Received-SPF: pass (google.com: domain of linux-crypto+bounces-2610-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Eric Snowberg <eric.snowberg@oracle.com>
To: linux-security-module@vger.kernel.org
Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au,
        davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org,
        paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com,
        zohar@linux.ibm.com, roberto.sassu@huawei.com,
        dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com,
        stefanb@linux.ibm.com, eric.snowberg@oracle.com,
        linux-kernel@vger.kernel.org, keyrings@vger.kernel.org,
        linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org,
        linux-integrity@vger.kernel.org
Subject: [PATCH RFC 6/8] keys: Add ability to track intended usage of the public key
Date: Mon, 11 Mar 2024 12:11:09 -0400
Message-Id: <20240311161111.3268190-7-eric.snowberg@oracle.com>
In-Reply-To: <20240311161111.3268190-1-eric.snowberg@oracle.com>
References: <20240311161111.3268190-1-eric.snowberg@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?ph3P5hCXQ2liPkTTaqGm3dwW9+2/XcnKHx0X4lzKmvPh56/eksJJAmEhFdjd?=
 =?us-ascii?Q?7pGG5dreavXZDG04xAYDcmiknGUk205H8qNUp9iPav3AT7wiIEc60o5VB/1v?=
 =?us-ascii?Q?metTPo7pPx5qHN4F9CCFtP1VEwX7JlXfev69/sL6Hst8f6Y+TWMjAtjyPutl?=
 =?us-ascii?Q?B9QI/3HTA9H3bXXOVYCzUAMcggYKDvSk85kbqPGFXTnhdWOeAf+2RBxk3Rj7?=
 =?us-ascii?Q?fhSVpQpNPjl36OADJuBVZTdPrL14wbkKsgkClNP0r1GIP1vyoVt/+N0fNXr0?=
 =?us-ascii?Q?O/6iBlz3dcWwZLjPDmGwJMmeolcTiTCPuJ8GV8mTYYYPfAp3TPn90GDCayV+?=
 =?us-ascii?Q?nA1wD3WuwHKorjhZAXpisgTqLBeHTePjEQtHA2vA95UgJvPUf4XhovvSiecV?=
 =?us-ascii?Q?k+YWjIYDoNASybths5Qq/2TtPhC2H+SxBLbRCCnguDvm3+l/HxzEQKCPH1Lj?=
 =?us-ascii?Q?508wX9VkGcz4yq4+UKroqp55v6YL9CyWW1lxSL2QLvIHWJpbmSbXdGjCrN7o?=
 =?us-ascii?Q?nnKvDaJXiHw7/1Kix9EbGL1ESQpeMkmmfUl9Ncyd/I3VscIGIH332ZBxFGS/?=
 =?us-ascii?Q?BCAhFLOPG/KHw2mC8tkAYKwrC4RQTuLKSkRJNlmYdKeT2fiDOgfN4jvNSGGW?=
 =?us-ascii?Q?szxkhNd7y38Cff14wPGdlwhjX9DK0jH+r07/EhOppyluOewGusWpSWOpoZqE?=
 =?us-ascii?Q?s7P+UNSBOnRxgS5+HVnqc98YeqoMKrTQQVd3/RKWH9+NFY+AC9z4AuCzKcMs?=
 =?us-ascii?Q?j8b4L5kTQkaWO66HzQ2pLvU9+EXZAMrgrfwZM0FrXvJ9QEQOLgs8VSrbfVSr?=
 =?us-ascii?Q?4Vpryux0M8cLTh8pcH18caS0ZX029EoJTWJ7l2q5nPfxJ1cYdzadVU2mHQnk?=
 =?us-ascii?Q?YycoaJKC2B8A3TPPxb3HiXmCr1tRhSRQ33ngLOWcM/TDcxeqDCElI2WFgYgp?=
