| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20221104113000.487098-6-coxu@redhat.com>
Date: Fri, 4 Nov 2022 19:30:00 +0800
From: Coiby Xu <coxu@...hat.com>
To: kexec@...ts.infradead.org
Cc: Milan Broz <gmazyland@...il.com>,
Thomas Staudt <tstaudt@...ibm.com>,
Kairui Song <ryncsn@...il.com>, dm-devel@...hat.com,
Jan Pazdziora <jpazdziora@...hat.com>,
Pingfan Liu <kernelfans@...il.com>,
Baoquan He <bhe@...hat.com>, Dave Young <dyoung@...hat.com>,
linux-kernel@...r.kernel.org, Vivek Goyal <vgoyal@...hat.com>
Subject: [RFC v2 5/5] crash_dump: retrieve LUKS volume key in kdump kernel
Crash kernel will retrieve the LUKS volume key based on the
luksvolumekey command line parameter. When libcryptsetup writes the key
description to /sys/kernel/crash_luks_volume_key, crash kernel will
create a thread keyring and add a logon key.
Signed-off-by: Coiby Xu <coxu@...hat.com>
---
include/linux/crash_dump.h | 2 +
kernel/crash_dump.c | 116 ++++++++++++++++++++++++++++++++++++-
2 files changed, 116 insertions(+), 2 deletions(-)
diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
index 0f3a656293b0..bc848e058c64 100644
--- a/include/linux/crash_dump.h
+++ b/include/linux/crash_dump.h
@@ -15,6 +15,8 @@
extern unsigned long long elfcorehdr_addr;
extern unsigned long long elfcorehdr_size;
+extern unsigned long long luks_volume_key_addr;
+
#ifdef CONFIG_CRASH_DUMP
extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size);
extern void elfcorehdr_free(unsigned long long addr);
diff --git a/kernel/crash_dump.c b/kernel/crash_dump.c
index 9c202bffbb8d..77a6b84415e8 100644
--- a/kernel/crash_dump.c
+++ b/kernel/crash_dump.c
@@ -5,7 +5,10 @@
#include <linux/errno.h>
#include <linux/export.h>
+#include <linux/key.h>
+#include <linux/keyctl.h>
#include <keys/user-type.h>
+
/*
* stores the physical address of elf header of crash image
*
@@ -16,6 +19,8 @@
unsigned long long elfcorehdr_addr = ELFCORE_ADDR_MAX;
EXPORT_SYMBOL_GPL(elfcorehdr_addr);
+unsigned long long luks_volume_key_addr;
+EXPORT_SYMBOL_GPL(luks_volume_key_addr);
/*
* stores the size of elf header of crash image
*/
@@ -41,6 +46,76 @@ static int __init setup_elfcorehdr(char *arg)
}
early_param("elfcorehdr", setup_elfcorehdr);
+static int __init setup_luksvolumekey(char *arg)
+{
+ char *end;
+
+ if (!arg)
+ return -EINVAL;
+ luks_volume_key_addr = memparse(arg, &end);
+ if (end > arg)
+ return 0;
+
+ luks_volume_key_addr = 0;
+ return -EINVAL;
+}
+
+early_param("luksvolumekey", setup_luksvolumekey);
+
+/*
+ * Architectures may override this function to read LUKS master key
+ */
+ssize_t __weak luks_key_read(char *buf, size_t count, u64 *ppos)
+{
+ struct kvec kvec = { .iov_base = buf, .iov_len = count };
+ struct iov_iter iter;
+
+ iov_iter_kvec(&iter, READ, &kvec, 1, count);
+ return read_from_oldmem(&iter, count, ppos, false);
+}
+
+static int retrive_kdump_luks_volume_key(u8 *buffer, unsigned int *sz)
+{
+ unsigned int key_size;
+ size_t lukskeybuf_sz;
+ unsigned int *size_ptr;
+ char *lukskeybuf;
+ u64 addr;
+ int r;
+
+ if (luks_volume_key_addr == 0) {
+ pr_debug("LUKS master key memory address inaccessible");
+ return -EINVAL;
+ }
+
+ addr = luks_volume_key_addr;
+
+ /* Read LUKS master key size */
+ r = luks_key_read((char *)&key_size, sizeof(unsigned int), &addr);
+
+ if (r < 0)
+ return r;
+
+ pr_debug("Retrieve LUKS master key: size=%u\n", key_size);
+ /* Read in LUKS maste rkey */
+ lukskeybuf_sz = sizeof(unsigned int) + key_size * sizeof(u8);
+ lukskeybuf = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+ get_order(lukskeybuf_sz));
+ if (!lukskeybuf)
+ return -ENOMEM;
+
+ addr = luks_volume_key_addr;
+ r = luks_key_read((char *)lukskeybuf, lukskeybuf_sz, &addr);
+
+ if (r < 0)
+ return r;
+ size_ptr = (unsigned int *)lukskeybuf;
+ memcpy(buffer, size_ptr + 1, key_size * sizeof(u8));
+ pr_debug("Retrieve LUKS master key (size=%u): %48ph...\n", key_size, buffer);
+ *sz = key_size;
+ return 0;
+}
+
static u8 *luks_volume_key;
static unsigned int luks_volume_key_size;
@@ -62,12 +137,48 @@ static DECLARE_DELAYED_WORK(wipe_luks_volume_key_work, _wipe_luks_volume_key);
static unsigned __read_mostly wipe_key_delay = 3600; /* 1 hour */
+static int retore_luks_volume_key_to_thread_keyring(const char *key_desc)
+{
+ key_ref_t keyring_ref, key_ref;
+ int ret;
+
+ /* find the target keyring (which must be writable) */
+ keyring_ref = lookup_user_key(KEY_SPEC_THREAD_KEYRING, 0x01, KEY_NEED_WRITE);
+ if (IS_ERR(keyring_ref)) {
+ pr_alert("Failed to get keyring");
+ return PTR_ERR(keyring_ref);
+ }
+
+ luks_volume_key = kmalloc(128, GFP_KERNEL);
+ ret = retrive_kdump_luks_volume_key(luks_volume_key, &luks_volume_key_size);
+ if (ret) {
+ kfree(luks_volume_key);
+ return ret;
+ }
+
+ /* create or update the requested key and add it to the target keyring */
+ key_ref = key_create_or_update(keyring_ref, "logon", key_desc,
+ luks_volume_key, luks_volume_key_size,
+ KEY_PERM_UNDEF, KEY_ALLOC_IN_QUOTA);
+
+ if (!IS_ERR(key_ref)) {
+ ret = key_ref_to_ptr(key_ref)->serial;
+ key_ref_put(key_ref);
+ pr_alert("Success adding key %s", key_desc);
+ } else {
+ ret = PTR_ERR(key_ref);
+ pr_alert("Error when adding key");
+ }
+
+ key_ref_put(keyring_ref);
+ return ret;
+}
+
static int crash_save_temp_luks_volume_key(const char *key_desc, size_t count)
{
const struct user_key_payload *ukp;
struct key *key;
-
if (luks_volume_key) {
memset(luks_volume_key, 0, luks_volume_key_size * sizeof(u8));
kfree(luks_volume_key);
@@ -100,7 +211,8 @@ int crash_sysfs_luks_volume_key_write(const char *key_desc, size_t count)
{
if (!is_kdump_kernel())
return crash_save_temp_luks_volume_key(key_desc, count);
- return -EINVAL;
+ else
+ return retore_luks_volume_key_to_thread_keyring(key_desc);
}
EXPORT_SYMBOL(crash_sysfs_luks_volume_key_write);
--
2.37.3
Powered by blists - more mailing lists