blob: 06554c448dce886d3bd7a01a745a78ab5fd734e8 [file] [log] [blame]
Dmitry Kasatkin8607c502011-10-05 11:54:46 +03001/*
2 * Copyright (C) 2011 Intel Corporation
3 *
4 * Author:
5 * Dmitry Kasatkin <dmitry.kasatkin@intel.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, version 2 of the License.
10 *
11 */
12
13#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15#include <linux/err.h>
Mimi Zohar7d2ce232013-08-13 08:47:43 -040016#include <linux/sched.h>
Dmitry Kasatkin65d543b2014-11-05 17:01:13 +020017#include <linux/slab.h>
Mimi Zohar7d2ce232013-08-13 08:47:43 -040018#include <linux/cred.h>
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030019#include <linux/key-type.h>
20#include <linux/digsig.h>
David Howellsa511e1a2016-04-06 16:14:26 +010021#include <crypto/public_key.h>
22#include <keys/system_keyring.h>
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030023
24#include "integrity.h"
25
26static struct key *keyring[INTEGRITY_KEYRING_MAX];
27
28static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +030029#ifndef CONFIG_INTEGRITY_TRUSTED_KEYRING
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030030 "_evm",
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030031 "_ima",
Mimi Zohar7d2ce232013-08-13 08:47:43 -040032#else
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +030033 ".evm",
Mimi Zohar7d2ce232013-08-13 08:47:43 -040034 ".ima",
35#endif
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +030036 "_module",
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030037};
38
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +030039#ifdef CONFIG_INTEGRITY_TRUSTED_KEYRING
40static bool init_keyring __initdata = true;
41#else
42static bool init_keyring __initdata;
43#endif
44
David Howells56104cf2016-04-07 09:45:23 +010045#ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
46#define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted
David Howellsa511e1a2016-04-06 16:14:26 +010047#else
David Howells56104cf2016-04-07 09:45:23 +010048#define restrict_link_to_ima restrict_link_by_builtin_trusted
David Howellsa511e1a2016-04-06 16:14:26 +010049#endif
50
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030051int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
Dmitry Kasatkin089bc8e2013-10-10 15:56:13 +090052 const char *digest, int digestlen)
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030053{
Seth Forsheeb4bfec72016-08-01 08:19:10 -050054 if (id >= INTEGRITY_KEYRING_MAX || siglen < 2)
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030055 return -EINVAL;
56
57 if (!keyring[id]) {
58 keyring[id] =
Linus Torvalds34ef7bd2013-11-23 16:36:35 -080059 request_key(&key_type_keyring, keyring_name[id], NULL);
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030060 if (IS_ERR(keyring[id])) {
61 int err = PTR_ERR(keyring[id]);
62 pr_err("no %s keyring: %d\n", keyring_name[id], err);
63 keyring[id] = NULL;
64 return err;
65 }
66 }
67
Dmitry Kasatkinb1aaab22013-10-10 16:12:03 +090068 switch (sig[1]) {
Dmitry Kasatkine0751252013-02-07 00:12:08 +020069 case 1:
Dmitry Kasatkinb1aaab22013-10-10 16:12:03 +090070 /* v1 API expect signature without xattr type */
71 return digsig_verify(keyring[id], sig + 1, siglen - 1,
Dmitry Kasatkine0751252013-02-07 00:12:08 +020072 digest, digestlen);
73 case 2:
74 return asymmetric_verify(keyring[id], sig, siglen,
75 digest, digestlen);
76 }
77
78 return -EOPNOTSUPP;
Dmitry Kasatkin8607c502011-10-05 11:54:46 +030079}
Mimi Zohar7d2ce232013-08-13 08:47:43 -040080
Dmitry Kasatkind16a8582014-10-01 21:43:07 +030081int __init integrity_init_keyring(const unsigned int id)
Mimi Zohar7d2ce232013-08-13 08:47:43 -040082{
83 const struct cred *cred = current_cred();
Mat Martineau2b6aa412016-08-31 16:05:43 -070084 struct key_restriction *restriction;
Mimi Zohar7d2ce232013-08-13 08:47:43 -040085 int err = 0;
86
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +030087 if (!init_keyring)
88 return 0;
89
Mat Martineau2b6aa412016-08-31 16:05:43 -070090 restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
91 if (!restriction)
92 return -ENOMEM;
93
94 restriction->check = restrict_link_to_ima;
95
Mimi Zohar7d2ce232013-08-13 08:47:43 -040096 keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),
97 KGIDT_INIT(0), cred,
98 ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
99 KEY_USR_VIEW | KEY_USR_READ |
100 KEY_USR_WRITE | KEY_USR_SEARCH),
David Howells5ac7eac2016-04-06 16:14:24 +0100101 KEY_ALLOC_NOT_IN_QUOTA,
Mat Martineau2b6aa412016-08-31 16:05:43 -0700102 restriction, NULL);
David Howells5ac7eac2016-04-06 16:14:24 +0100103 if (IS_ERR(keyring[id])) {
Mimi Zohar7d2ce232013-08-13 08:47:43 -0400104 err = PTR_ERR(keyring[id]);
105 pr_info("Can't allocate %s keyring (%d)\n",
106 keyring_name[id], err);
107 keyring[id] = NULL;
108 }
109 return err;
110}
Dmitry Kasatkin65d543b2014-11-05 17:01:13 +0200111
Dmitry Kasatkin9d03a722014-11-26 16:55:00 +0200112int __init integrity_load_x509(const unsigned int id, const char *path)
Dmitry Kasatkin65d543b2014-11-05 17:01:13 +0200113{
114 key_ref_t key;
115 char *data;
116 int rc;
117
118 if (!keyring[id])
119 return -EINVAL;
120
121 rc = integrity_read_file(path, &data);
122 if (rc < 0)
123 return rc;
124
125 key = key_create_or_update(make_key_ref(keyring[id], 1),
126 "asymmetric",
127 NULL,
128 data,
129 rc,
130 ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
131 KEY_USR_VIEW | KEY_USR_READ),
Dmitry Kasatkin72e1eed2015-09-10 22:06:15 +0300132 KEY_ALLOC_NOT_IN_QUOTA);
Dmitry Kasatkin65d543b2014-11-05 17:01:13 +0200133 if (IS_ERR(key)) {
134 rc = PTR_ERR(key);
135 pr_err("Problem loading X.509 certificate (%d): %s\n",
136 rc, path);
137 } else {
138 pr_notice("Loaded X.509 cert '%s': %s\n",
139 key_ref_to_ptr(key)->description, path);
140 key_ref_put(key);
141 }
142 kfree(data);
143 return 0;
144}