Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp6481661ybi; Wed, 31 Jul 2019 15:24:41 -0700 (PDT) X-Google-Smtp-Source: APXvYqz0wp8F2aGR4+vFMO86MWtRmct/coVm+uEVuodPXEPAZ1e7A6J1smsPSW2HznSVgZIP8F6B X-Received: by 2002:a63:b64:: with SMTP id a36mr106785247pgl.215.1564611880803; Wed, 31 Jul 2019 15:24:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564611880; cv=none; d=google.com; s=arc-20160816; b=AvytRhy8nukPskLjl2T6zTSIm4kfh8+c8fmt5jRwSTxScnuWqP7yUNaqI8WdOQoqWI HLxkGO5gK0/CIIKiKbxWRMy3kINdyFGQqVGcHwVMRa69LvN70k7k1fN6xEinqch+6YTN yHjn8O8apCHW9NnAaOXJaWaz7ppWsXeLBLSObwqi9qisUEwZoAV7i6A3mN1A2OIGVKL8 PDFvsqknn2u2lKrWaSm96SDL++ENzVjREQUfkWk/sqePPwx2JKmllayoWVlHy8WyxLCs t8hZzAynLU/vfZixERFGVowEktkEucAHtuF6ZICpbUFxq0pVfRahIKawtuSS3pHb+S8K FicQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:from:subject:references :mime-version:message-id:in-reply-to:date:dkim-signature; bh=0e260YowI9CRqgpWSZnFK5vaM3jseidaVbkh9lNaqp8=; b=aHnpoBAkxSeu8ZhClkwd8pVC9j+71DdvzTQaRcHKGf3P5bIg1pu5143e6gjeZTqOoe E0OtV0Ih84IaNu29rJ68+ED/jDzIUOZzjOi7gJWwHdeiQJhx9wbTnBcjWkMm1rfQmIV0 Tsm3qI9SoNxN3/lbesUrDfHraPYnfE0YZktrzX6tL+8oBaq33EYuiqN2broD0qNZxXbF 8ce1HjlLNRIyfBNYctCxLwN3KHMvQ2BVSEF3TveDbcepR1G3QCP4AjXUan4XmVYcYP+1 mCTsWptzeCig0T4U0Ycr+Q/JC6dhpVexDgI6V4dk2lZ7HZsTdXGyjP5pGVMb61THzAO0 CMUw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=T5C8KJDU; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s101si2312945pjc.5.2019.07.31.15.24.25; Wed, 31 Jul 2019 15:24:40 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=T5C8KJDU; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731228AbfGaWQt (ORCPT + 99 others); Wed, 31 Jul 2019 18:16:49 -0400 Received: from mail-qt1-f201.google.com ([209.85.160.201]:48143 "EHLO mail-qt1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731221AbfGaWQr (ORCPT ); Wed, 31 Jul 2019 18:16:47 -0400 Received: by mail-qt1-f201.google.com with SMTP id x7so62849168qtp.15 for ; Wed, 31 Jul 2019 15:16:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=0e260YowI9CRqgpWSZnFK5vaM3jseidaVbkh9lNaqp8=; b=T5C8KJDUx9azZLWdpz1dHN6vsdvRR0gZKEvl1PMRoFDAxYz1C/GdcPLsBTRtv5f+k7 0PZFkLysDpcsZI2GwWei196H24omcqyCGqeDCyNYwlo1EJ8smCGY+kcW0aN/eX2v+NSn BzbnuAGd88Ma2SyQpR2/aNBQqv+K5Y3eOwbDNfaBPe++D/TNGaCZgXS4gCmO7zaC3Sir G2vpIg9hxBRdq8Cf3Hs2DTze1dsoLwnyBDQo5NxYqLCuideJROAzDShG01EjjNIAl/Hi nvy/2m63KxhFJfEy7yherX07YMF/H6HXuHuDQx+K9SfbwUNYYDtzsEi4sdnyvlCPb6uR rvLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=0e260YowI9CRqgpWSZnFK5vaM3jseidaVbkh9lNaqp8=; b=o0qq2OuqoTQtdkjxmfIL976pvz++9dVJVq3vGv1vvswsJ2rfCp7hgSQ1c7uE7pLzr2 lZ1/I1H7Pds87W1gLrmI65c4e+mXTLzjVeMd7ZGlbV2rLQEaozvx7EtAhKLOXWxkLQFX kNxg6vB8RFIPKS6kkjlbh9EEqFUsxcvNe5IPKdWHTBMW3yeRaXc8pMcBIgQTI1T8Dpu1 xWsRnE1u7Xqh7Pnnh4aVnZrcY/jQsdCsv4hqHr66Q4WaNbYi73PajI7nQMlKYLRjLLsG VgBI42w3Tj2T6U0tDvZuOQWoNgB5+emhaqNHTyn/ZxofCUnWnkKOSFjf/7mO4gD4+QNb 21hw== X-Gm-Message-State: APjAAAVRp5+QreXVhglXCOCkGdxmN41mXceXFqvr8NnHQBqXwoV7Cvuh 46OFOx3cSQ6cljJ0zGDec/ZbLkBuj1CqlQ3tyNw4zw== X-Received: by 2002:a0c:8b49:: with SMTP id d9mr87945356qvc.178.1564611406707; Wed, 31 Jul 2019 15:16:46 -0700 (PDT) Date: Wed, 31 Jul 2019 15:15:56 -0700 In-Reply-To: <20190731221617.234725-1-matthewgarrett@google.com> Message-Id: <20190731221617.234725-9-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190731221617.234725-1-matthewgarrett@google.com> X-Mailer: git-send-email 2.22.0.770.g0f2c4a37fd-goog Subject: [PATCH V37 08/29] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE From: Matthew Garrett To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Jiri Bohac , David Howells , Matthew Garrett , Dave Young , kexec@lists.infradead.org Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jiri Bohac This is a preparatory patch for kexec_file_load() lockdown. A locked down kernel needs to prevent unsigned kernel images from being loaded with kexec_file_load(). Currently, the only way to force the signature verification is compiling with KEXEC_VERIFY_SIG. This prevents loading usigned images even when the kernel is not locked down at runtime. This patch splits KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE. Analogous to the MODULE_SIG and MODULE_SIG_FORCE for modules, KEXEC_SIG turns on the signature verification but allows unsigned images to be loaded. KEXEC_SIG_FORCE disallows images without a valid signature. Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac Reviewed-by: Dave Young cc: kexec@lists.infradead.org --- arch/x86/Kconfig | 20 +++++++++---- crypto/asymmetric_keys/verify_pefile.c | 4 ++- include/linux/kexec.h | 4 +-- kernel/kexec_file.c | 41 ++++++++++++++++++++++---- 4 files changed, 55 insertions(+), 14 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 05e78acb187c..fd2cd4f861cc 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2032,20 +2032,30 @@ config KEXEC_FILE config ARCH_HAS_KEXEC_PURGATORY def_bool KEXEC_FILE -config KEXEC_VERIFY_SIG +config KEXEC_SIG bool "Verify kernel signature during kexec_file_load() syscall" depends on KEXEC_FILE ---help--- - This option makes kernel signature verification mandatory for - the kexec_file_load() syscall. - In addition to that option, you need to enable signature + This option makes the kexec_file_load() syscall check for a valid + signature of the kernel image. The image can still be loaded without + a valid signature unless you also enable KEXEC_SIG_FORCE, though if + there's a signature that we can check, then it must be valid. + + In addition to this option, you need to enable signature verification for the corresponding kernel image type being loaded in order for this to work. +config KEXEC_SIG_FORCE + bool "Require a valid signature in kexec_file_load() syscall" + depends on KEXEC_SIG + ---help--- + This option makes kernel signature verification mandatory for + the kexec_file_load() syscall. + config KEXEC_BZIMAGE_VERIFY_SIG bool "Enable bzImage signature verification support" - depends on KEXEC_VERIFY_SIG + depends on KEXEC_SIG depends on SIGNED_PE_FILE_VERIFICATION select SYSTEM_TRUSTED_KEYRING ---help--- diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c index 3b303fe2f061..cc9dbcecaaca 100644 --- a/crypto/asymmetric_keys/verify_pefile.c +++ b/crypto/asymmetric_keys/verify_pefile.c @@ -96,7 +96,7 @@ static int pefile_parse_binary(const void *pebuf, unsigned