| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20230706144225.1046544-7-roberto.sassu@huaweicloud.com>
Date: Thu, 6 Jul 2023 16:42:19 +0200
From: Roberto Sassu <roberto.sassu@...weicloud.com>
To: dhowells@...hat.com, dwmw2@...radead.org,
herbert@...dor.apana.org.au, davem@...emloft.net,
jarkko@...nel.org, song@...nel.org, jolsa@...nel.org,
ast@...nel.org, daniel@...earbox.net, andrii@...nel.org,
martin.lau@...ux.dev, yhs@...com, john.fastabend@...il.com,
kpsingh@...nel.org, sdf@...gle.com, haoluo@...gle.com,
rostedt@...dmis.org, mhiramat@...nel.org, mykolal@...com,
shuah@...nel.org
Cc: linux-kernel@...r.kernel.org, keyrings@...r.kernel.org,
linux-crypto@...r.kernel.org, bpf@...r.kernel.org,
linux-trace-kernel@...r.kernel.org,
linux-kselftest@...r.kernel.org, pbrobinson@...il.com,
zbyszek@...waw.pl, zohar@...ux.ibm.com,
linux-integrity@...r.kernel.org, paul@...l-moore.com,
linux-security-module@...r.kernel.org, wiktor@...acode.biz,
devel@...ts.sequoia-pgp.org, gnupg-devel@...pg.org,
ebiggers@...nel.org, Jason@...c4.com, mail@...iej.szmigiero.name,
antony@...nard.ch, konstantin@...uxfoundation.org,
James.Bottomley@...senPartnership.com,
Roberto Sassu <roberto.sassu@...wei.com>
Subject: [RFC][PATCH 06/10] verification: Add verify_uasym_signature() and verify_uasym_sig_message()
From: Roberto Sassu <roberto.sassu@...wei.com>
Introduce verify_uasym_signature() and verify_uasym_sig_message(), to
verify user asymmetric key signatures from detached data. It aims to be
used by kernel subsystems wishing to verify the authenticity of system
data, with system-defined keyrings as trust anchor.
Signed-off-by: Roberto Sassu <roberto.sassu@...wei.com>
---
certs/system_keyring.c | 125 +++++++++++++++++++++++++++++++++++
include/linux/verification.h | 50 ++++++++++++++
2 files changed, 175 insertions(+)
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index a7a49b17ceb..dbee2e5b732 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -16,6 +16,7 @@
#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
#include <crypto/pkcs7.h>
+#include <crypto/uasym_keys_sigs.h>
static struct key *builtin_trusted_keys;
#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
@@ -339,6 +340,130 @@ int verify_pkcs7_signature(const void *data, size_t len,
}
EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
+#ifdef CONFIG_UASYM_KEYS_SIGS
+/**
+ * verify_uasym_sig_message - Verify a user asym key signature on system data
+ * @data: The data to be verified (must be provided)
+ * @len: Size of @data
+ * @uasym_sig: The signature context
+ * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only,
+ * (void *)1UL for all trusted keys)
+ * (void *)2UL for platform keys)
+ * @usage: The use to which the key is being put
+ * @view_content: Callback to gain access to content
+ * @ctx: Context for callback
+ *
+ * Verify the user asymmetric key signature of the supplied system data,
+ * against a key (if found) in the supplied trusted keyring.
+ *
+ * Return: Zero on successful verification, a negative value otherwise.
+ */
+int verify_uasym_sig_message(const void *data, size_t len,
+ struct uasym_sig_message *uasym_sig,
+ struct key *trusted_keys,
+ enum key_being_used_for usage,
+ int (*view_content)(void *ctx,
+ const void *data, size_t len,
+ size_t asn1hdrlen),
+ void *ctx)
+{
+ int ret;
+
+ /* The data should be detached - so we need to supply it. */
+ if (data && uasym_sig_supply_detached_data(uasym_sig, data, len)) {
+ pr_err("Failed to supply data for user asymmetric key signature\n");
+ ret = -EBADMSG;
+ goto error;
+ }
+
+ if (!trusted_keys) {
+ trusted_keys = builtin_trusted_keys;
+ } else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) {
+#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
+ trusted_keys = secondary_trusted_keys;
+#else
+ trusted_keys = builtin_trusted_keys;
+#endif
+ } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+ trusted_keys = platform_trusted_keys;
+#else
+ trusted_keys = NULL;
+#endif
+ if (!trusted_keys) {
+ ret = -ENOKEY;
+ pr_devel("Platform keyring is not available\n");
+ goto error;
+ }
+ }
+
+ ret = uasym_sig_verify_message(uasym_sig, trusted_keys);
+ if (ret < 0)
+ goto error;
+
+ if (view_content) {
+ size_t sig_data_len;
+
+ ret = uasym_sig_get_content_data(uasym_sig, &data, &len,
+ &sig_data_len);
+ if (ret < 0) {
+ if (ret == -ENODATA)
+ pr_devel("User asymmetric key signature does not contain data\n");
+ goto error;
+ }
+
+ ret = view_content(ctx, data, len, sig_data_len);
+ kfree(data);
+ }
+error:
+ pr_devel("<==%s() = %d\n", __func__, ret);
+ return ret;
+}
+EXPORT_SYMBOL_GPL(verify_uasym_sig_message);
+
+/**
+ * verify_uasym_signature - Verify a user asym key signature on system data
+ * @data: The data to be verified (must be provided)
+ * @len: Size of @data
+ * @raw_uasym_sig: The raw signature
+ * @raw_uasym_sig_len: The size of @raw_uasym_sig
+ * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only,
+ * (void *)1UL for all trusted keys)
+ * (void *)2UL for platform keys)
+ * @usage: The use to which the key is being put
+ * @view_content: Callback to gain access to content
+ * @ctx: Context for callback
+ *
+ * Verify the user asymmetric key signature of the supplied system data,
+ * against a key (if found) in the supplied trusted keyring.
