linux-kernel - [PATCH v2 0/3] Add digitalSignature enforcement keyring restrictions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230522230944.180389-1-eric.snowberg@oracle.com>
Date:   Mon, 22 May 2023 19:09:41 -0400
From:   Eric Snowberg <eric.snowberg@...cle.com>
To:     jarkko@...nel.org, zohar@...ux.ibm.com, dhowells@...hat.com,
        dwmw2@...radead.org
Cc:     herbert@...dor.apana.org.au, davem@...emloft.net,
        dmitry.kasatkin@...il.com, paul@...l-moore.com, jmorris@...ei.org,
        serge@...lyn.com, jlee@...e.com, eric.snowberg@...cle.com,
        kanth.ghatraju@...cle.com, konrad.wilk@...cle.com,
        keyrings@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-crypto@...r.kernel.org, linux-integrity@...r.kernel.org,
        linux-security-module@...r.kernel.org
Subject: [PATCH v2 0/3] Add digitalSignature enforcement keyring restrictions

X.509 certificates may contain a key usage extension [1]. The key usage
extension defines the purpose of the certificate. One area of
interest is the digitalSignature. The digitalSignature usage is
typically used for code signing (integrity). 

Within the "Add CA enforcement key restrictions" [2] series, the
digitalSignature is being saved.  This series builds upon the previous
one and adds restrictions based on the digitalSignature usage.  

A new keyring restriction called restrict_link_by_digsig is added. The new
restriction only allows keys that contain digitalSignature usage within
it.

With this update, keys can be filtered based on digitalSignature. The
first two keyrings to use this restriction are the .ima and .evm
keyrings. Only keys containing a digitalSignature shall be allowed into
either keyring.

1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
2. https://lore.kernel.org/all/20230329220231.h6afgarrvdlwwdjc@kernel.org/T/

Changelog:
v2:
- No new code changes
- Added Reviewed-by and ACKs
- Updated code comments requested by Jarkko

Eric Snowberg (3):
  KEYS: DigitalSignature link restriction
  integrity: Enforce digitalSignature usage in the ima and evm keyrings
  integrity: Remove EXPERIMENTAL from Kconfig

 certs/system_keyring.c            | 50 +++++++++++++++++++++++++++++++
 crypto/asymmetric_keys/restrict.c | 44 +++++++++++++++++++++++++++
 include/crypto/public_key.h       | 11 +++++++
 include/keys/system_keyring.h     | 11 +++++++
 security/integrity/digsig.c       |  4 +--
 security/integrity/evm/Kconfig    |  3 +-
 security/integrity/ima/Kconfig    |  5 ++--
 7 files changed, 123 insertions(+), 5 deletions(-)

base-commit: 44c026a73be8038f03dbdeef028b642880cf1511
-- 
2.27.0