 =?us-ascii?Q?fFhpEm38vKhG6qVunzqP7ot7t7O0LQH521pGSJNOh2QIp4ZOzSh+DVwwgLVa?=
 =?us-ascii?Q?TMJkjNx4uukUZ97Md9eV5tUYREcIQ8Lqyka90oblMzyeHlR07wfYLJw0AdCY?=
 =?us-ascii?Q?MyjUmvDO7KrxuplEqgAcYZeouNdSh4JywrS/RNFUcxI3pp3pcFsXnzhdvQO8?=
 =?us-ascii?Q?LIyK3Tb5WKwFCdtj8/sxbmBAhLbZSk3O25hyImHFDV35jwA+OurqloS0wqhS?=
 =?us-ascii?Q?mnOwCbxUallb6cDBPZN8Ea5TdPqIwer8AQIOL7adnCluICrs2kNNQQFJMmhr?=
 =?us-ascii?Q?1kwHTElRN+bpIf6cNaIHldYdFrERm9qLEFiVchJZ7dPPJ8VZQo1ouC4lj/de?=
 =?us-ascii?Q?ys2TbfUmHUHOSBnE940uXS+e77SN7vyj6i687HvdP/fnfl1wDDcn1+CBaSJ2?=
 =?us-ascii?Q?Tf22Aib2Rz3pqzm7SXPYEG1N6h8EFjCuH0nk3FAi1K20L8hgCxc8AQtqiQIY?=
 =?us-ascii?Q?KkA6begpzHqkRTwdsLmC5/4rAy05vQ7P9FuNe212vN8SEMZlFIWuiYskdBWw?=
 =?us-ascii?Q?AtFKjTL6rgOqb2cjn5Y/AXLZWrtyev+pIVzPSeXiCg56GyogUPHos49iPbZh?=
 =?us-ascii?Q?HxGbgyyUphvntiomHTQaZm6JSfk9yQiZAchefILT//Cyruwt4nS81CLvdSeJ?=
 =?us-ascii?Q?6tPehWtpOsT6zBYYhoxnEC8=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	C1ongw3z/d5O8w3EF5ul18Wg39gaOoBNkhFwl3VlVohchSRz3iCNovH/x2VBV1WOutGTl2TF24f4hFuMFtx7XtGCym8RXrKjB4R0vvtuwIzi404/xd9vKZB+lIogLGDe8OEcZ7QKWSMeoKkGUZd5RKfXysB8t72vsihiFRMzQCcuIRp9yEvMUVE5vwMCRNRdDO0GkJQGCSj2P5XFTusut93qU+nOv69jRTdYpLjGQDq4HBP2ue50yDWZsC3uYgfzJ5OcA9sOuf5xqhnvMSOXrNypZ5WWQils5Qg3Sdcu5pYqU043sAzUqm/1iLC2hdYkdw2krhAXrrlDF+ND5k0BVW6qIu/LY6m6Hb0yDamFc1hMAPcZCs3BnwEyI0YtkANAIgeIw8Yiu2cMSKkZAlGV9WUOzNpo5bNtkFTubCZAbVi6tE78bT1Ef4OXPqrNA7mxjYtS3e5TuyfmNeUqUGUFXtb5XieKwRHi3+acl8pRpiY5LwvdJ1MNPvQTTn+T28fZtwe/6qurSR0G3L7fK2VB7Dpo0d7ReRcwnhoSvHxrLmGsPBjtcylodx8GgPVqLxRXbnNJIN/tXdc1k+XAXbji9sO/WinFwChPMwEx1plpB4M=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 184d2b49-4e09-4190-b7b2-08dc41e7048b
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2024 16:19:25.1908
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: J0K1DBHSsYzkzpChCxjHtI0LMmLn9E5LLLXB8FPY/fe5MBeq3HbKCHJALViPDB8ZN/rcpcOsYIBH/BgA83HowVVvADzmTX9tLqoX5Cfluto=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR10MB7589
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-03-11_10,2024-03-11_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 suspectscore=0
 malwarescore=0 spamscore=0 mlxscore=0 adultscore=0 mlxlogscore=999
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2311290000 definitions=main-2403110124
X-Proofpoint-GUID: v3HYcdjVo_CUrjQAjCGV1A_0Af7hpTLR
X-Proofpoint-ORIG-GUID: v3HYcdjVo_CUrjQAjCGV1A_0Af7hpTLR

