History

Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull integrity updates from Mimi Zohar: "The major feature in this time is IMA support for measuring and appraising appended file signatures. In addition are a couple of bug fixes and code cleanup to use struct_size(). In addition to the PE/COFF and IMA xattr signatures, the kexec kernel image may be signed with an appended signature, using the same scripts/sign-file tool that is used to sign kernel modules. Similarly, the initramfs may contain an appended signature. This contained a lot of refactoring of the existing appended signature verification code, so that IMA could retain the existing framework of calculating the file hash once, storing it in the IMA measurement list and extending the TPM, verifying the file's integrity based on a file hash or signature (eg. xattrs), and adding an audit record containing the file hash, all based on policy. (The IMA support for appended signatures patch set was posted and reviewed 11 times.) The support for appended signature paves the way for adding other signature verification methods, such as fs-verity, based on a single system-wide policy. The file hash used for verifying the signature and the signature, itself, can be included in the IMA measurement list" * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: ima_api: Use struct_size() in kzalloc() ima: use struct_size() in kzalloc() sefltest/ima: support appended signatures (modsig) ima: Fix use after free in ima_read_modsig() MODSIGN: make new include file self contained ima: fix freeing ongoing ahash_request ima: always return negative code for error ima: Store the measurement again when appraising a modsig ima: Define ima-modsig template ima: Collect modsig ima: Implement support for module-style appended signatures ima: Factor xattr_verify() out of ima_appraise_measurement() ima: Add modsig appraise_type option for module-style appended signatures integrity: Select CONFIG_KEYS instead of depending on it PKCS#7: Introduce pkcs7_get_digest() PKCS#7: Refactor verify_pkcs7_signature() MODSIGN: Export module signature definitions ima: initialize the "template" field with the default template

Linus Torvalds committed 7 years ago

Commit f1f2f612 parents 298fb76 2a7f0e532 files · +871 −203Browse files

Showing the changes to kernel (4 of 32 files). Show all

Unified · Split

4 files
  1. kernel/Makefile +1 −0
  2. kernel/module.c +1 −0
  3. kernel/module_signature.c +46 −0
  4. kernel/module_signing.c +8 −48
kernel/Makefile+1−0
@@ -58,6 +58,7 @@ endif · 57 unmodified lines
5858 obj-$(CONFIG_UID16) += uid16.o
5959 obj-$(CONFIG_MODULES) += module.o
6060 obj-$(CONFIG_MODULE_SIG) += module_signing.o
61+obj-$(CONFIG_MODULE_SIG_FORMAT) += module_signature.o
6162 obj-$(CONFIG_KALLSYMS) += kallsyms.o
6263 obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o
6364 obj-$(CONFIG_CRASH_CORE) += crash_core.o
kernel/module.c+1−0
@@ -7,6 +7,7 @@ · 6 unmodified lines
77 #include <linux/export.h>
88 #include <linux/extable.h>
99 #include <linux/moduleloader.h>
10+#include <linux/module_signature.h>
1011 #include <linux/trace_events.h>
1112 #include <linux/init.h>
1213 #include <linux/kallsyms.h>
kernel/module_signature.c+46−0
@@ -0,0 +1,46 @@
1+// SPDX-License-Identifier: GPL-2.0+
2+/*
3+ * Module signature checker
4+ *
5+ * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
6+ * Written by David Howells (dhowells@redhat.com)
7+ */
8+
9+#include <linux/errno.h>
10+#include <linux/printk.h>
11+#include <linux/module_signature.h>
12+#include <asm/byteorder.h>
13+
14+/**
15+ * mod_check_sig - check that the given signature is sane
16+ *
17+ * @ms: Signature to check.
18+ * @file_len: Size of the file to which @ms is appended.
19+ * @name: What is being checked. Used for error messages.
20+ */
21+int mod_check_sig(const struct module_signature *ms, size_t file_len,
22+ const char *name)
23+{
24+ if (be32_to_cpu(ms->sig_len) >= file_len - sizeof(*ms))
25+ return -EBADMSG;
26+
27+ if (ms->id_type != PKEY_ID_PKCS7) {
28+ pr_err("%s: Module is not signed with expected PKCS#7 message\n",
29+ name);
30+ return -ENOPKG;
31+ }
32+
33+ if (ms->algo != 0 ||
34+ ms->hash != 0 ||
35+ ms->signer_len != 0 ||
36+ ms->key_id_len != 0 ||
37+ ms->__pad[0] != 0 ||
38+ ms->__pad[1] != 0 ||
39+ ms->__pad[2] != 0) {
40+ pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n",
41+ name);
42+ return -EBADMSG;
43+ }
44+
45+ return 0;
46+}
kernel/module_signing.c+8−48
@@ -7,37 +7,13 @@ · 6 unmodified lines
77
88 #include <linux/kernel.h>
99 #include <linux/errno.h>
10+#include <linux/module.h>
11+#include <linux/module_signature.h>
1012 #include <linux/string.h>
1113 #include <linux/verification.h>
1214 #include <crypto/public_key.h>
1315 #include "module-internal.h"
1416
15−enum pkey_id_type {
16− PKEY_ID_PGP, /* OpenPGP generated key ID */
17− PKEY_ID_X509, /* X.509 arbitrary subjectKeyIdentifier */
18− PKEY_ID_PKCS7, /* Signature in PKCS#7 message */
19−};
20−
21−/*
22− * Module signature information block.
23− *
24− * The constituents of the signature section are, in order:
25− *
26− * - Signer's name
27− * - Key identifier
28− * - Signature data
29− * - Information block
30− */
31−struct module_signature {
32− u8 algo; /* Public-key crypto algorithm [0] */
33− u8 hash; /* Digest algorithm [0] */
34− u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */
35− u8 signer_len; /* Length of signer's name [0] */
36− u8 key_id_len; /* Length of key identifier [0] */
37− u8 __pad[3];
38− __be32 sig_len; /* Length of signature data */
39−};
40−
4117 /*
4218 * Verify the signature on a module.
4319 */
@@ -45,6 +21,7 @@ int mod_verify_sig(const void *mod, struct load_info *info) · 1 unmodified line
4521 {
4622 struct module_signature ms;
4723 size_t sig_len, modlen = info->len;
24+ int ret;
4825
4926 pr_devel("==>%s(,%zu)\n", __func__, modlen);
5027
@@ -52,32 +29,15 @@ int mod_verify_sig(const void *mod, struct load_info *info) · 1 unmodified line
5229 return -EBADMSG;
5330
5431 memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
55− modlen -= sizeof(ms);
32+
33+ ret = mod_check_sig(&ms, modlen, info->name);
34+ if (ret)
35+ return ret;
5636
5737 sig_len = be32_to_cpu(ms.sig_len);
58− if (sig_len >= modlen)
59− return -EBADMSG;
60− modlen -= sig_len;
38+ modlen -= sig_len + sizeof(ms);
6139 info->len = modlen;
6240
63− if (ms.id_type != PKEY_ID_PKCS7) {
64− pr_err("%s: Module is not signed with expected PKCS#7 message\n",
65− info->name);
66− return -ENOPKG;
67− }
68−
69− if (ms.algo != 0 ||
70− ms.hash != 0 ||
71− ms.signer_len != 0 ||
72− ms.key_id_len != 0 ||
73− ms.__pad[0] != 0 ||
74− ms.__pad[1] != 0 ||
75− ms.__pad[2] != 0) {
76− pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n",
77− info->name);
78− return -EBADMSG;
79− }
80−
8141 return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
8242 VERIFY_USE_SECONDARY_KEYRING,
8343 VERIFYING_MODULE_SIGNATURE,