Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 31 Mar 2023 16:30:21 +0200
From:   Ahelenia =?utf-8?Q?Ziemia=C5=84ska?= 
        <nabijaczleweli@nabijaczleweli.xyz>
Cc:     Luis Chamberlain <mcgrof@kernel.org>,
        "open list:MODULE SUPPORT" <linux-modules@vger.kernel.org>,
        "open list:MODULE SUPPORT" <linux-kernel@vger.kernel.org>
Subject: [PATCH] KEYS: Make use of platform keyring for module signature
 verification
Message-ID: <qvgp2il2co4iyxkzxvcs4p2bpyilqsbfgcprtpfrsajwae2etc@3z2s2o52i3xg>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="ethhinddwvgbvcoy"
Content-Disposition: inline
User-Agent: NeoMutt/20230322
To:     unlisted-recipients:; (no To-header on input)
Precedence: bulk


--ethhinddwvgbvcoy
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

This allows a cert in DB to be used to sign modules,
in addition to certs in the MoK and built-in keyrings.

This key policy matches what's used for kexec.

Signed-off-by: Ahelenia Ziemia=C5=84ska <nabijaczleweli@nabijaczleweli.xyz>
---

Notes:
    Debian has carried an equivalent patch since 5.3.9-1:
      https://bugs.debian.org/935945
      https://bugs.debian.org/1030200
    in
      https://salsa.debian.org/kernel-team/linux/-/commit/0e65c8f3e316d6f0f=
c30f091dd47dba2ac616529
    and it appears the true origin is some version of
      https://gitlab.com/cki-project/kernel-ark/-/commit/b697ff5e26974fee8f=
cd31a1e221e9dd41515efc

 kernel/module/signing.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/kernel/module/signing.c b/kernel/module/signing.c
index a2ff4242e623..71d6248cf9ec 100644
--- a/kernel/module/signing.c
+++ b/kernel/module/signing.c
@@ -61,10 +61,16 @@ int mod_verify_sig(const void *mod, struct load_info *i=
nfo)
 	modlen -=3D sig_len + sizeof(ms);
 	info->len =3D modlen;
=20
-	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-				      VERIFY_USE_SECONDARY_KEYRING,
-				      VERIFYING_MODULE_SIGNATURE,
-				      NULL, NULL);
+	ret =3D verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+				     VERIFY_USE_SECONDARY_KEYRING,
+				     VERIFYING_MODULE_SIGNATURE,
+				     NULL, NULL);
+	if (ret =3D=3D -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
+		ret =3D verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+					     VERIFY_USE_PLATFORM_KEYRING,
+					     VERIFYING_MODULE_SIGNATURE,
+					     NULL, NULL);
+	return ret;
 }
=20
 int module_sig_check(struct load_info *info, int flags)
--=20
2.30.2

--ethhinddwvgbvcoy
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEfWlHToQCjFzAxEFjvP0LAY0mWPEFAmQm7nsACgkQvP0LAY0m
WPH7PxAAm7kjlMTNkXa7IuXBabuDCpGz7Bn5NTDpQlzhMQirVIK9yqnxMB4QKkTv
fz/N7zsuOrF2ikrk83d3d0siR+oeH8FjfRnfV0rItXLGndTTgoN0SjcYB0lMZfia
V40hSM+vWJ3Hqlza/KVr5+htvjnJLZh9DcNDGb/P1t71/31TH/9NZ8fn8XgxEgHD
5Pj0MCBum4ejEM1Pv13bfBauYn3hfQomD0qjDBwn3cEvFemdEZVyxvCgM8PO0lvp
8SHwIhOUyKCWiMRY2w36pjcawA33QD6rl8APqTAhj2PGJHOPywfz8iBMM05hSXdT
U40Ns0VYM1xSkJbQ7QEp2iWBM0DetqGeXs+Ttf6ANVwJpm4kZydY4rFNYMBkK9TG
AceDxM6iLIMFD2k435NOlIeRV+X3EmyIoyCmthNjQaxBK/Tp9j4eF118KiFpOmaM
M6Jc3O74yyxC7/8Oqn9Tk2/KePQDURxHt7lYFZDNJWcqPlLn3nXcpWENbmLnZi37
IbHCfOxie3avtNxC3xIHeGXaijEuD5DeI+DzwDfYL0nnfQv17qfIGR8miIwg5tjc
fV1+4tF6ZKNKRDA3/ahWnJCzwzPMJKTYRdqln1QQvVg4kRciypPG6emghc0JK2jz
2kQaGPk9m77rBK+RFcG6Xm7YiQsu6sniAlQ9xpPA0TKdTK7zhAw=
=0QOz
-----END PGP SIGNATURE-----

--ethhinddwvgbvcoy--