Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754684AbeAMVg1 (ORCPT + 1 other); Sat, 13 Jan 2018 16:36:27 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:39511 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754443AbeAMVgV (ORCPT ); Sat, 13 Jan 2018 16:36:21 -0500 X-Google-Smtp-Source: ACJfBov5gq3v3cTdNLJ+vqt59G0z4mfk+Twy1pEFGqRHUoVamXihvyDfzrDexPkuvFMp79cQmDEqLA== From: Dan Aloni To: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Cc: David Howells Subject: [PATCHv2 4/7] certs: allow in-kernel access of trusted keys Date: Sat, 13 Jan 2018 23:34:38 +0200 Message-Id: <20180113213441.52047-5-dan@kernelim.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180113213441.52047-1-dan@kernelim.com> References: <20180113213441.52047-1-dan@kernelim.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: CC: David Howells Signed-off-by: Dan Aloni --- certs/system_keyring.c | 56 ++++++++++++++++++++++++++++++++++++++++++- include/keys/system_keyring.h | 3 +++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 6251d1b27f0c..843a38b43fb1 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -131,6 +131,8 @@ static __init int system_trusted_keyring_init(void) */ device_initcall(system_trusted_keyring_init); +static char *first_asymmetric_key_description; + /* * Load the compiled-in list of X.509 certificates. */ @@ -172,8 +174,11 @@ static __init int load_system_certificate_list(void) pr_err("Problem loading in-kernel X.509 certificate (%ld)\n", PTR_ERR(key)); } else { + first_asymmetric_key_description = + kstrdup(key_ref_to_ptr(key)->description, + GFP_KERNEL); pr_notice("Loaded X.509 cert '%s'\n", - key_ref_to_ptr(key)->description); + first_asymmetric_key_description); key_ref_put(key); } p += plen; @@ -265,3 +270,52 @@ int verify_pkcs7_signature(const void *data, size_t len, EXPORT_SYMBOL_GPL(verify_pkcs7_signature); #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ + +/** + * get_first_asymmetric_key - Find a key by ID. + * @keyring: The keys to search. + * + * Return the first asymmetric key in a keyring. + */ +static struct key *get_first_asymmetric_key(struct key *keyring) +{ + key_ref_t ref; + + ref = keyring_search(make_key_ref(keyring, 1), + &key_type_asymmetric, + first_asymmetric_key_description); + if (IS_ERR(ref)) { + switch (PTR_ERR(ref)) { + case -EACCES: + case -ENOTDIR: + case -EAGAIN: + return ERR_PTR(-ENOKEY); + default: + return ERR_CAST(ref); + } + } + + return key_ref_to_ptr(ref); +} + +/** + * find_trusted_asymmetric_key - Find a key by ID in the builtin trusted + * keys keyring, or return the first key in that keyring. + * + * @id_0: The first ID to look for or NULL. + * @id_1: The second ID to look for or NULL. + * + * The preferred identifier is the id_0 and the fallback identifier is + * the id_1. If both are given, the lookup is by the former, but the + * latter must also match. If none are given, the first key is returned. + */ +struct key *find_trusted_asymmetric_key(const struct asymmetric_key_id *id_0, + const struct asymmetric_key_id *id_1) +{ + struct key *keyring = builtin_trusted_keys; + + if (!id_0 && !id_1) + return get_first_asymmetric_key(keyring); + + return find_asymmetric_key(keyring, id_0, id_1, false); +} diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 359c2f936004..0bef29eb8297 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -13,6 +13,7 @@ #define _KEYS_SYSTEM_KEYRING_H #include +#include #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING @@ -61,5 +62,7 @@ static inline struct key *get_ima_blacklist_keyring(void) } #endif /* CONFIG_IMA_BLACKLIST_KEYRING */ +struct key *find_trusted_asymmetric_key(const struct asymmetric_key_id *id_0, + const struct asymmetric_key_id *id_1); #endif /* _KEYS_SYSTEM_KEYRING_H */ -- 2.14.3