQoV2cVP6KeFRu4QCPhtV0pOGzer3pu2RKfIwUp3CSg8gwfqCPw1R/pKNxVTq2pLYMHGkXc+SuqACYgowJ1mA9Tcr+CnUAbx2QONpWDSgBIK0FaoNLYchsevXqLEObAbVdKG9Ob1lOX8S+96oi8IP0kQPAjGDzH8An0oaWpg== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(346002)(39860400002)(376002)(366004)(136003)(396003)(52116002)(7696005)(66476007)(5660300002)(66556008)(316002)(36756003)(66946007)(86362001)(6666004)(8936002)(6486002)(38100700002)(2906002)(44832011)(38350700002)(26005)(186003)(4326008)(83380400001)(8676002)(1076003)(956004)(7416002)(2616005)(16526019)(478600001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: TKGVnyZyCbjldzWBSI4DZr579a/H1BibVAoFe8a5ixLAPm5xCoZCSiAVLcztJS3O4dWcHBPuuYDxXVZ74nrJOJEEYb9EkxRofGBGEPF6bAzTYCH39EC9fbyUKtYhFOj8zONU5m+9IhcYpGLFyRjZgfCbXgxg3ZnNxhdAFZmavLsgmaSaoJkO5xSzdRp7eM/vudiK70riJkl1WcnikqGaIbOzwubgGwgnTCw1HBWwkkSq2WKPEKFY2F8shm9rXSgO2xyc6tHWkEFbxr6Ds+YXJUCvLl6z0O0e3cQG15bhx4Mb8dg9KuV3nWzt5Nk6cgqgyA2G3HI0O28rNdxlBTDpc2mD9cyvfYgsnZwsy8jWPMsLSPMIT/166aJOuDSPDpgTg+GNmAgruzaffXL1oHmeS6zsdCjLHdQByAyLZ6G1c/2H+r163nvFdy5f/Hh1EaVnifLKBx5wNA4EiAQWWhfLeOxfhtorVUsb2TYZwsODw+0ZHNI45hCfRXDB6fakafS218C0uKmIVTcMotyqH0THkStd8pb3MqdTS4FClQrF0UIWhpm9TvyY9iPUi7TZZ5fnJOylw0byDlUQZTit5tJf7Y/cngcMrGhfjTdNyChFaHwdU48oJ7RC/V7HBhaKof/eWannh/VrJ7pmAghZS3GA2nV5l2gyjhp9U0nLFTR+/05YseScSQOYd4HkALOM9PtlqRj2RudUhSWYm7wBWR/Wr8BxmsOz44VIuqq+MlZGNVsjyScTyJWCbOGa412R/lps3mIFeL1Gh+vQeRKMytsTDc3OwwHU9FNhOpWYLSGajMCdVjRpMOrFSTnTYsU+S45Vx6m8uLHMd8MvBqcH8bdcoT3RpJ5YEgik8tVk4UfdzdoPYCe3mc9yf8smf4+87EQKQN0zrRjfL9lMZOXtE8fVTvkUOJTWNDysrRus7MP17JoHwZZpsU3HXJ7ttFCRdc4mTpYL3mWz9Koow8d5MV5wY7bhIjoJfqEj0BYP2pLbSdkpY8zSjhLDd/vC5/y0zChtab6LUCdilGlR5HOumAPU1vffAu8Och1VJJeUQTnJeWAD92mFCMbPzefZGe1HTXBaE6VtvCv/VtrYZh9b3EQwG33PjJ5SezLlytPta+KrLkLuba6xfRjR4CmduwpGlR6JQrENcqcgZB0SXjy0iPc26KPbqfXQLb6SNd1iUan8yfX0ZVgvoHHeCyLhmlcCnpiMttQEo51XRsKPIbgi33fcG05QMIgWj6Ssi51HC/p/4OVmOEZxPfIw2kDjxf45TjuZG/e0bIWODAmgZw8omCj1kXilSYhKE73fJk1tpH79ryJlZtyIV/yiRM63dw7CT5lb X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2d83b15b-6a8b-4d25-9c6a-08d919873242 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 May 2021 22:57:50.5694 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gvDenO6OV8cf89xkR6s3PL2qDyza5X/DwXqFUce6X7ht09TQHk3hGcJcpF2RnqcEtZAQ/IQWmaNjniFq9JRLuRHldICJ111SB9A9uPFt2oU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4328 X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9987 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 spamscore=0 mlxlogscore=999 mlxscore=0 adultscore=0 malwarescore=0 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105170162 X-Proofpoint-GUID: C830sk42bVyOc7CsJ6Aa0ddVfl6CeMVJ X-Proofpoint-ORIG-GUID: C830sk42bVyOc7CsJ6Aa0ddVfl6CeMVJ Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org A new MOK variable called MokTrustPlatform has been introduced in shim. When this UEFI variable is set, it indicates the end-user has made the decision themself that they wish to trust both UEFI Secure Boot DB and MOK keys within the Linux trust boundary. It is not an error if this variable does not exist. If it does not exist, the platform keyring should not be trusted within the kernel. MOK variables are mirrored from Boot