Received: by 2002:a5b:505:0:0:0:0:0 with SMTP id o5csp5018703ybp; Mon, 7 Oct 2019 18:16:33 -0700 (PDT) X-Google-Smtp-Source: APXvYqwBRDPgKLHOQTKFen0ElYLjLq+UF57Mtntb5pfkZm5Un4RffCspzOSXTx0b5G+WU/zrAWBW X-Received: by 2002:a17:906:f0d5:: with SMTP id dk21mr26862957ejb.253.1570497393447; Mon, 07 Oct 2019 18:16:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1570497393; cv=none; d=google.com; s=arc-20160816; b=MiFx8Dvn51m/0dpHD2leBrX6GlkgMkVR4QndHeOZOMWr7Ejd3A/8HLocBgqOK5G6ck 8zoOI5MEUsMOTbV8+4lOnuB2j0CG8p7tZBLCXXz05n4oBbwIT9jFXbxTkzctgyebMMV1 L3ZkwgZtv+m+YR5KODV3kUzYkvF1GMMjqsTjY+sEKuX6ojuDrLcx2gMCaNTf9KWKfBaU h8NP+Hyb3QwqJuZw9C9e/HqEfkSdkKG8CDNE8c1tRtrvujQd/RZ6cR4ym/O4iMfnWfDY 5I2lS5n/YY95h9IgIrZ1IwtFX9v20qPXijr3piY2LbVEevVtV2kqI6l/KZNjMb0IMWIR WopQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:references:in-reply-to:date :subject:cc:to:from; bh=sQABVCf/Y2lfkJkUplMozoHyxcUA7MJcifw51xf+J00=; b=EMxC1kTW9UiPIRz8f5RTnET3ZcjYQZPo3oIyJiqr2w6fivSs6BUZHyGmRXPcJuS1gW CdSRZ8h+Yrjn3/nl9OhYY8o3qnnBlq0UgYihm05qz/Y8S4D/4pIXHO7UNLHqW0QElQaN jLwUG/xEvQJpzr9EBj3U06Yw1G0tTAFlLbhtoy/V+kDT4+uOV6jtLFe7C3BgVnwI9J78 CbJCq8TaVcZMpVusvoIysbdGnD6ja5TovBdselRuJIHUAtFwpXejIBEGNMIeJ0u1SXBJ Yzg5Ko2wcwncoGOnMh8FWnx2vlhjiKc0EUjY6vvrBUuuJMf2WAWLclkBhtZHbg+XqlfA EMqg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id w8si9145182edq.391.2019.10.07.18.16.10; Mon, 07 Oct 2019 18:16:33 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729753AbfJHBPQ (ORCPT + 99 others); Mon, 7 Oct 2019 21:15:16 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:47390 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729743AbfJHBPO (ORCPT ); Mon, 7 Oct 2019 21:15:14 -0400 Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x981BtxA144382 for ; Mon, 7 Oct 2019 21:15:13 -0400 Received: from e06smtp04.uk.ibm.com (e06smtp04.uk.ibm.com [195.75.94.100]) by mx0a-001b2d01.pphosted.com with ESMTP id 2vgd6pdqgh-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 07 Oct 2019 21:15:13 -0400 Received: from localhost by e06smtp04.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 8 Oct 2019 02:15:11 +0100 Received: from b06cxnps4074.portsmouth.uk.ibm.com (9.149.109.196) by e06smtp04.uk.ibm.com (192.168.101.134) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 8 Oct 2019 02:15:07 +0100 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id x981F5Od40370400 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 8 Oct 2019 01:15:05 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4A68011C054; Tue, 8 Oct 2019 01:15:05 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BE21511C04A; Tue, 8 Oct 2019 01:15:02 +0000 (GMT) Received: from swastik.ibm.com (unknown [9.80.231.8]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 8 Oct 2019 01:15:02 +0000 (GMT) From: Nayna Jain To: linuxppc-dev@ozlabs.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Michael Ellerman , Benjamin Herrenschmidt , Paul Mackerras , Ard Biesheuvel , Jeremy Kerr , Matthew Garret , Mimi Zohar , Greg Kroah-Hartman , Claudio Carvalho , George Wilson , Elaine Palmer , Eric Ricther , "Oliver O'Halloran" , Nayna Jain Subject: [PATCH v7 6/8] certs: add wrapper function to check blacklisted binary hash Date: Mon, 7 Oct 2019 21:14:25 -0400 X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1570497267-13672-1-git-send-email-nayna@linux.ibm.com> References: <1570497267-13672-1-git-send-email-nayna@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 19100801-0016-0000-0000-000002B4FEB3 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 19100801-0017-0000-0000-00003316186A Message-Id: <1570497267-13672-7-git-send-email-nayna@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-10-07_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=761 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1908290000 definitions=main-1910080011 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The existing is_hash_blacklisted() function returns -EKEYREJECTED error code for both the blacklisted keys and binaries. This patch adds a wrapper function is_binary_blacklisted() to check against binary hashes and returns -EPERM. Signed-off-by: Nayna Jain --- certs/blacklist.c | 9 +++++++++ include/keys/system_keyring.h | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/certs/blacklist.c b/certs/blacklist.c index ec00bf337eb6..6514f9ebc943 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -135,6 +135,15 @@ int is_hash_blacklisted(const u8 *hash, size_t hash_len, const char *type) } EXPORT_SYMBOL_GPL(is_hash_blacklisted); +int is_binary_blacklisted(const u8 *hash, size_t hash_len) +{ + if (is_hash_blacklisted(hash, hash_len, "bin") == -EKEYREJECTED) + return -EPERM; + + return 0; +} +EXPORT_SYMBOL_GPL(is_binary_blacklisted); + /* * Initialise the blacklist */ diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index c1a96fdf598b..fb8b07daa9d1 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -35,12 +35,18 @@ extern int restrict_link_by_builtin_and_secondary_trusted( extern int mark_hash_blacklisted(const char *hash); extern int is_hash_blacklisted(const u8 *hash, size_t hash_len, const char *type); +extern int is_binary_blacklisted(const u8 *hash, size_t hash_len); #else static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len, const char *type) { return 0; } + +static inline int is_binary_blacklisted(const u8 *hash, size_t hash_len) +{ + return 0; +} #endif #ifdef CONFIG_IMA_BLACKLIST_KEYRING -- 2.20.1