int pelen, if (!ddir->certs.virtual_address || !ddir->certs.size) { pr_debug("Unsigned PE binary\n"); - return -EKEYREJECTED; + return -ENODATA; } chkaddr(ctx->header_size, ddir->certs.virtual_address, @@ -403,6 +403,8 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen, * (*) 0 if at least one signature chain intersects with the keys in the trust * keyring, or: * + * (*) -ENODATA if there is no signature present. + * * (*) -ENOPKG if a suitable crypto module couldn't be found for a check on a * chain. * diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 305f6a5ca4fe..998f77c3a0e1 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -125,7 +125,7 @@ typedef void *(kexec_load_t)(struct kimage *image, char *kernel_buf, unsigned long cmdline_len); typedef int (kexec_cleanup_t)(void *loader_data); -#ifdef CONFIG_KEXEC_VERIFY_SIG +#ifdef CONFIG_KEXEC_SIG typedef int (kexec_verify_sig_t)(const char *kernel_buf, unsigned long kernel_len); #endif @@ -134,7 +134,7 @@ struct kexec_file_ops { kexec_probe_t *probe; kexec_load_t *load; kexec_cleanup_t *cleanup; -#ifdef CONFIG_KEXEC_VERIFY_SIG +#ifdef CONFIG_KEXEC_SIG kexec_verify_sig_t *verify_sig; #endif }; diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index b8cc032d5620..875482c34154 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -88,7 +88,7 @@ int __weak arch_kimage_file_post_load_cleanup(struct kimage *image) return kexec_image_post_load_cleanup_default(image); } -#ifdef CONFIG_KEXEC_VERIFY_SIG +#ifdef CONFIG_KEXEC_SIG static int kexec_image_verify_sig_default(struct kimage *image, void *buf, unsigned long buf_len) { @@ -186,7 +186,8 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, const char __user *cmdline_ptr, unsigned long cmdline_len, unsigned flags) { - int ret = 0; + const char *reason; + int ret; void *ldata; loff_t size; @@ -202,14 +203,42 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, if (ret) goto out; -#ifdef CONFIG_KEXEC_VERIFY_SIG +#ifdef CONFIG_KEXEC_SIG ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf, image->kernel_buf_len); - if (ret) { - pr_debug("kernel signature verification failed.\n"); + switch (ret) { + case 0: + break; + + /* Certain verification errors are non-fatal if we're not + * checking errors, provided we aren't mandating that there + * must be a valid signature. + */ + case -ENODATA: + reason = "kexec of unsigned image"; + goto decide; + case -ENOPKG: + reason = "kexec of image with unsupported crypto"; + goto decide; + case -ENOKEY: + reason = "kexec of image with unavailable key"; + decide: + if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) { + pr_notice("%s rejected\n", reason); + goto out; + } + + ret = 0; + break; + + /* All other errors are fatal, including nomem, unparseable + * signatures and signature check failures - even if signatures + * aren't required. + */ + default: + pr_notice("kernel signature verification failed (%d).\n", ret); goto out; } - pr_debug("kernel signature verification successful.\n"); #endif /* It is possible that there no initramfs is being loaded */ if (!(flags & KEXEC_FILE_NO_INITRAMFS)) { -- 2.22.0.770.g0f2c4a37fd-goog