system_keyring.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* System trusted keyring for trusted public keys
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #include <linux/export.h>
  8. #include <linux/kernel.h>
  9. #include <linux/sched.h>
  10. #include <linux/cred.h>
  11. #include <linux/err.h>
  12. #include <linux/slab.h>
  13. #include <linux/verification.h>
  14. #include <keys/asymmetric-type.h>
  15. #include <keys/system_keyring.h>
  16. #include <crypto/pkcs7.h>
  17. #include "common.h"
  18. static struct key *builtin_trusted_keys;
  19. #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
  20. static struct key *secondary_trusted_keys;
  21. #endif
  22. #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
  23. static struct key *platform_trusted_keys;
  24. #endif
  25. extern __initconst const u8 system_certificate_list[];
  26. extern __initconst const unsigned long system_certificate_list_size;
  27. /**
  28. * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA
  29. *
  30. * Restrict the addition of keys into a keyring based on the key-to-be-added
  31. * being vouched for by a key in the built in system keyring.
  32. */
  33. int restrict_link_by_builtin_trusted(struct key *dest_keyring,
  34. const struct key_type *type,
  35. const union key_payload *payload,
  36. struct key *restriction_key)
  37. {
  38. return restrict_link_by_signature(dest_keyring, type, payload,
  39. builtin_trusted_keys);
  40. }
  41. #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
  42. /**
  43. * restrict_link_by_builtin_and_secondary_trusted - Restrict keyring
  44. * addition by both builtin and secondary keyrings
  45. *
  46. * Restrict the addition of keys into a keyring based on the key-to-be-added
  47. * being vouched for by a key in either the built-in or the secondary system
  48. * keyrings.
  49. */
  50. int restrict_link_by_builtin_and_secondary_trusted(
  51. struct key *dest_keyring,
  52. const struct key_type *type,
  53. const union key_payload *payload,
  54. struct key *restrict_key)
  55. {
  56. /* If we have a secondary trusted keyring, then that contains a link
  57. * through to the builtin keyring and the search will follow that link.
  58. */
  59. if (type == &key_type_keyring &&
  60. dest_keyring == secondary_trusted_keys &&
  61. payload == &builtin_trusted_keys->payload)
  62. /* Allow the builtin keyring to be added to the secondary */
  63. return 0;
  64. return restrict_link_by_signature(dest_keyring, type, payload,
  65. secondary_trusted_keys);
  66. }
  67. /**
  68. * Allocate a struct key_restriction for the "builtin and secondary trust"
  69. * keyring. Only for use in system_trusted_keyring_init().
  70. */
  71. static __init struct key_restriction *get_builtin_and_secondary_restriction(void)
  72. {
  73. struct key_restriction *restriction;
  74. restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
  75. if (!restriction)
  76. panic("Can't allocate secondary trusted keyring restriction\n");
  77. restriction->check = restrict_link_by_builtin_and_secondary_trusted;
  78. return restriction;
  79. }
  80. #endif
  81. /*
  82. * Create the trusted keyrings
  83. */
  84. static __init int system_trusted_keyring_init(void)
  85. {
  86. pr_notice("Initialise system trusted keyrings\n");
  87. builtin_trusted_keys =
  88. keyring_alloc(".builtin_trusted_keys",
  89. KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
  90. ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
  91. KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
  92. KEY_ALLOC_NOT_IN_QUOTA,
  93. NULL, NULL);
  94. if (IS_ERR(builtin_trusted_keys))
  95. panic("Can't allocate builtin trusted keyring\n");
  96. #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
  97. secondary_trusted_keys =
  98. keyring_alloc(".secondary_trusted_keys",
  99. KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
  100. ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
  101. KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH |
  102. KEY_USR_WRITE),
  103. KEY_ALLOC_NOT_IN_QUOTA,
  104. get_builtin_and_secondary_restriction(),
  105. NULL);
  106. if (IS_ERR(secondary_trusted_keys))
  107. panic("Can't allocate secondary trusted keyring\n");
  108. if (key_link(secondary_trusted_keys, builtin_trusted_keys) < 0)
  109. panic("Can't link trusted keyrings\n");
  110. #endif
  111. return 0;
  112. }
  113. /*
  114. * Must be initialised before we try and load the keys into the keyring.
  115. */
  116. device_initcall(system_trusted_keyring_init);
  117. /*
  118. * Load the compiled-in list of X.509 certificates.
  119. */
  120. static __init int load_system_certificate_list(void)
  121. {
  122. pr_notice("Loading compiled-in X.509 certificates\n");
  123. return load_certificate_list(system_certificate_list, system_certificate_list_size,
  124. builtin_trusted_keys);
  125. }
  126. late_initcall(load_system_certificate_list);
  127. #ifdef CONFIG_SYSTEM_DATA_VERIFICATION
  128. /**
  129. * verify_pkcs7_message_sig - Verify a PKCS#7-based signature on system data.
