|
 |
ec226c2 |
From 096da19de900a115ee3610b666ecb7e55926623d Mon Sep 17 00:00:00 2001
|
|
 |
6a91557 |
From: Josh Boyer <jwboyer@fedoraproject.org>
|
|
|
6a91557 |
Date: Fri, 26 Oct 2012 12:36:24 -0400
|
|
|
ec226c2 |
Subject: [PATCH 6/9] KEYS: Add a system blacklist keyring
|
|
|
6a91557 |
|
|
|
6a91557 |
This adds an additional keyring that is used to store certificates that
|
|
|
6a91557 |
are blacklisted. This keyring is searched first when loading signed modules
|
|
|
6a91557 |
and if the module's certificate is found, it will refuse to load. This is
|
|
|
6a91557 |
useful in cases where third party certificates are used for module signing.
|
|
|
6a91557 |
|
|
|
6a91557 |
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
|
|
|
6a91557 |
---
|
|
|
ec226c2 |
certs/system_keyring.c | 22 ++++++++++++++++++++++
|
|
|
6a91557 |
include/keys/system_keyring.h | 4 ++++
|
|
|
6a91557 |
init/Kconfig | 9 +++++++++
|
|
|
ec226c2 |
3 files changed, 35 insertions(+)
|
|
|
6a91557 |
|
|
|
48f65f6 |
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
|
|
|
ec226c2 |
index 50979d6dcecd..787eeead2f57 100644
|
|
|
48f65f6 |
--- a/certs/system_keyring.c
|
|
|
48f65f6 |
+++ b/certs/system_keyring.c
|
|
|
ec226c2 |
@@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys;
|
|
|
ec226c2 |
#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
|
|
|
ec226c2 |
static struct key *secondary_trusted_keys;
|
|
|
ec226c2 |
#endif
|
|
|
6a91557 |
+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
|
|
|
6a91557 |
+struct key *system_blacklist_keyring;
|
|
|
6a91557 |
+#endif
|
|
|
6a91557 |
|
|
|
6a91557 |
extern __initconst const u8 system_certificate_list[];
|
|
|
6a91557 |
extern __initconst const unsigned long system_certificate_list_size;
|
|
|
ec226c2 |
@@ -99,6 +102,16 @@ static __init int system_trusted_keyring_init(void)
|
|
|
ec226c2 |
if (key_link(secondary_trusted_keys, builtin_trusted_keys) < 0)
|
|
|
ec226c2 |
panic("Can't link trusted keyrings\n");
|
|
|
ec226c2 |
#endif
|
|
|
ec226c2 |
+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
|
|
|
6a91557 |
+ system_blacklist_keyring = keyring_alloc(".system_blacklist_keyring",
|
|
|
ec226c2 |
+ KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
|
|
|
ec226c2 |
+ ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
|
|
|
ec226c2 |
+ KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
|
|
|
ec226c2 |
+ KEY_ALLOC_NOT_IN_QUOTA,
|
|
|
ec226c2 |
+ NULL, NULL);
|
|
|
6a91557 |
+ if (IS_ERR(system_blacklist_keyring))
|
|
|
6a91557 |
+ panic("Can't allocate system blacklist keyring\n");
|
|
|
6a91557 |
+#endif
|
|
|
ec226c2 |
|
|
|
6a91557 |
return 0;
|
|
|
6a91557 |
}
|
|
|
ec226c2 |
@@ -214,6 +227,15 @@ int verify_pkcs7_signature(const void *data, size_t len,
|
|
|
ec226c2 |
trusted_keys = builtin_trusted_keys;
|
|
|
ec226c2 |
#endif
|
|
|
ec226c2 |
}
|
|
|
48f65f6 |
+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
|
|
|
ec226c2 |
+ ret = pkcs7_validate_trust(pkcs7, system_blacklist_keyring);
|
|
|
48f65f6 |
+ if (!ret) {
|
|
|
48f65f6 |
+ /* module is signed with a cert in the blacklist. reject */
|
|
|
48f65f6 |
+ pr_err("Module key is in the blacklist\n");
|
|
|
48f65f6 |
+ ret = -EKEYREJECTED;
|
|
|
48f65f6 |
+ goto error;
|
|
|
48f65f6 |
+ }
|
|
|
48f65f6 |
+#endif
|
|
|
ec226c2 |
ret = pkcs7_validate_trust(pkcs7, trusted_keys);
|
|
|
ec226c2 |
if (ret < 0) {
|
|
|
ec226c2 |
if (ret == -ENOKEY)
|
|
|
48f65f6 |
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
|
|
|
ec226c2 |
index fbd4647767e9..5bc291a3d261 100644
|
|
|
48f65f6 |
--- a/include/keys/system_keyring.h
|
|
|
48f65f6 |
+++ b/include/keys/system_keyring.h
|
|
|
ec226c2 |
@@ -33,6 +33,10 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
|
|
|
ec226c2 |
#define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
|
|
|
48f65f6 |
#endif
|
|
|
48f65f6 |
|
|
|
48f65f6 |
+#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
|
|
|
48f65f6 |
+extern struct key *system_blacklist_keyring;
|
|
|
48f65f6 |
+#endif
|
|
|
48f65f6 |
+
|
|
|
ec226c2 |
#ifdef CONFIG_IMA_BLACKLIST_KEYRING
|
|
 |
168984b |
extern struct key *ima_blacklist_keyring;
|
|
|
ec226c2 |
|
|
|
48f65f6 |
diff --git a/init/Kconfig b/init/Kconfig
|
|
|
ec226c2 |
index a9c4aefd5436..e5449d5aeff9 100644
|
|
|
48f65f6 |
--- a/init/Kconfig
|
|
|
48f65f6 |
+++ b/init/Kconfig
|
|
|
ec226c2 |
@@ -1829,6 +1829,15 @@ config SYSTEM_DATA_VERIFICATION
|
|
|
48f65f6 |
module verification, kexec image verification and firmware blob
|
|
|
48f65f6 |
verification.
|
|
|
48f65f6 |
|
|
|
48f65f6 |
+config SYSTEM_BLACKLIST_KEYRING
|
|
|
48f65f6 |
+ bool "Provide system-wide ring of blacklisted keys"
|
|
|
48f65f6 |
+ depends on KEYS
|
|
|
48f65f6 |
+ help
|
|
|
48f65f6 |
+ Provide a system keyring to which blacklisted keys can be added.
|
|
|
48f65f6 |
+ Keys in the keyring are considered entirely untrusted. Keys in this
|
|
|
48f65f6 |
+ keyring are used by the module signature checking to reject loading
|
|
|
48f65f6 |
+ of modules signed with a blacklisted key.
|
|
|
48f65f6 |
+
|
|
|
48f65f6 |
config PROFILING
|
|
|
48f65f6 |
bool "Profiling support"
|
|
|
48f65f6 |
help
|
|
|
48f65f6 |
--
|
|
|
ec226c2 |
2.5.5
|
|
|
48f65f6 |
|