lkml.org 
[lkml]   [2022]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 5/6] kexec, KEYS: make the code in bzImage64_verify_sig generic
    Date
    From: Coiby Xu <coxu@redhat.com>

    commit c903dae8941deb55043ee46ded29e84e97cd84bb upstream.

    commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
    signature verify") adds platform keyring support on x86 kexec but not
    arm64.

    The code in bzImage64_verify_sig uses the keys on the
    .builtin_trusted_keys, .machine, if configured and enabled,
    .secondary_trusted_keys, also if configured, and .platform keyrings
    to verify the signed kernel image as PE file.

    Cc: kexec@lists.infradead.org
    Cc: keyrings@vger.kernel.org
    Cc: linux-security-module@vger.kernel.org
    Reviewed-by: Michal Suchanek <msuchanek@suse.de>
    Signed-off-by: Coiby Xu <coxu@redhat.com>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
    include/linux/kexec.h | 7 +++++++
    kernel/kexec_file.c | 17 +++++++++++++++++
    3 files changed, 25 insertions(+), 19 deletions(-)

    --- a/arch/x86/kernel/kexec-bzimage64.c
    +++ b/arch/x86/kernel/kexec-bzimage64.c
    @@ -17,7 +17,6 @@
    #include <linux/kernel.h>
    #include <linux/mm.h>
    #include <linux/efi.h>
    -#include <linux/verification.h>

    #include <asm/bootparam.h>
    #include <asm/setup.h>
    @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loade
    return 0;
    }

    -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
    -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
    -{
    - int ret;
    -
    - ret = verify_pefile_signature(kernel, kernel_len,
    - VERIFY_USE_SECONDARY_KEYRING,
    - VERIFYING_KEXEC_PE_SIGNATURE);
    - if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
    - ret = verify_pefile_signature(kernel, kernel_len,
    - VERIFY_USE_PLATFORM_KEYRING,
    - VERIFYING_KEXEC_PE_SIGNATURE);
    - }
    - return ret;
    -}
    -#endif
    -
    const struct kexec_file_ops kexec_bzImage64_ops = {
    .probe = bzImage64_probe,
    .load = bzImage64_load,
    .cleanup = bzImage64_cleanup,
    #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
    - .verify_sig = bzImage64_verify_sig,
    + .verify_sig = kexec_kernel_verify_pe_sig,
    #endif
    };
    --- a/include/linux/kexec.h
    +++ b/include/linux/kexec.h
    @@ -19,6 +19,7 @@
    #include <asm/io.h>

    #include <uapi/linux/kexec.h>
    +#include <linux/verification.h>

    /* Location of a reserved region to hold the crash kernel.
    */
    @@ -212,6 +213,12 @@ static inline void *arch_kexec_kernel_im
    }
    #endif

    +#ifdef CONFIG_KEXEC_SIG
    +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
    +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len);
    +#endif
    +#endif
    +
    extern int kexec_add_buffer(struct kexec_buf *kbuf);
    int kexec_locate_mem_hole(struct kexec_buf *kbuf);

    --- a/kernel/kexec_file.c
    +++ b/kernel/kexec_file.c
    @@ -123,6 +123,23 @@ void kimage_file_post_load_cleanup(struc
    }

    #ifdef CONFIG_KEXEC_SIG
    +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
    +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
    +{
    + int ret;
    +
    + ret = verify_pefile_signature(kernel, kernel_len,
    + VERIFY_USE_SECONDARY_KEYRING,
    + VERIFYING_KEXEC_PE_SIGNATURE);
    + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
    + ret = verify_pefile_signature(kernel, kernel_len,
    + VERIFY_USE_PLATFORM_KEYRING,
    + VERIFYING_KEXEC_PE_SIGNATURE);
    + }
    + return ret;
    +}
    +#endif
    +
    static int kexec_image_verify_sig(struct kimage *image, void *buf,
    unsigned long buf_len)
    {

    \
     
     \ /
      Last update: 2022-08-19 17:41    [W:5.316 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site