initial commit
imported from https://salsa.debian.org/kernel-team/linux.git commit 9d5cc9d9d6501d7f1dd7e194d4b245bd0b6c6a22 version 6.11.4-1
This commit is contained in:
@@ -0,0 +1,130 @@
|
||||
From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
|
||||
Date: Tue, 13 Mar 2018 18:38:02 +0800
|
||||
Subject: [PATCH 3/4] MODSIGN: checking the blacklisted hash before loading a
|
||||
kernel module
|
||||
Origin: https://lore.kernel.org/patchwork/patch/933175/
|
||||
|
||||
This patch adds the logic for checking the kernel module's hash
|
||||
base on blacklist. The hash must be generated by sha256 and enrolled
|
||||
to dbx/mokx.
|
||||
|
||||
For example:
|
||||
sha256sum sample.ko
|
||||
mokutil --mokx --import-hash $HASH_RESULT
|
||||
|
||||
Whether the signature on ko file is stripped or not, the hash can be
|
||||
compared by kernel.
|
||||
|
||||
Cc: David Howells <dhowells@redhat.com>
|
||||
Cc: Josh Boyer <jwboyer@fedoraproject.org>
|
||||
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
|
||||
Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
|
||||
[Rebased by Luca Boccassi]
|
||||
[bwh: Forward-ported to 5.19:
|
||||
- The type parameter to is_hash_blacklisted() is now an enumeration
|
||||
rather than a string
|
||||
- Adjust filename, context]
|
||||
---
|
||||
kernel/module/signing.c | 59 +++++++++++++++++++++++++++++++++++++++--
|
||||
1 file changed, 57 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/kernel/module/signing.c
|
||||
+++ b/kernel/module/signing.c
|
||||
@@ -13,6 +13,8 @@
|
||||
#include <linux/verification.h>
|
||||
#include <linux/security.h>
|
||||
#include <crypto/public_key.h>
|
||||
+#include <crypto/hash.h>
|
||||
+#include <keys/system_keyring.h>
|
||||
#include <uapi/linux/module.h>
|
||||
#include "internal.h"
|
||||
|
||||
@@ -37,13 +39,60 @@
|
||||
sig_enforce = true;
|
||||
}
|
||||
|
||||
+static int mod_is_hash_blacklisted(const void *mod, size_t verifylen)
|
||||
+{
|
||||
+ struct crypto_shash *tfm;
|
||||
+ struct shash_desc *desc;
|
||||
+ size_t digest_size, desc_size;
|
||||
+ u8 *digest;
|
||||
+ int ret;
|
||||
+
|
||||
+ tfm = crypto_alloc_shash("sha256", 0, 0);
|
||||
+ if (IS_ERR(tfm)) {
|
||||
+ ret = PTR_ERR(tfm);
|
||||
+ goto error_return;
|
||||
+ }
|
||||
+
|
||||
+ desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
|
||||
+ digest_size = crypto_shash_digestsize(tfm);
|
||||
+ digest = kzalloc(digest_size + desc_size, GFP_KERNEL);
|
||||
+ if (!digest) {
|
||||
+ pr_err("digest memory buffer allocate fail\n");
|
||||
+ ret = -ENOMEM;
|
||||
+ goto error_digest;
|
||||
+ }
|
||||
+ desc = (void *)digest + digest_size;
|
||||
+ desc->tfm = tfm;
|
||||
+ ret = crypto_shash_init(desc);
|
||||
+ if (ret < 0)
|
||||
+ goto error_shash;
|
||||
+
|
||||
+ ret = crypto_shash_finup(desc, mod, verifylen, digest);
|
||||
+ if (ret < 0)
|
||||
+ goto error_shash;
|
||||
+
|
||||
+ pr_debug("%ld digest: %*phN\n", verifylen, (int) digest_size, digest);
|
||||
+
|
||||
+ ret = is_hash_blacklisted(digest, digest_size, BLACKLIST_HASH_BINARY);
|
||||
+ if (ret == -EKEYREJECTED)
|
||||
+ pr_err("Module hash %*phN is blacklisted\n",
|
||||
+ (int) digest_size, digest);
|
||||
+
|
||||
+error_shash:
|
||||
+ kfree(digest);
|
||||
+error_digest:
|
||||
+ crypto_free_shash(tfm);
|
||||
+error_return:
|
||||
+ return ret;
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* Verify the signature on a module.
