diff mbox series

[v7,2/4] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification

Message ID 20210521094220.1238-3-jlee@suse.com
State New
Headers show
Series Check codeSigning extended key usage extension | expand

Commit Message

Lee, Chun-Yi May 21, 2021, 9:42 a.m. UTC 
This patch adds the logic for checking the CodeSigning extended
key usage when verifying signature of kernel module or
kexec PE binary in PKCS#7.

Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
---
 certs/blacklist.c                    |  6 +++--
 certs/system_keyring.c               |  4 ++--
 crypto/asymmetric_keys/Kconfig       |  9 ++++++++
 crypto/asymmetric_keys/pkcs7_trust.c | 43 +++++++++++++++++++++++++++++++++---
 include/crypto/pkcs7.h               |  4 +++-
 include/keys/system_keyring.h        |  7 ++++--
 6 files changed, 63 insertions(+), 10 deletions(-)

Comments

kernel test robot May 22, 2021, 5:26 p.m. UTC | #1 
Hi Chun-Yi",

I love your patch! Yet something to improve:

[auto build test ERROR on cryptodev/master]
[also build test ERROR on linus/master v5.13-rc2 next-20210521]
[cannot apply to crypto/master sparc-next/master]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Lee-Chun-Yi/Check-codeSigning-extended-key-usage-extension/20210522-220349
base:   https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
config: sparc64-randconfig-s032-20210522 (attached as .config)
compiler: sparc64-linux-gcc (GCC) 9.3.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # apt-get install sparse
        # sparse version: v0.6.3-341-g8af24329-dirty
        # https://github.com/0day-ci/linux/commit/928555596c9cd62caabf8777ed8152ddac2609ef
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Lee-Chun-Yi/Check-codeSigning-extended-key-usage-extension/20210522-220349
        git checkout 928555596c9cd62caabf8777ed8152ddac2609ef
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' W=1 ARCH=sparc64 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   In file included from security/integrity/digsig.c:18:
>> include/keys/system_keyring.h:72:1: error: expected identifier or '(' before '{' token

      72 | {
         | ^
   In file included from security/integrity/digsig.c:18:
   include/keys/system_keyring.h:70:19: warning: 'is_key_on_revocation_list' declared 'static' but never defined [-Wunused-function]
      70 | static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
         |                   ^~~~~~~~~~~~~~~~~~~~~~~~~


vim +72 include/keys/system_keyring.h

734114f8782f6c David Howells 2017-04-03  60  
56c5812623f953 Eric Snowberg 2021-01-22  61  #ifdef CONFIG_SYSTEM_REVOCATION_LIST
56c5812623f953 Eric Snowberg 2021-01-22  62  extern int add_key_to_revocation_list(const char *data, size_t size);
928555596c9cd6 Lee, Chun-Yi  2021-05-21  63  extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
928555596c9cd6 Lee, Chun-Yi  2021-05-21  64  				     enum key_being_used_for usage);
56c5812623f953 Eric Snowberg 2021-01-22  65  #else
56c5812623f953 Eric Snowberg 2021-01-22  66  static inline int add_key_to_revocation_list(const char *data, size_t size)
56c5812623f953 Eric Snowberg 2021-01-22  67  {
56c5812623f953 Eric Snowberg 2021-01-22  68  	return 0;
56c5812623f953 Eric Snowberg 2021-01-22  69  }
928555596c9cd6 Lee, Chun-Yi  2021-05-21  70  static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
928555596c9cd6 Lee, Chun-Yi  2021-05-21  71  					    enum key_being_used_for usage);
56c5812623f953 Eric Snowberg 2021-01-22 @72  {
56c5812623f953 Eric Snowberg 2021-01-22  73  	return -ENOKEY;
56c5812623f953 Eric Snowberg 2021-01-22  74  }
56c5812623f953 Eric Snowberg 2021-01-22  75  #endif
56c5812623f953 Eric Snowberg 2021-01-22  76  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
kernel test robot May 22, 2021, 6:55 p.m. UTC | #2 
Hi Chun-Yi",

I love your patch! Perhaps something to improve:

[auto build test WARNING on cryptodev/master]
[also build test WARNING on linus/master v5.13-rc2 next-20210521]
[cannot apply to crypto/master]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Lee-Chun-Yi/Check-codeSigning-extended-key-usage-extension/20210522-220349
base:   https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
config: openrisc-randconfig-r015-20210522 (attached as .config)
compiler: or1k-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/928555596c9cd62caabf8777ed8152ddac2609ef
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Lee-Chun-Yi/Check-codeSigning-extended-key-usage-extension/20210522-220349
        git checkout 928555596c9cd62caabf8777ed8152ddac2609ef
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=openrisc 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

   In file included from certs/system_keyring.c:17:
   include/keys/system_keyring.h:72:1: error: expected identifier or '(' before '{' token
      72 | {
         | ^
>> include/keys/system_keyring.h:70:19: warning: 'is_key_on_revocation_list' used but never defined

      70 | static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
         |                   ^~~~~~~~~~~~~~~~~~~~~~~~~


vim +/is_key_on_revocation_list +70 include/keys/system_keyring.h

    60	
    61	#ifdef CONFIG_SYSTEM_REVOCATION_LIST
    62	extern int add_key_to_revocation_list(const char *data, size_t size);
    63	extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
    64					     enum key_being_used_for usage);
    65	#else
    66	static inline int add_key_to_revocation_list(const char *data, size_t size)
    67	{
    68		return 0;
    69	}
  > 70	static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7,

