Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        gregkh@linuxfoundation.org, torvalds@linux-foundation.org,
        scott.branden@broadcom.com, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v4 03/12] KEYS: CA link restriction
Date:   Wed, 18 Aug 2021 20:21:00 -0400
Message-Id: <20210819002109.534600-4-eric.snowberg@oracle.com>
In-Reply-To: <20210819002109.534600-1-eric.snowberg@oracle.com>
References: <20210819002109.534600-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from localhost.us.oracle.com (148.87.23.4) by SN4PR0401CA0025.namprd04.prod.outlook.com (2603:10b6:803:2a::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.19 via Frontend Transport; Thu, 19 Aug 2021 00:21:30 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: eff55540-42d5-43b5-dea1-08d962a74c7a
X-MS-TrafficTypeDiagnostic: CH0PR10MB5116:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <CH0PR10MB51169EFDE79873D0DD0BDF8B87C09@CH0PR10MB5116.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: fyJeiGRHMSe/t26gYEk8Z2OFZ2pIi4wD4Jyf1LyEtez01PVPrwnz6Q2eIrUTcCOcoPWgo10b4aVpMzEs9DK2+UdRklSjCVE5p2itAo9DKCoqt3wROUPEmQGPrZm0m1aa7jItG+NBTlNxhcGAzgJkavtyEERtz0Binm9cVOj15qyHycddbKof/zw2kaWekztmEiR6ydBOwjKDNLioW71SB9lHwEW7UlVxWWpo+G+Q75ts3Gsix0AXdF2sy8UGt9IQSCjpU0fNzLjxRi1EeI9oDGsLfBAkxweQo1U4oSoHAY7UnUSgJzJ5vWuY3RYwQ/U5QJk5eCqKf6CsZ0XqOA3NNvMpT3h6IPKYjd8/CaUim0k269lw/QChzMXjzhHSTrPKJJ1o/vDuuB4Km6xFk0GJcEwZ/ZHsoX6O6yFNVwpBSBhvSMfI+wTbvjdhaxzO/ARDqWF2RgNvqTveNxCHW1aNYfDCiNc5otdgMA79YFxKm3OPwr1iY07QPLlzE1vcanS4Gn9Pz/TWg0qsUEq5atvDmdmj0qb/3uG3Ndv6JA6Ntoedv0N24ED8VObMkQgKexggS3FIfrlD5IPU6com8mgogeeJpY51y2vtogwvWF/4BN5iqdueQOvj5/Ur94UnSDR2GmCv+njifbs1h+pfQUiNOCNqqV1DU9W1TibQRHMQ4Htzbhm/2hVC5We16gGzE7WX61WrI8qHUAAFp8gnU/F74TjrjgNzdtayOnoQB4Po1zI=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(136003)(346002)(39860400002)(366004)(396003)(376002)(5660300002)(478600001)(6666004)(6486002)(66556008)(66476007)(83380400001)(86362001)(316002)(956004)(2616005)(38350700002)(66946007)(186003)(107886003)(38100700002)(52116002)(44832011)(7696005)(2906002)(26005)(36756003)(7416002)(921005)(8676002)(4326008)(1076003)(8936002);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sDiKRRm6Nq9Ogk3fPM2g9bkxqJkX5r/k290dMfoZ4O2e6NE4fA5466VwDkod?=
 =?us-ascii?Q?ibhQf4y0Cxt1zalQXrwF7kXPHGiwO7abxHzY+qxZ8Sw323GGZXxdPSJvZyG4?=
 =?us-ascii?Q?wF+IXadd2loJdeeZpEqN/axKsGF027JtDSmZ5jGsE0+x7zZ4xQ8AI4hF0jsw?=
 =?us-ascii?Q?J9TcBZELaueJvbzYoy/M+B8S1yd6mOfLPvYYF1Jh+VGWn3fBE88kndNaDO4G?=
 =?us-ascii?Q?rvvctJydzcUFITgI1xRGPM80w93jjDMfp7GhaR8qJBn+LDXMg3r8qwMKhJwq?=
 =?us-ascii?Q?Rxxy0ZWd/IJwq7g9q/1J5k0n+YBO99n+OhbZ8SaAiWYXRIn7t6KHGB6Iz/E+?=
 =?us-ascii?Q?QEwS3DdQ2c3OfFTQKtbn5Gatqfm6FRD91Fa3Qm++8EN5VEjnQyd927RNmW6y?=
 =?us-ascii?Q?sGjXRMaBl5KeO5IhdhyQ+YsrQ4Z4AD+j6baluiAKuRQksI2Avvshn8By0O07?=
 =?us-ascii?Q?6B3wATe2al8F3qMO/I9fdE0fcAryuX1FmNiemKML1M+12aPp7BevdNbH48QO?=
 =?us-ascii?Q?IjG9tVcWmpQA0VDWu+kgFFYJE2wxx9ioZMgn5jd/BjzFEUi1x+byzX74qy6z?=
 =?us-ascii?Q?AXOUA+4rsE4D0hxqXUAskZCCdB5Tl735VoqirSvISCJjq4/KGh0230JP2bRQ?=
 =?us-ascii?Q?+TBdNFvvTO1Zv07mtC8nicrZv7HiY5jN1alBuHumArOx3F8UG5GmJupfnKX6?=
 =?us-ascii?Q?LTLdikpiKGnDh4iynhwFLIvmZRNVZNbthSdax4t+YGDt+CdNSbwmm8B+xjH5?=
 =?us-ascii?Q?c8Gb3yak3XjCHo6t9KAk7xiJSq2fYY8U60O01POJusxms50MsRD491zJq4pO?=
 =?us-ascii?Q?RWMk0WvSPCGxQOlQ9iKru9NP8P23dO/UImURsrkyca5rqcSbrH/qH1jefgD3?=
 =?us-ascii?Q?SKhtiK8iqOh0QPY7yFW274r/LMnpl644+MQM7W6DoX8rvwRcgCQv8h5TIYE2?=
 =?us-ascii?Q?LNOOypHdOiPo0qSMjTNXroupXWXVp68kJL/q4VIQrv/jBFbChkXGWLyRr9ZZ?=
 =?us-ascii?Q?LfSfgcJuFYPuwKa1XUwl5Axt+2lDXbWrkS9gBCOXx6v6rf2/TiQHCe8jfU0l?=
 =?us-ascii?Q?kFXvfiaRDJI/bGtLjXvK7Hu/ptWCOsMKYDzJTeWq5raYj51pnMQV9q+gLNyE?=
 =?us-ascii?Q?C8tce5cI9ng8Svi4F8X8Ao1v1HjWWZqkMM1ihobjZiMo6JHfaypI83QhojiV?=
 =?us-ascii?Q?Eu7D1o/r2XQI6mCtB3ayNjgYf4HR5+RHdhYCXbjGm1rbvO9iUw3GZHa5ke5L?=
 =?us-ascii?Q?/OqRgEn6KYUB9RUNyN/p/UR69O0zXjy8M76Ux2u4XlVwHIe8cybG95qVZjbU?=
 =?us-ascii?Q?g8pqGqQ9g+i730a86ZOmk2DX?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: eff55540-42d5-43b5-dea1-08d962a74c7a
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Aug 2021 00:21:33.3738
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 1ez+Ee/rX7gn/TsP9i3kcjLXrNqT9HlHrpXdxFegIlGrC8sNx4FBQH0GRPhFlOnaD7QdiEOJnmsAYdgwa5QH60pAJc+P8nvDrfA77Iij7kA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5116
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10080 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0 bulkscore=0
 suspectscore=0 mlxlogscore=999 phishscore=0 mlxscore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000
 definitions=main-2108190000
X-Proofpoint-ORIG-GUID: 8vGGVCdXrCPSKl19UNtRmkXPAAaBDCf_
X-Proofpoint-GUID: 8vGGVCdXrCPSKl19UNtRmkXPAAaBDCf_
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Add a new link restriction.  Restrict the addition of keys in a keyring
based on the key to be added being a CA (self-signed).

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v1: Initial version
v2: Removed secondary keyring references
v3: Removed restrict_link_by_system_trusted_or_ca
    Simplify restrict_link_by_ca - only see if the key is a CA
    Did not add __init in front of restrict_link_by_ca in case
      restriction could be resued in the future
v4: Unmodified from v3
---
 crypto/asymmetric_keys/restrict.c | 40 +++++++++++++++++++++++++++++++
 include/crypto/public_key.h       |  5 ++++
 2 files changed, 45 insertions(+)

diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
index 84cefe3b3585..9ae43d3f862b 100644
--- a/crypto/asymmetric_keys/restrict.c
+++ b/crypto/asymmetric_keys/restrict.c
@@ -108,6 +108,46 @@ int restrict_link_by_signature(struct key *dest_keyring,
 	return ret;
 }
 
+/**
+ * restrict_link_by_ca - Restrict additions to a ring of CA keys
+ * @dest_keyring: Keyring being linked to.
+ * @type: The type of key being added.
+ * @payload: The payload of the new key.
+ * @trusted: Unused.
+ *
+ * Check if the new certificate is a CA. If it is a CA, then mark the new
+ * certificate as being ok to link.
+ *
+ * Returns 0 if the new certificate was accepted, -ENOKEY if we could not find
+ * a matching parent certificate in the trusted list.  -ENOPKG if the signature
+ * uses unsupported crypto, or some other error if there is a matching
+ * certificate  but the signature check cannot be performed.
+ */
+int restrict_link_by_ca(struct key *dest_keyring,
+			const struct key_type *type,
+			const union key_payload *payload,
+			struct key *trust_keyring)
+{
+	const struct public_key_signature *sig;
+	const struct public_key *pkey;
+
+	if (type != &key_type_asymmetric)
+		return -EOPNOTSUPP;
+
+	sig = payload->data[asym_auth];
+	if (!sig)
+		return -ENOPKG;
+
+	if (!sig->auth_ids[0] && !sig->auth_ids[1])
+		return -ENOKEY;
+
+	pkey = payload->data[asym_crypto];
+	if (!pkey)
+		return -ENOPKG;
+
+	return public_key_verify_signature(pkey, sig);
+}
+
 static bool match_either_id(const struct asymmetric_key_ids *pair,
 			    const struct asymmetric_key_id *single)
 {
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 47accec68cb0..545af1ea57de 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -71,6 +71,11 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring,
 						 const union key_payload *payload,
 						 struct key *trusted);
 
+extern int restrict_link_by_ca(struct key *dest_keyring,
+			       const struct key_type *type,
+			       const union key_payload *payload,
+			       struct key *trust_keyring);
+
 extern int query_asymmetric_key(const struct kernel_pkey_params *,
 				struct kernel_pkey_query *);
 
-- 
2.18.4