|
||||
*/
|
||||
int mod_verify_sig(const void *mod, struct load_info *info)
|
||||
{
|
||||
struct module_signature ms;
|
||||
- size_t sig_len, modlen = info->len;
|
||||
+ size_t sig_len, modlen = info->len, wholelen;
|
||||
int ret;
|
||||
|
||||
pr_devel("==>%s(,%zu)\n", __func__, modlen);
|
||||
@@ -51,6 +100,7 @@
|
||||
if (modlen <= sizeof(ms))
|
||||
return -EBADMSG;
|
||||
|
||||
+ wholelen = modlen + sizeof(MODULE_SIG_STRING) - 1;
|
||||
memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
|
||||
|
||||
ret = mod_check_sig(&ms, modlen, "module");
|
||||
@@ -61,10 +111,17 @@
|
||||
modlen -= sig_len + sizeof(ms);
|
||||
info->len = modlen;
|
||||
|
||||
- return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
||||
+ ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
||||
VERIFY_USE_SECONDARY_KEYRING,
|
||||
VERIFYING_MODULE_SIGNATURE,
|
||||
NULL, NULL);
|
||||
+ pr_devel("verify_pkcs7_signature() = %d\n", ret);
|
||||
+
|
||||
+ /* checking hash of module is in blacklist */
|
||||
+ if (!ret)
|
||||
+ ret = mod_is_hash_blacklisted(mod, wholelen);
|
||||
+
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
int module_sig_check(struct load_info *info, int flags)
|
||||
@@ -0,0 +1,33 @@
|
||||
From: Robert Holmes <robeholmes@gmail.com>
|
||||
Date: Tue, 23 Apr 2019 07:39:29 +0000
|
||||
Subject: [PATCH] KEYS: Make use of platform keyring for module signature
|
||||
verify
|
||||
Bug-Debian: https://bugs.debian.org/935945
|
||||
Bug-Debian: https://bugs.debian.org/1030200
|
||||
Origin: https://src.fedoraproject.org/rpms/kernel/raw/master/f/KEYS-Make-use-of-platform-keyring-for-module-signature.patch
|
||||
Forwarded: https://lore.kernel.org/linux-modules/qvgp2il2co4iyxkzxvcs4p2bpyilqsbfgcprtpfrsajwae2etc@3z2s2o52i3xg/t/#u
|
||||
|
||||
This allows a cert in DB to be used to sign modules,
|
||||
in addition to certs in the MoK and built-in keyrings.
|
||||
|
||||
Signed-off-by: Robert Holmes <robeholmes@gmail.com>
|
||||
Signed-off-by: Jeremy Cline <jcline@redhat.com>
|
||||
[bwh: Forward-ported to 5.19: adjust filename]
|
||||
[наб: reinstate for 6.1, re-write description]
|
||||
---
|
||||
--- a/kernel/module/signing.c
|
||||
+++ b/kernel/module/signing.c
|
||||
@@ -116,6 +116,13 @@ int mod_verify_sig(const void *mod, stru
|
||||
VERIFYING_MODULE_SIGNATURE,
|
||||
NULL, NULL);
|
||||
pr_devel("verify_pkcs7_signature() = %d\n", ret);
|
||||
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
|
||||
+ ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
||||
+ VERIFY_USE_PLATFORM_KEYRING,
|
||||
+ VERIFYING_MODULE_SIGNATURE,
|
||||
+ NULL, NULL);
|
||||
+ pr_devel("verify_pkcs7_signature() = %d\n", ret);
|
||||
+ }
|
||||
|
||||
/* checking hash of module is in blacklist */
|
||||
if (!ret)
|
||||
29
debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch
vendored
Normal file
29
debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch
vendored
Normal file
@@ -0,0 +1,29 @@
|
||||
From 585cbcb982bffc4a8cee2f3d8d099fc64f9a74b9 Mon Sep 17 00:00:00 2001
|
||||
From: Luca Boccassi <bluca@debian.org>
|
||||
Date: Fri, 14 Oct 2022 00:22:06 +0200
|
||||
Subject: [PATCH] trust machine keyring (MoK) by default
|
||||
Forwarded: not-needed
|
||||
|
||||
Debian always trusted keys in MoK by default. Upstream made it
|
||||
conditional on a new EFI variable being set.
|
||||
To keep backward compatibility skip this check.
|
||||
---
|
||||
security/integrity/platform_certs/machine_keyring.c | 5 +----
|
||||
1 file changed, 1 insertion(+), 4 deletions(-)
|
||||
|
||||
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
|
||||
index a401640a63cd..0627f14eacbe 100644
|
||||
--- a/security/integrity/platform_certs/machine_keyring.c
|
||||
+++ b/security/integrity/platform_certs/machine_keyring.c
|
||||
@@ -68,10 +68,7 @@ static bool __init trust_moklist(void)
|
||||
|
||||
if (!initialized) {
|
||||
initialized = true;
|
||||
- trust_mok = false;
|
||||
-
|
||||
- if (uefi_check_trust_mok_keys())
|
||||
- trust_mok = true;
|
||||
+ trust_mok = true;
|
||||
}
|
||||
|
||||
return trust_mok;
|
||||
Reference in New Issue
Block a user