David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 1 | /* System trusted keyring for trusted public keys |
| 2 | * |
| 3 | * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. |
| 4 | * Written by David Howells (dhowells@redhat.com) |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public Licence |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the Licence, or (at your option) any later version. |
| 10 | */ |
| 11 | |
| 12 | #include <linux/export.h> |
| 13 | #include <linux/kernel.h> |
| 14 | #include <linux/sched.h> |
| 15 | #include <linux/cred.h> |
| 16 | #include <linux/err.h> |
| 17 | #include <keys/asymmetric-type.h> |
| 18 | #include <keys/system_keyring.h> |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 19 | #include <crypto/pkcs7.h> |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 20 | |
David Howells | a511e1a | 2016-04-06 16:14:26 +0100 | [diff] [blame^] | 21 | static struct key *system_trusted_keyring; |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 22 | |
| 23 | extern __initconst const u8 system_certificate_list[]; |
Hendrik Brueckner | 6222698 | 2013-12-05 14:48:22 +0100 | [diff] [blame] | 24 | extern __initconst const unsigned long system_certificate_list_size; |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 25 | |
David Howells | a511e1a | 2016-04-06 16:14:26 +0100 | [diff] [blame^] | 26 | /** |
| 27 | * restrict_link_by_builtin_trusted - Restrict keyring addition by system CA |
| 28 | * |
| 29 | * Restrict the addition of keys into a keyring based on the key-to-be-added |
| 30 | * being vouched for by a key in the system keyring. |
| 31 | */ |
| 32 | int restrict_link_by_builtin_trusted(struct key *keyring, |
| 33 | const struct key_type *type, |
| 34 | unsigned long flags, |
| 35 | const union key_payload *payload) |
| 36 | { |
| 37 | return restrict_link_by_signature(system_trusted_keyring, |
| 38 | type, payload); |
| 39 | } |
| 40 | |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 41 | /* |
| 42 | * Load the compiled-in keys |
| 43 | */ |
| 44 | static __init int system_trusted_keyring_init(void) |
| 45 | { |
| 46 | pr_notice("Initialise system trusted keyring\n"); |
| 47 | |
| 48 | system_trusted_keyring = |
| 49 | keyring_alloc(".system_keyring", |
| 50 | KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), |
| 51 | ((KEY_POS_ALL & ~KEY_POS_SETATTR) | |
Mimi Zohar | af34cb0 | 2013-08-20 14:36:26 -0400 | [diff] [blame] | 52 | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH), |
David Howells | 5ac7eac | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 53 | KEY_ALLOC_NOT_IN_QUOTA, |
David Howells | a511e1a | 2016-04-06 16:14:26 +0100 | [diff] [blame^] | 54 | restrict_link_by_builtin_trusted, NULL); |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 55 | if (IS_ERR(system_trusted_keyring)) |
| 56 | panic("Can't allocate system trusted keyring\n"); |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 57 | return 0; |
| 58 | } |
| 59 | |
| 60 | /* |
| 61 | * Must be initialised before we try and load the keys into the keyring. |
| 62 | */ |
| 63 | device_initcall(system_trusted_keyring_init); |
| 64 | |
| 65 | /* |
| 66 | * Load the compiled-in list of X.509 certificates. |
| 67 | */ |
| 68 | static __init int load_system_certificate_list(void) |
| 69 | { |
| 70 | key_ref_t key; |
| 71 | const u8 *p, *end; |
| 72 | size_t plen; |
| 73 | |
| 74 | pr_notice("Loading compiled-in X.509 certificates\n"); |
| 75 | |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 76 | p = system_certificate_list; |
Hendrik Brueckner | 6222698 | 2013-12-05 14:48:22 +0100 | [diff] [blame] | 77 | end = p + system_certificate_list_size; |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 78 | while (p < end) { |
| 79 | /* Each cert begins with an ASN.1 SEQUENCE tag and must be more |
| 80 | * than 256 bytes in size. |
| 81 | */ |
| 82 | if (end - p < 4) |
| 83 | goto dodgy_cert; |
| 84 | if (p[0] != 0x30 && |
| 85 | p[1] != 0x82) |
| 86 | goto dodgy_cert; |
| 87 | plen = (p[2] << 8) | p[3]; |
| 88 | plen += 4; |
| 89 | if (plen > end - p) |
| 90 | goto dodgy_cert; |
| 91 | |
| 92 | key = key_create_or_update(make_key_ref(system_trusted_keyring, 1), |
| 93 | "asymmetric", |
| 94 | NULL, |
| 95 | p, |
| 96 | plen, |
Mimi Zohar | af34cb0 | 2013-08-20 14:36:26 -0400 | [diff] [blame] | 97 | ((KEY_POS_ALL & ~KEY_POS_SETATTR) | |
| 98 | KEY_USR_VIEW | KEY_USR_READ), |
David Howells | 008643b | 2013-08-30 16:07:37 +0100 | [diff] [blame] | 99 | KEY_ALLOC_NOT_IN_QUOTA | |