+ *
+ * Return: Zero on successful verification, a negative value otherwise.
+ */
+int verify_uasym_signature(const void *data, size_t len,
+ const void *raw_uasym_sig, size_t raw_uasym_sig_len,
+ struct key *trusted_keys,
+ enum key_being_used_for usage,
+ int (*view_content)(void *ctx,
+ const void *data, size_t len,
+ size_t asn1hdrlen),
+ void *ctx)
+{
+ struct uasym_sig_message *uasym_sig;
+ int ret;
+
+ uasym_sig = uasym_sig_parse_message(raw_uasym_sig, raw_uasym_sig_len);
+ if (IS_ERR(uasym_sig))
+ return PTR_ERR(uasym_sig);
+
+ ret = verify_uasym_sig_message(data, len, uasym_sig, trusted_keys, usage,
+ view_content, ctx);
+
+ uasym_sig_free_message(uasym_sig);
+ pr_devel("<==%s() = %d\n", __func__, ret);
+ return ret;
+}
+EXPORT_SYMBOL_GPL(verify_uasym_signature);
+#endif /* CONFIG_UASYM_KEYS_SIGS */
#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
diff --git a/include/linux/verification.h b/include/linux/verification.h
index f34e50ebcf6..818f0ca4e12 100644
--- a/include/linux/verification.h
+++ b/include/linux/verification.h
@@ -43,6 +43,7 @@ extern const char *const key_being_used_for[NR__KEY_BEING_USED_FOR];
struct key;
struct pkcs7_message;
+struct uasym_sig_message;
extern int verify_pkcs7_signature(const void *data, size_t len,
const void *raw_pkcs7, size_t pkcs7_len,
@@ -62,6 +63,55 @@ extern int verify_pkcs7_message_sig(const void *data, size_t len,
size_t asn1hdrlen),
void *ctx);
+#ifdef CONFIG_UASYM_KEYS_SIGS
+extern int verify_uasym_sig_message(const void *data, size_t len,
+ struct uasym_sig_message *uasym_sig,
+ struct key *trusted_keys,
+ enum key_being_used_for usage,
+ int (*view_content)(void *ctx,
+ const void *data,
+ size_t len,
+ size_t asn1hdrlen),
+ void *ctx);
+extern int verify_uasym_signature(const void *data, size_t len,
+ const void *raw_uasym_sig,
+ size_t raw_uasym_sig_len,
+ struct key *trusted_keys,
+ enum key_being_used_for usage,
+ int (*view_content)(void *ctx,
+ const void *data,
+ size_t len,
+ size_t asn1hdrlen),
+ void *ctx);
+#else
+static inline int verify_uasym_sig_message(const void *data, size_t len,
+ struct uasym_sig_message *uasym_sig,
+ struct key *trusted_keys,
+ enum key_being_used_for usage,
+ int (*view_content)(void *ctx,
+ const void *data,
+ size_t len,
+ size_t asn1hdrlen),
+ void *ctx)
+{
+ return -EOPNOTSUPP;
+}
+
+static inline int verify_uasym_signature(const void *data, size_t len,
+ const void *raw_uasym_sig,
+ size_t raw_uasym_sig_len,
+ struct key *trusted_keys,
+ enum key_being_used_for usage,
+ int (*view_content)(void *ctx,
+ const void *data,
+ size_t len,
+ size_t asn1hdrlen),
+ void *ctx)
+{
+ return -EOPNOTSUPP;
+}
+#endif /* CONFIG_UASYM_KEYS_SIGS */
+
#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
extern int verify_pefile_signature(const void *pebuf, unsigned pelen,
struct key *trusted_keys,
--
2.34.1
Powered by blists - more mailing lists