  130. * @data: The data to be verified (NULL if expecting internal data).
  131. * @len: Size of @data.
  132. * @pkcs7: The PKCS#7 message that is the signature.
  133. * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only,
  134. * (void *)1UL for all trusted keys).
  135. * @usage: The use to which the key is being put.
  136. * @view_content: Callback to gain access to content.
  137. * @ctx: Context for callback.
  138. */
  139. int verify_pkcs7_message_sig(const void *data, size_t len,
  140. struct pkcs7_message *pkcs7,
  141. struct key *trusted_keys,
  142. enum key_being_used_for usage,
  143. int (*view_content)(void *ctx,
  144. const void *data, size_t len,
  145. size_t asn1hdrlen),
  146. void *ctx)
  147. {
  148. int ret;
  149. /* The data should be detached - so we need to supply it. */
  150. if (data && pkcs7_supply_detached_data(pkcs7, data, len) < 0) {
  151. pr_err("PKCS#7 signature with non-detached data\n");
  152. ret = -EBADMSG;
  153. goto error;
  154. }
  155. ret = pkcs7_verify(pkcs7, usage);
  156. if (ret < 0)
  157. goto error;
  158. if (!trusted_keys) {
  159. trusted_keys = builtin_trusted_keys;
  160. } else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) {
  161. #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
  162. trusted_keys = secondary_trusted_keys;
  163. #else
  164. trusted_keys = builtin_trusted_keys;
  165. #endif
  166. } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
  167. #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
  168. trusted_keys = platform_trusted_keys;
  169. #else
  170. trusted_keys = NULL;
  171. #endif
  172. if (!trusted_keys) {
  173. ret = -ENOKEY;
  174. pr_devel("PKCS#7 platform keyring is not available\n");
  175. goto error;
  176. }
  177. ret = is_key_on_revocation_list(pkcs7);
  178. if (ret != -ENOKEY) {
  179. pr_devel("PKCS#7 platform key is on revocation list\n");
  180. goto error;
  181. }
  182. }
  183. ret = pkcs7_validate_trust(pkcs7, trusted_keys);
  184. if (ret < 0) {
  185. if (ret == -ENOKEY)
  186. pr_devel("PKCS#7 signature not signed with a trusted key\n");
  187. goto error;
  188. }
  189. if (view_content) {
  190. size_t asn1hdrlen;
  191. ret = pkcs7_get_content_data(pkcs7, &data, &len, &asn1hdrlen);
  192. if (ret < 0) {
  193. if (ret == -ENODATA)
  194. pr_devel("PKCS#7 message does not contain data\n");
  195. goto error;
  196. }
  197. ret = view_content(ctx, data, len, asn1hdrlen);
  198. }
  199. error:
  200. pr_devel("<==%s() = %d\n", __func__, ret);
  201. return ret;
  202. }
  203. /**
  204. * verify_pkcs7_signature - Verify a PKCS#7-based signature on system data.
  205. * @data: The data to be verified (NULL if expecting internal data).
  206. * @len: Size of @data.
  207. * @raw_pkcs7: The PKCS#7 message that is the signature.
  208. * @pkcs7_len: The size of @raw_pkcs7.
  209. * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only,
  210. * (void *)1UL for all trusted keys).
  211. * @usage: The use to which the key is being put.
  212. * @view_content: Callback to gain access to content.
  213. * @ctx: Context for callback.
  214. */
  215. int verify_pkcs7_signature(const void *data, size_t len,
  216. const void *raw_pkcs7, size_t pkcs7_len,
  217. struct key *trusted_keys,
  218. enum key_being_used_for usage,
  219. int (*view_content)(void *ctx,
  220. const void *data, size_t len,
  221. size_t asn1hdrlen),
  222. void *ctx)
  223. {
  224. struct pkcs7_message *pkcs7;
  225. int ret;
  226. pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len);
  227. if (IS_ERR(pkcs7))
  228. return PTR_ERR(pkcs7);
  229. ret = verify_pkcs7_message_sig(data, len, pkcs7, trusted_keys, usage,
  230. view_content, ctx);
  231. pkcs7_free_message(pkcs7);
  232. pr_devel("<==%s() = %d\n", __func__, ret);
  233. return ret;
  234. }
  235. EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
  236. #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
  237. #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
  238. void __init set_platform_trusted_keys(struct key *keyring)
  239. {
  240. platform_trusted_keys = keyring;
  241. }
  242. #endif