David Howells | 5d2787c | 2016-02-09 16:40:46 +0000 | [diff] [blame] | 100 | KEY_ALLOC_TRUSTED | |
David Howells | 5ac7eac | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 101 | KEY_ALLOC_BUILT_IN | |
| 102 | KEY_ALLOC_BYPASS_RESTRICTION); |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 103 | if (IS_ERR(key)) { |
| 104 | pr_err("Problem loading in-kernel X.509 certificate (%ld)\n", |
| 105 | PTR_ERR(key)); |
| 106 | } else { |
David Howells | b56e5a1 | 2013-08-30 16:07:30 +0100 | [diff] [blame] | 107 | pr_notice("Loaded X.509 cert '%s'\n", |
| 108 | key_ref_to_ptr(key)->description); |
| 109 | key_ref_put(key); |
| 110 | } |
| 111 | p += plen; |
| 112 | } |
| 113 | |
| 114 | return 0; |
| 115 | |
| 116 | dodgy_cert: |
| 117 | pr_err("Problem parsing in-kernel X.509 certificate list\n"); |
| 118 | return 0; |
| 119 | } |
| 120 | late_initcall(load_system_certificate_list); |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 121 | |
| 122 | #ifdef CONFIG_SYSTEM_DATA_VERIFICATION |
| 123 | |
| 124 | /** |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 125 | * verify_pkcs7_signature - Verify a PKCS#7-based signature on system data. |
| 126 | * @data: The data to be verified (NULL if expecting internal data). |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 127 | * @len: Size of @data. |
| 128 | * @raw_pkcs7: The PKCS#7 message that is the signature. |
| 129 | * @pkcs7_len: The size of @raw_pkcs7. |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 130 | * @trusted_keys: Trusted keys to use (NULL for system_trusted_keyring). |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 131 | * @usage: The use to which the key is being put. |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 132 | * @view_content: Callback to gain access to content. |
| 133 | * @ctx: Context for callback. |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 134 | */ |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 135 | int verify_pkcs7_signature(const void *data, size_t len, |
| 136 | const void *raw_pkcs7, size_t pkcs7_len, |
| 137 | struct key *trusted_keys, |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 138 | enum key_being_used_for usage, |
| 139 | int (*view_content)(void *ctx, |
| 140 | const void *data, size_t len, |
| 141 | size_t asn1hdrlen), |
| 142 | void *ctx) |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 143 | { |
| 144 | struct pkcs7_message *pkcs7; |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 145 | int ret; |
| 146 | |
| 147 | pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len); |
| 148 | if (IS_ERR(pkcs7)) |
| 149 | return PTR_ERR(pkcs7); |
| 150 | |
| 151 | /* The data should be detached - so we need to supply it. */ |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 152 | if (data && pkcs7_supply_detached_data(pkcs7, data, len) < 0) { |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 153 | pr_err("PKCS#7 signature with non-detached data\n"); |
| 154 | ret = -EBADMSG; |
| 155 | goto error; |
| 156 | } |
| 157 | |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 158 | ret = pkcs7_verify(pkcs7, usage); |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 159 | if (ret < 0) |
| 160 | goto error; |
| 161 | |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 162 | if (!trusted_keys) |
| 163 | trusted_keys = system_trusted_keyring; |
David Howells | bda850c | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 164 | ret = pkcs7_validate_trust(pkcs7, trusted_keys); |
| 165 | if (ret < 0) { |
| 166 | if (ret == -ENOKEY) |
| 167 | pr_err("PKCS#7 signature not signed with a trusted key\n"); |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 168 | goto error; |
| 169 | } |
| 170 | |
| 171 | if (view_content) { |
| 172 | size_t asn1hdrlen; |
| 173 | |
| 174 | ret = pkcs7_get_content_data(pkcs7, &data, &len, &asn1hdrlen); |
| 175 | if (ret < 0) { |
| 176 | if (ret == -ENODATA) |
| 177 | pr_devel("PKCS#7 message does not contain data\n"); |
| 178 | goto error; |
| 179 | } |
| 180 | |
| 181 | ret = view_content(ctx, data, len, asn1hdrlen); |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 182 | } |
| 183 | |
| 184 | error: |
| 185 | pkcs7_free_message(pkcs7); |
| 186 | pr_devel("<==%s() = %d\n", __func__, ret); |
| 187 | return ret; |
| 188 | } |
David Howells | e68503b | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 189 | EXPORT_SYMBOL_GPL(verify_pkcs7_signature); |
David Howells | 091f6e2 | 2015-07-20 21:16:28 +0100 | [diff] [blame] | 190 | |
| 191 | #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ |