Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     jarkko@kernel.org, zohar@linux.ibm.com
Cc:     dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org,
        serge@hallyn.com, pvorel@suse.cz, noodles@fb.com, tiwai@suse.de,
        bp@suse.de, eric.snowberg@oracle.com, kanth.ghatraju@oracle.com,
        konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com,
        coxu@redhat.com, keyrings@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-integrity@vger.kernel.org,
        linux-security-module@vger.kernel.org
Subject: [PATCH v2 06/10] KEYS: Introduce keyring restriction that validates ca trust
Date:   Wed,  7 Dec 2022 12:12:34 -0500
Message-Id: <20221207171238.2945307-7-eric.snowberg@oracle.com>
In-Reply-To: <20221207171238.2945307-1-eric.snowberg@oracle.com>
References: <20221207171238.2945307-1-eric.snowberg@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?pz0GErKT956OzeJtuZhMwmREfGAjpfwYD3WlwLYjh94kqQmACA0cp88XhKbA?=
 =?us-ascii?Q?tPThGreVeZDatdIl8vpF2bXrxll1ZZplMjH9X5Alt3KZk2haGpt4w7USjXo/?=
 =?us-ascii?Q?NCKl/kMY2Rd69Y3G+2GhrCWEsb+2yoUZQvHjaJOVw9M+H2ABg6VEW3YqfrPO?=
 =?us-ascii?Q?sjFIo8WJmcmm7BeEqYfYKdd8B3M2z/3hpfRrndSW7ygGiQkDan7AFWTLV+78?=
 =?us-ascii?Q?4zYC8knAVf0voszIBQrjme1NE2Jyp3ON00np/AghjVVa4scCBM+BJD01Wxp4?=
 =?us-ascii?Q?g5zA7ZnkE789JfEMB2sQY9qbTSGMZ1jIVvyzI709DN6vx65VB0XTpfnkz3n2?=
 =?us-ascii?Q?eRdeNcgXtRFZWX+wofS+mxCbbkCk34RetH4TNRnrGQNvXM+x11UO3512QZOm?=
 =?us-ascii?Q?arxzcDYvUeYM839NUEh6Fw2exFEgqt96bbc5cynEGQ41xYRl40wNjCfEansP?=
 =?us-ascii?Q?oLDqMGqeAi8HV4rk9U8SwsX2pkY2tkWf8kssYhQajWKCy8vPr9J0PL8HH3R8?=
 =?us-ascii?Q?EmUshDN5ZGF2SOrrsAMzqVKa8gRgQTuNDFSxIi5j8ljFOdN3iakwLz+9sDvp?=
 =?us-ascii?Q?GCwAJ1xhzvsTrU1Ehh431Ms+p+J0mpOO8owhPH/HHNNWG8anLSGapkPrF6fk?=
 =?us-ascii?Q?/wgvy4pU4TPZHe2ix0mJF7hc5y5XGbhzVnFnEP4k9LFeLApnISjxUPJcV4LD?=
 =?us-ascii?Q?OEq1IzJDjA4d7IDFmACwu4Yq7/NgkoR2k20e8/8dZS22IxSyKec/C6xQH8RX?=
 =?us-ascii?Q?RJTM7Ldyss+2GZsjkonLcQf0ZPGfJ3V99ZD5KGepmTAIYXJJTzvVWcO1H9BE?=
 =?us-ascii?Q?2PoqIN4f+a4xFZnpky4ViiWn+mKLI8MxGNDw4RIxn0lKIRGezV5h8MvBw2oS?=
 =?us-ascii?Q?XyimKK+9/aysQFeeL8F21BeL5SBSo+p2/GxNkiKA/BX6V82h6ueRIxBVZ3oW?=
 =?us-ascii?Q?uZqNq2ZJ5Vl7VawdxHgh/g91W9U/Oq4UWZfcKrWtuau0gWFD5DpJsxdRBC3i?=
 =?us-ascii?Q?DT3Lcv7nDbRl85QpqI+I94XqUzQab1ZLPiNtd0B7Gjqw/7ha9alIxnR0wFOl?=
 =?us-ascii?Q?5INjtAgWNUjIJZSdBoKJt3PfvzNZKYsqEwiHJjDaHk5fY0PilLITYUr5U1mQ?=
 =?us-ascii?Q?bTG49LwHhCFYSTcwEeTpjZQns3Kn2AZ+DZ8cjOzts7vhjJ0NCgFqWSU2Xbyq?=
 =?us-ascii?Q?BbxIpqOMSvgo+qml6BRBvkwC3fSwELmtz5MNequsFltTmiAJXVKyjnsQylZz?=
 =?us-ascii?Q?wWzlq/xUYbX22RhITZKvDWqojdx4gx4pzZvf7O6YKkszn8N46xJD/EiiQ+cP?=
 =?us-ascii?Q?ktxc7KIen6wnf3ZFeD496gmZAIBmLPFA0T+/jxC44ryfjSYeeUsa5Cz9ln/I?=
 =?us-ascii?Q?pP3h4PUR56yQxAwIFpD4qFXtb1iaLvLkAL2pmS3942s+Bbnjf3cV7m57emUS?=
 =?us-ascii?Q?NIoDethK+CpPP16RQMdPmLchosPreDw+oCXDDACIdW9kEX7YXqHnYXWMoqyE?=
 =?us-ascii?Q?hBVFxlpWOwbm0qmYsLX+JYp83OFSMay9LyMY68yBJE4cHLBXXFWbGHMv7GHg?=
 =?us-ascii?Q?l/kNeRfmkD08hcmp2IfcZXXRgpZRAziZODAGhY0Z6fgCG8R7auFNge4V2Z+W?=
 =?us-ascii?Q?BmO/4iwAa6///J7EE031pFY=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a25617f4-0df0-47ee-4f9e-08dad87647a6
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Dec 2022 17:12:54.8042
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: f7j2tkmfMBWmmawmt1fq+bJ39DWVZzpnnODDgSz/dUWvJAx8z0BoZf7RLtv57h8hqvjBm5/yrfzKTHc2M/50Xbkq/6gOS5MAXT2+bXqHaqY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5293
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-12-07_08,2022-12-07_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0
 malwarescore=0 phishscore=0 mlxlogscore=999 spamscore=0 adultscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2210170000 definitions=main-2212070150
X-Proofpoint-ORIG-GUID: Tp1HIK1xCUcRWReEoYlU0sUCivubzGPo
X-Proofpoint-GUID: Tp1HIK1xCUcRWReEoYlU0sUCivubzGPo
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

The current keyring restrictions validate if a key can be vouched for by
another key already contained in a keyring.  Add a new restriction called
restrict_link_by_ca_and_signature that both vouches for the new key and
validates the vouching key is an endorsed certificate authority.

Two new system keyring restrictions are added to use
restrict_link_by_ca_and_signature.  The first restriction called
restrict_link_by_ca_builtin_trusted  uses the builtin_trusted_keys as
the restricted keyring.  The second system keyring restriction called
restrict_link_by_ca_builtin_and_secondary_trusted uses the
secondary_trusted_keys as the restricted keyring.  Should the machine
keyring be defined, it shall be validated too, since it is linked to
the secondary_trusted_keys keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
 certs/system_keyring.c            | 18 ++++++++++++++
 crypto/asymmetric_keys/restrict.c | 41 +++++++++++++++++++++++++++++++
 include/crypto/public_key.h       |  5 ++++
 include/keys/system_keyring.h     | 12 ++++++++-
 4 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 250148298690..af5094ce9bcb 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -51,6 +51,14 @@ int restrict_link_by_builtin_trusted(struct key *dest_keyring,
 					  builtin_trusted_keys);
 }
 
+int restrict_link_by_ca_builtin_trusted(struct key *dest_keyring,
+					 const struct key_type *type,
+					 const union key_payload *payload,
+					 struct key *unused)
+{
+	return restrict_link_by_ca_and_signature(dest_keyring, type, payload,
+						  builtin_trusted_keys);
+}
 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
 /**
  * restrict_link_by_builtin_and_secondary_trusted - Restrict keyring
@@ -83,6 +91,16 @@ int restrict_link_by_builtin_and_secondary_trusted(
 					  secondary_trusted_keys);
 }
 
+int restrict_link_by_ca_builtin_and_secondary_trusted(
+	struct key *dest_keyring,
+	const struct key_type *type,
+	const union key_payload *payload,
+	struct key *unused)
+{
+	return restrict_link_by_ca_and_signature(dest_keyring, type, payload,
+						  secondary_trusted_keys);
+}
+
 /*
  * Allocate a struct key_restriction for the "builtin and secondary trust"
  * keyring. Only for use in system_trusted_keyring_init().
diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
index 6b1ac5f5896a..005cb28969e4 100644
--- a/crypto/asymmetric_keys/restrict.c
+++ b/crypto/asymmetric_keys/restrict.c
@@ -108,6 +108,47 @@ int restrict_link_by_signature(struct key *dest_keyring,
 	return ret;
 }
 
+int restrict_link_by_ca_and_signature(struct key *dest_keyring,
+				       const struct key_type *type,
+				       const union key_payload *payload,
+				       struct key *trust_keyring)
+{
+	const struct public_key_signature *sig;
+	struct key *key;
+	int ret;
+
+	if (!trust_keyring)
+		return -ENOKEY;
+
+	if (type != &key_type_asymmetric)
+		return -EOPNOTSUPP;
+
+	sig = payload->data[asym_auth];
+	if (!sig)
+		return -ENOPKG;
+	if (!sig->auth_ids[0] && !sig->auth_ids[1] && !sig->auth_ids[2])
+		return -ENOKEY;
+
+	if (ca_keyid && !asymmetric_key_id_partial(sig->auth_ids[1], ca_keyid))
+		return -EPERM;
+
+	/* See if we have a key that signed this one. */
+	key = find_asymmetric_key(trust_keyring,
+				  sig->auth_ids[0], sig->auth_ids[1],
+				  sig->auth_ids[2], false);
+	if (IS_ERR(key))
+		return -ENOKEY;
+
+	if (!test_bit(KEY_FLAG_ECA, &key->flags))
+		ret = -ENOKEY;
+	else if (use_builtin_keys && !test_bit(KEY_FLAG_BUILTIN, &key->flags))
+		ret = -ENOKEY;
+	else
+		ret = verify_signature(key, sig);
+	key_put(key);
+	return ret;
+}
+
 static bool match_either_id(const struct asymmetric_key_id **pair,
 			    const struct asymmetric_key_id *single)
 {
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 6d61695e1cde..e51bbc5ffe17 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -71,6 +71,11 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring,
 						 const union key_payload *payload,
 						 struct key *trusted);
 
+extern int restrict_link_by_ca_and_signature(struct key *dest_keyring,
+					      const struct key_type *type,
+					      const union key_payload *payload,
+					      struct key *unused);
+
 extern int query_asymmetric_key(const struct kernel_pkey_params *,
 				struct kernel_pkey_query *);
 
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 91e080efb918..4e94bf72b998 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -24,9 +24,13 @@ extern int restrict_link_by_builtin_trusted(struct key *keyring,
 					    const union key_payload *payload,
 					    struct key *restriction_key);
 extern __init int load_module_cert(struct key *keyring);
-
+extern int restrict_link_by_ca_builtin_trusted(struct key *keyring,
+						const struct key_type *type,
+						const union key_payload *payload,
+						struct key *unused);
 #else
 #define restrict_link_by_builtin_trusted restrict_link_reject
+#define restrict_link_by_ca_builtin_trusted restrict_link_reject
 
 static inline __init int load_module_cert(struct key *keyring)
 {
@@ -41,8 +45,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
 	const struct key_type *type,
 	const union key_payload *payload,
 	struct key *restriction_key);
+extern int restrict_link_by_ca_builtin_and_secondary_trusted(
+	struct key *dest_keyring,
+	const struct key_type *type,
+	const union key_payload *payload,
+	struct key *restrict_key);
 #else
 #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
+#define restrict_link_by_ca_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
 #endif
 
 #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
-- 
2.27.0