Services to Runtime Services. When shim sees the new MokTPKState BS variable, it will create a variable called MokTrustPlatform without EFI_VARIABLE_NON_VOLATILE set. Following Exit Boot Services, UEFI variables can only be set and created with SetVariable if both EFI_VARIABLE_RUNTIME_ACCESS & EFI_VARIABLE_NON_VOLATILE are set. Therefore, this can not be defeated by simply creating a MokTrustPlatform variable from Linux, since the existence of EFI_VARIABLE_NON_VOLATILE will cause uefi_check_trust_platform to return false. Signed-off-by: Eric Snowberg --- .../platform_certs/platform_keyring.c | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/security/integrity/platform_certs/platform_keyring.c b/security/integrity/platform_certs/platform_keyring.c index bcafd7387729..d2731182e511 100644 --- a/security/integrity/platform_certs/platform_keyring.c +++ b/security/integrity/platform_certs/platform_keyring.c @@ -13,6 +13,8 @@ #include #include #include "../integrity.h" +#include +#include /** * add_to_platform_keyring - Add to platform keyring without validation. @@ -37,6 +39,43 @@ void __init add_to_platform_keyring(const char *source, const void *data, pr_info("Error adding keys to platform keyring %s\n", source); } +/* + * Try to load the MokTrustPlatform UEFI variable to see if we should trust + * the platform keyring within the kernel. It is not an error if this variable + * does not exist. If it does not exist, the platform keyring should not + * be trusted within the kernel. + */ +static __init bool uefi_check_trust_platform(void) +{ + efi_status_t status; + unsigned int ptrust = 0; + unsigned long size = sizeof(ptrust); + efi_guid_t guid = EFI_SHIM_LOCK_GUID; + u32 attr; + + status = efi.get_variable(L"MokTrustPlatform", &guid, &attr, &size, &ptrust); + + /* + * The EFI_VARIABLE_NON_VOLATILE check is to verify MokTrustPlatform + * was set thru the shim mirrioring and not by a user from the host os. + * According to the UEFI spec, once EBS is performed, only variables + * that have EFI_VARIABLE_RUNTIME_ACCESS & EFI_VARIABLE_NON_VOLATILE + * set can be set with SetVariable(). + */ + return (status == EFI_SUCCESS && (!(attr & EFI_VARIABLE_NON_VOLATILE))); +} + +/* + * Check if the platform keyring should be trusted + */ +static __init void platform_keyring_trust_setup(void) +{ + if (uefi_check_trust_platform()) + set_trust_platform_keys(); +} + +late_initcall(platform_keyring_trust_setup); + /* * Create the trusted keyrings. */ From patchwork Mon May 17 22:57:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12263331 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30683C43600 for ; Mon, 17 May 2021 22:58:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0C3EB610A1 for ; Mon, 17 May 2021 22:58:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241845AbhEQW77 (ORCPT ); Mon, 17 May 2021 18:59:59 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:29136 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238861AbhEQW76 (ORCPT ); Mon, 17 May 2021 18:59:58 -0400 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 14HMqf3E028377; Mon, 17 May 2021 