Add two new fields in public_key_signature to track the intended usage of
the signature.  Also add a flag for the revocation pass.  During signiture
validation, two verifications can take place for the same signature.  One
to see if it verifies against something on the .blacklist keyring and
the other to see if it verifies against the supplied keyring. The flag
is used to determine which stage the verification is in.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
 certs/blacklist.c                     |  3 +++
 crypto/asymmetric_keys/pkcs7_trust.c  | 20 ++++++++++++++++++++
 crypto/asymmetric_keys/pkcs7_verify.c |  4 ++++
 include/crypto/pkcs7.h                |  3 +++
 include/crypto/public_key.h           |  4 ++++
 5 files changed, 34 insertions(+)

diff --git a/certs/blacklist.c b/certs/blacklist.c
index 675dd7a8f07a..dd34e56a6362 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -17,6 +17,7 @@
 #include <linux/uidgid.h>
 #include <keys/asymmetric-type.h>
 #include <keys/system_keyring.h>
+#include <crypto/public_key.h>
 #include "blacklist.h"
 
 /*
@@ -289,7 +290,9 @@ int is_key_on_revocation_list(struct pkcs7_message *pkcs7)
 {
 	int ret;
 
+	pkcs7_set_usage_flag(pkcs7, PKS_REVOCATION_PASS);
 	ret = pkcs7_validate_trust(pkcs7, blacklist_keyring);
+	pkcs7_clear_usage_flag(pkcs7, PKS_REVOCATION_PASS);
 
 	if (ret == 0)
 		return -EKEYREJECTED;
diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
index 9a87c34ed173..64d70eb68864 100644
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -131,6 +131,26 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
 	return 0;
 }
 
+void pkcs7_clear_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage)
+{
+	struct pkcs7_signed_info *sinfo;
+
+	for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
+		if (sinfo->sig)
+			clear_bit(usage, &sinfo->sig->usage_flags);
+	}
+}
+
+void pkcs7_set_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage)
+{
+	struct pkcs7_signed_info *sinfo;
+
+	for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
+		if (sinfo->sig)
+			set_bit(usage, &sinfo->sig->usage_flags);
+	}
+}
+
 /**
  * pkcs7_validate_trust - Validate PKCS#7 trust chain
  * @pkcs7: The PKCS#7 certificate to validate
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 1dc80e68ce96..44b8bd0ad4d8 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -455,6 +455,10 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
 			return ret;
 		}
 		actual_ret = 0;
+		if (sinfo->sig) {
+			sinfo->sig->usage = usage;
+			set_bit(PKS_USAGE_SET, &sinfo->sig->usage_flags);
+		}
 	}
 
 	kleave(" = %d", actual_ret);
diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h
index 38ec7f5f9041..6c3c9061b118 100644
--- a/include/crypto/pkcs7.h
+++ b/include/crypto/pkcs7.h
@@ -32,6 +32,9 @@ extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
 extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
 				struct key *trust_keyring);
 
+extern void pkcs7_set_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage);
+extern void pkcs7_clear_usage_flag(struct pkcs7_message *pkcs7, unsigned long usage);
+
 /*
  * pkcs7_verify.c
  */
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 462f8a34cdf8..3ddfbc20a55f 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -48,6 +48,10 @@ struct public_key_signature {
 	const char *pkey_algo;
 	const char *hash_algo;
 	const char *encoding;
+	u32 usage;		/* Intended usage */
+	unsigned long usage_flags;
+#define PKS_USAGE_SET		0
+#define PKS_REVOCATION_PASS	1
 };
 
 extern void public_key_signature_free(struct public_key_signature *sig);
-- 
2.39.3