| From fb2ac204a70da565de9ef9a9d6d69a40c2d59727 Mon Sep 17 00:00:00 2001 |
| From: David Howells <dhowells@redhat.com> |
| Date: Fri, 5 May 2017 08:21:56 +0100 |
| Subject: [PATCH] KEYS: Allow unrestricted boot-time addition of keys to |
| secondary keyring |
| |
| Allow keys to be added to the system secondary certificates keyring during |
| kernel initialisation in an unrestricted fashion. Such keys are implicitly |
| trusted and don't have their trust chains checked on link. |
| |
| This allows keys in the UEFI database to be added in secure boot mode for |
| the purposes of module signing. |
| |
| Signed-off-by: David Howells <dhowells@redhat.com> |
| |
| certs/internal.h | 18 ++++++++++++++++++ |
| certs/system_keyring.c | 33 +++++++++++++++++++++++++++++++++ |
| 2 files changed, 51 insertions(+) |
| create mode 100644 certs/internal.h |
| |
| diff --git a/certs/internal.h b/certs/internal.h |
| new file mode 100644 |
| index 0000000..5dcbefb |
| |
| |
| @@ -0,0 +1,18 @@ |
| +/* Internal definitions |
| + * |
| + * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. |
| + * Written by David Howells (dhowells@redhat.com) |
| + * |
| + * This program is free software; you can redistribute it and/or |
| + * modify it under the terms of the GNU General Public Licence |
| + * as published by the Free Software Foundation; either version |
| + * 2 of the Licence, or (at your option) any later version. |
| + */ |
| + |
| +/* |
| + * system_keyring.c |
| + */ |
| +#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING |
| +extern void __init add_trusted_secondary_key(const char *source, |
| + const void *data, size_t len); |
| +#endif |
| diff --git a/certs/system_keyring.c b/certs/system_keyring.c |
| index 6251d1b..5ac8ba6 100644 |
| |
| |
| @@ -18,6 +18,7 @@ |
| #include <keys/asymmetric-type.h> |
| #include <keys/system_keyring.h> |
| #include <crypto/pkcs7.h> |
| +#include "internal.h" |
| |
| static struct key *builtin_trusted_keys; |
| #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING |
| @@ -265,3 +266,35 @@ int verify_pkcs7_signature(const void *data, size_t len, |
| EXPORT_SYMBOL_GPL(verify_pkcs7_signature); |
| |
| #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ |
| + |
| +#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING |
| +/** |
| + * add_trusted_secondary_key - Add to secondary keyring with no validation |
| + * @source: Source of key |
| + * @data: The blob holding the key |
| + * @len: The length of the data blob |
| + * |
| + * Add a key to the secondary keyring without checking its trust chain. This |
| + * is available only during kernel initialisation. |
| + */ |
| +void __init add_trusted_secondary_key(const char *source, |
| + const void *data, size_t len) |
| +{ |
| + key_ref_t key; |
| + |
| + key = key_create_or_update(make_key_ref(secondary_trusted_keys, 1), |
| + "asymmetric", |
| + NULL, data, len, |
| + (KEY_POS_ALL & ~KEY_POS_SETATTR) | |
| + KEY_USR_VIEW, |
| + KEY_ALLOC_NOT_IN_QUOTA | |
| + KEY_ALLOC_BYPASS_RESTRICTION); |
| + |
| + if (IS_ERR(key)) |
| + pr_err("Problem loading %s X.509 certificate (%ld)\n", |
| + source, PTR_ERR(key)); |
| + else |
| + pr_notice("Loaded %s cert '%s' linked to secondary sys keyring\n", |
| + source, key_ref_to_ptr(key)->description); |
| +} |
| +#endif /* CONFIG_SECONDARY_TRUSTED_KEYRING */ |
| -- |
| 2.9.3 |
| |