22:57:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=vnx3UOOHlYy+LzdQrU4wLxAgWLrhunJvAtQvwd7t+I8=; b=qwG6YwFRVGH8yFZXJ/9Gk/10DrdHpaOkk4BY1D+X7PXtSNpBnekgmWw032hlOprHvbrq Taywn3I7BldxVhzkywZHrGX8bd9xnd3a5sk6iED9O0lE9AhbDWN2fscdCNhz8rH4Dv/1 XFbvzrc+nccMZbm3dk5ctS2ReCxFs2huEgKN5SpARjZpW9/zdoweHG3MROhnJYhY+WRk 9AFnLBdg6FpQTyzfEpJJC4Vjz5UsKBPyE1xDutl4LRpJL3zU5u6Upe3XRjwrCpmSPjyN DexTbjDoKHzW8+Zuo+Y957sVi36hWknqOKaO+TDqhyQmC2GWoKpCw/uCffLpkRnOc/CF /A== Received: from oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 38kh0h8cr6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 17 May 2021 22:57:54 +0000 Received: from userp3030.oracle.com (userp3030.oracle.com [127.0.0.1]) by pps.podrdrct (8.16.0.36/8.16.0.36) with SMTP id 14HMvpIf154682; Mon, 17 May 2021 22:57:53 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2174.outbound.protection.outlook.com [104.47.73.174]) by userp3030.oracle.com with ESMTP id 38j3dtss8w-3 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 17 May 2021 22:57:53 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GL7K333eBjZIANq9wt+amm3PqcBFcy6a/9LXBOwIHmzMMaQPDlyokJvlMy25eJNhOK0snz7y2nkTt6ftgPVvxFMgFMLy4b7Jf+Kf5vTLm+0HDN3gVZ1EPM7iZSLzWYogUH97AmTf/4PaTN/fEyfoWnC496GjVcmlcm/ugiAOMLFkyGOteWo4HqAifcrSThlGS3BWOCWzIHIbZRlOsxb8y9ip7RMavP+8rZXRjACiiuRBPIfz79MW9WsXrw7GEYeWL4Okq6Ynd33l0/6mVurCzDQ2cnA0V/tWRHdlffOu278m/tfIkfyZ2KOUr9BwaTv3HYR4ym45vc3wEK50ACYcjA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vnx3UOOHlYy+LzdQrU4wLxAgWLrhunJvAtQvwd7t+I8=; b=Pki87/aErPT6BEraucjpGQh88sV5/e3YYg5rVMLKcg0oq3HPOWfGEvfd3gAqLilgAq/If36bPcpGgGuwz1wPKJKFxK6ICZ1AvLgJwsKNxm9VBYmO9BecPIi56zbTpcJ/JCVB17TSpmvTJf0BHRF3wILFUNCeg8zlGDugid3WUSoUeKFBBW6qRHCXP32qgnKgOC2b0EW3NQfThMYj0pLjrCKIENfRjxYQGoeXxbbBniiTe2YicYkOeF3s58CHM/+0Isy4bCqMkLXBtwgSGxUh4G3ad9D5dwl3tfBQkdKCYBWJRmRJt+RmksDtoEsIifirbQoCAIzVHxj8N09dpsvTuw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vnx3UOOHlYy+LzdQrU4wLxAgWLrhunJvAtQvwd7t+I8=; b=wpkqDWZO5FquEH1fWK4DYIl4dswR+/ogev5mWtIcw0+yf/wUNxklkDbWaTgwkFsNsqmE5WqY1DoAciHkhHRQaVlV/9GqTUsQD5QvZ+UlHCSpPtggi4v7R3YFjpE5S9EPHD8FYIOQi1bxVaevPsmeIjImOFGpZACsTzawkupeL8w= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB4328.namprd10.prod.outlook.com (2603:10b6:610:7e::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4129.26; Mon, 17 May 2021 22:57:52 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::99fc:aabb:5cff:b177]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::99fc:aabb:5cff:b177%3]) with mapi id 15.20.4129.031; Mon, 17 May 2021 22:57:52 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org Cc: dhowells@redhat.com, dwmw2@infradead.org, dmitry.kasatkin@gmail.com, eric.snowberg@oracle.com, jmorris@namei.org, jarkko@kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, zohar@linux.ibm.com, torvalds@linux-foundation.org, serge@hallyn.com, James.Bottomley@HansenPartnership.com, pjones@redhat.com, glin@suse.com Subject: [RFC PATCH 3/3] ima: Enable IMA SB Policy if MokIMAPolicy found Date: Mon, 17 May 2021 18:57:14 -0400 Message-Id: <20210517225714.498032-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210517225714.498032-1-eric.snowberg@oracle.com> References: <20210517225714.498032-1-eric.snowberg@oracle.com> X-Originating-IP: [148.87.23.5] X-ClientProxiedBy: SN6PR16CA0059.namprd16.prod.outlook.com (2603:10b6:805:ca::36) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from localhost.us.oracle.com (148.87.23.5) by SN6PR16CA0059.namprd16.prod.outlook.com (2603:10b6:805:ca::36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4108.25 via Frontend Transport; Mon, 17 May 2021 22:57:50 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f4bc3856-3fb5-4edf-3257-08d919873356 X-MS-TrafficTypeDiagnostic: CH2PR10MB4328: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: koi6xIxI2ACTkEO1oecclzCMibPFtKoimHUH5gyJEtoTf5oTyvxWtfMujl4sYkdVjpd6pczzIFJZ+du/ZdgBjxIZpAIK1NYIN5KU7Xq7Sla7fYA80OASeSlbAGfbkj41yIhguZQmKTjAJKywrJIDa2dC47hCGNNB7f/4T5ikJPePHu3SBOOjVH4PeJ3b+zaH/E8KOanhoZk0GvcuMQarItpfMhgv7Nx+8w5iDjrKnp9n+Q9FaeRzMEDq0zwi+FGk+RV00Ce/NN8+V7rkEqNU5Dab1IJ6NwdHCjE9KoxAvCzlE3mCeHjDQHiafG1G1dQWyEz1fjSsEVa2GZY492biI5Wa8XXOiUu7+6pRyCL+B2iOxs57id3B3lzNfXZf7YzgoYaNs5embrpGtLFoYcoyLJ6keFJPIetLz2IXXXApiIA8RjXyHsr3hiTdSRpIW0U9gC4U3EOA64L164lAKcW1Gz32M18TirihyblK+dZAsNntx3ESTEO35qyWyyRT2B0lZre4TZz5fSRPdhySchM4Ud7l8EQyuaADBjLEnfPqJSsFKgHLN7XQZ2hzCK5pD/veaoJQuET5QD/C1BcVTUHhlLyMbulbqmbSgMOjZ999odWG9uaqqwbhHncrF9Gt6c/1TvZL5FWAEECQxNP9gnunWju7RpISqiKqOZpSKBck2Nk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(346002)(39860400002)(376002)(366004)(136003)(396003)(52116002)(7696005)(66476007)(5660300002)(66556008)(316002)(36756003)(66946007)(86362001)(6666004)(8936002)(6486002)(38100700002)(2906002)(44832011)(38350700002)(26005)(186003)(4326008)(83380400001)(8676002)(1076003)(956004)(7416002)(2616005)(16526019)(478600001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: pEvPKj5rUQzdSC35A2u0GcJDj7KYuYtC8cEHS/tvd6TFhCVUXXQcA6tIXqMdzZ7LQStLv9kcqeUIizGGZVeNY0+8L9AM769gPNhqzbKrsfVszjE/N00Cxdvs4hFh6fPzUhuw8zuH2gxOB15limOkJTfHFizYSU1hCyPZqFlRjNi2yVkFGpk8LSZN4UKD6boZaAlii6dXDJzLuvQJRevie8H80yatmx/Mh2VAxu/FVbVM/f9POrEdVBx6NIGO+fvrvGhrKv+gFnTCaoPnpaY8YsSTsD7KzKzBj3iZy5x7x3AtN2UDxlITOvjo9SB9UUQzWaDVja3hvzmGsBtPl/LPKFUQfHy7P5rduBesIvzevsglrdriLKunsytfVjywmEGJV03ukuszaaEBmy53ClJTUlatTLdj6fWzuyPZzXyI1qB+DTbbbyjfmAKOn4p41GRVerrxyCou8irXGDnPrbzvcD02VvcBsbSxP5rFa/1nzHMOTqL7o04Q2pTFPuFW1EqMfQV2kJE+Rl8SKIt1CRAD/WvDEHHvx4uII7WbawCKbiMjD4SnUKD1VnDubtCuH+G53lWkxtc/WRwVUvmQSgUXKZiqeLMRulirGgDGoYN8R/xIypFWI2SqyulBYsXBxt2lEuZvNeVNfmkscdxuJ+iyUeBHqzZByF2dQv/xD8j7xXUG8XOs1UJmEOctPbnFaBr9OsICh4tby4UjMocItYGYg4lUqClgCkMMcTHfaLcwZYd7f7h50+TzwxrTeD14ExScTfbGfL6jT7gur4hjEEZSZyNxGjzAlQWEXwY5NqLL9p7821THZVb44r1JRi/tUTHTfR9NBf9T4doKYee4ADiEzXhcf8kFXo8+rh4jgM3etEMfUY5Ga5XUSwWAeL3MkB3WDitcok0ksI8tGa2qBkcnKrDv4Hl6RUC9A5qdMZRXlb1h5krSuIjc4RAZpnPvZvQm0dKngQOrXAbf097EOGPQtFshpWmEoA4CW9oKLzf0XWaMRuoLeuEbSooq6bZPH8AIoUqAZU0+YDwKPajVDvSdkIfCmomuZTI4hB87kJvKA8LhKMYKxR6eKYzgT57B+HEjgQpz5/CUpOQyIGAJ4QGMGMPW8P3eyhStZZQZxQwdegGbek9izSrGEWK5ywgKkkCPBHkmXOrfztK2u8cTyvezaT0XiDiwaAkQ4bZxlBiiFzIGt/hAqTTNVZ/YFinO7wYGaFEY1RUBNb0hpqwLIFcLLntj07mgOakgl14xIwj3DAL+l2HAD775ulXl6rcOhl/V2rGl91FHr+3R9pihdFFyPiKot/MTR2i+XtqWjYvDwFT3lCCubVAjLo6OKr1QJ4LD X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: f4bc3856-3fb5-4edf-3257-08d919873356 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 May 2021 22:57:52.4442 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: V2m0hTpUICCbm6qEcFM/N2Rlk4+yyqJZoPZMMZ002rq+L8kyP7sVWeGsATvTUwr86pDQUKfMQQ4dZoUozTkN3RjmP4B1tWNifDc7J5z8+U8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4328 X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9987 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 spamscore=0 mlxlogscore=999 mlxscore=0 adultscore=0 malwarescore=0 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105170162 X-Proofpoint-GUID: ytW35DfjSTaNPWkM807FsUGigHlePvoy X-Proofpoint-ORIG-GUID: ytW35DfjSTaNPWkM807FsUGigHlePvoy Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org A new MOK variable called MokIMAPolicy has been introduced in shim. When this UEFI variable is set, it indicates the end-user has made the decision that they wish to use the built-in kernel IMA architecture specific policy base on the run time secure boot flags. By default, this new MOK variable is not defined. This causes the IMA architecture specific secure boot policy to be disabled. Since this changes the current behavior, a new Kconfig option called IMA_UEFI_ARCH_POLICY has been added. Signed-off-by: Eric Snowberg --- security/integrity/ima/Kconfig | 8 ++++++++ security/integrity/ima/ima_efi.c | 24 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 12e9250c1bec..3773d2d1ddc4 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -172,6 +172,14 @@ config IMA_ARCH_POLICY This option enables loading an IMA architecture specific policy based on run time secure boot flags. +config IMA_UEFI_ARCH_POLICY + bool "Enable IMA archecture specific policy thru a UEFI variable" + depends on IMA_ARCH_POLICY + default n + help + This option allows the IMA archecture specific policy to be + enabled or disabled thru a UEFI variable setup thru the shim. + config IMA_APPRAISE_BUILD_POLICY bool "IMA build time configured policy rules" depends on IMA_APPRAISE && INTEGRITY_ASYMMETRIC_KEYS diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c index 71786d01946f..46873a94c934 100644 --- a/security/integrity/ima/ima_efi.c +++ b/security/integrity/ima/ima_efi.c @@ -62,8 +62,32 @@ static const char * const sb_arch_rules[] = { NULL }; +static __init int is_uefi_arch_policy_enabled(void) +{ + efi_status_t status; + unsigned int enabled = 0; + unsigned long size = sizeof(enabled); + efi_guid_t guid = EFI_SHIM_LOCK_GUID; + u32 attr; + + status = efi.get_variable(L"MokIMAPolicy", &guid, &attr, &size, &enabled); + + /* + * The EFI_VARIABLE_NON_VOLATILE check is to verify MokIMAPolicy + * was set thru the shim mirrioring and not by a user from the host os. + * According to the UEFI spec, once EBS is performed, only variables + * that have EFI_VARIABLE_RUNTIME_ACCESS & EFI_VARIABLE_NON_VOLATILE + * set can be set with SetVariable(). + */ + return (status == EFI_SUCCESS && (!(attr & EFI_VARIABLE_NON_VOLATILE))); +} + const char * const *arch_get_ima_policy(void) { + if (IS_ENABLED(CONFIG_IMA_UEFI_ARCH_POLICY)) + if (!is_uefi_arch_policy_enabled()) + return NULL; + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { if (IS_ENABLED(CONFIG_MODULE_SIG)) set_module_sig_enforced();