    71						    enum key_being_used_for usage);
    72	{
    73		return -ENOKEY;
    74	}
    75	#endif
    76	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
diff mbox series

Patch

diff --git a/certs/blacklist.c b/certs/blacklist.c
index c9a435b15af4..a4ef26286584 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -16,6 +16,7 @@ 
 #include <linux/seq_file.h>
 #include <linux/uidgid.h>
 #include <keys/system_keyring.h>
+#include <keys/asymmetric-type.h>
 #include "blacklist.h"
 #include "common.h"
 
@@ -181,11 +182,12 @@  int add_key_to_revocation_list(const char *data, size_t size)
  * is_key_on_revocation_list - Determine if the key for a PKCS#7 message is revoked
  * @pkcs7: The PKCS#7 message to check
  */
-int is_key_on_revocation_list(struct pkcs7_message *pkcs7)
+int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
+			      enum key_being_used_for usage)
 {
 	int ret;
 
-	ret = pkcs7_validate_trust(pkcs7, blacklist_keyring);
+	ret = pkcs7_validate_trust(pkcs7, blacklist_keyring, usage, false);
 
 	if (ret == 0)
 		return -EKEYREJECTED;
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 692365dee2bd..394cf4e0feed 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -221,13 +221,13 @@  int verify_pkcs7_message_sig(const void *data, size_t len,
 			goto error;
 		}
 
-		ret = is_key_on_revocation_list(pkcs7);
+		ret = is_key_on_revocation_list(pkcs7, usage);
 		if (ret != -ENOKEY) {
 			pr_devel("PKCS#7 platform key is on revocation list\n");
 			goto error;
 		}
 	}
-	ret = pkcs7_validate_trust(pkcs7, trusted_keys);
+	ret = pkcs7_validate_trust(pkcs7, trusted_keys, usage, true);
 	if (ret < 0) {
 		if (ret == -ENOKEY)
 			pr_devel("PKCS#7 signature not signed with a trusted key\n");
diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
index 1f1f004dc757..1754812df989 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -96,4 +96,13 @@  config SIGNED_PE_FILE_VERIFICATION
 	  This option provides support for verifying the signature(s) on a
 	  signed PE binary.
 
+config CHECK_CODESIGN_EKU
+	bool "Check codeSigning extended key usage"
+	depends on PKCS7_MESSAGE_PARSER=y
+	depends on SYSTEM_DATA_VERIFICATION
+	help
+	  This option provides support for checking the codeSigning extended
+	  key usage when verifying the signature in PKCS#7. It affects kernel
+	  module verification and kexec PE binary verification.
+
 endif # ASYMMETRIC_KEY_TYPE
diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
index b531df2013c4..c6ebf3e6adfd 100644
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -16,12 +16,40 @@ 
 #include <crypto/public_key.h>
 #include "pkcs7_parser.h"
 
+#ifdef CONFIG_CHECK_CODESIGN_EKU
+static bool check_eku_by_usage(struct key *key, enum key_being_used_for usage)
+{
+	struct public_key *public_key = key->payload.data[asym_crypto];
+	bool ret = true;
+
+	switch (usage) {
+	case VERIFYING_MODULE_SIGNATURE:
+	case VERIFYING_KEXEC_PE_SIGNATURE:
+		ret = !!(public_key->eku & EKU_codeSigning);
+		if (!ret)
+			pr_warn("The signer '%s' key is not CodeSigning\n",
+				key->description);
+		break;
+	default:
+		break;
+	}
+	return ret;
+}
+#else
+static bool check_eku_by_usage(struct key *key, enum key_being_used_for usage)
+{
+	return true;
+}
+#endif
+
 /*
  * Check the trust on one PKCS#7 SignedInfo block.
  */
 static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
 				    struct pkcs7_signed_info *sinfo,
-				    struct key *trust_keyring)
+				    struct key *trust_keyring,
+				    enum key_being_used_for usage,
+				    bool check_eku)
 {
 	struct public_key_signature *sig = sinfo->sig;
 	struct x509_certificate *x509, *last = NULL, *p;
@@ -112,6 +140,10 @@  static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
 	return -ENOKEY;
 
 matched:
+	if (check_eku && !check_eku_by_usage(key, usage)) {
+		key_put(key);
+		return -ENOKEY;
+	}
 	ret = verify_signature(key, sig);
 	key_put(key);
 	if (ret < 0) {
@@ -135,6 +167,8 @@  static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
  * pkcs7_validate_trust - Validate PKCS#7 trust chain
  * @pkcs7: The PKCS#7 certificate to validate
  * @trust_keyring: Signing certificates to use as starting points
+ * @usage: The use to which the key is being put.
+ * @check_eku: Check EKU (Extended Key Usage)
  *
  * Validate that the certificate chain inside the PKCS#7 message intersects
  * keys we already know and trust.
@@ -156,7 +190,9 @@  static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
  * May also return -ENOMEM.
  */
 int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
-			 struct key *trust_keyring)
+			 struct key *trust_keyring,
+			 enum key_being_used_for usage,
+			 bool check_eku)
 {
 	struct pkcs7_signed_info *sinfo;
 	struct x509_certificate *p;
@@ -167,7 +203,8 @@  int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
 		p->seen = false;
 
 	for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
-		ret = pkcs7_validate_trust_one(pkcs7, sinfo, trust_keyring);
+		ret = pkcs7_validate_trust_one(pkcs7, sinfo, trust_keyring,
+					       usage, check_eku);
 		switch (ret) {
 		case -ENOKEY:
 			continue;
diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h
index 38ec7f5f9041..5d87b8a02f79 100644
--- a/include/crypto/pkcs7.h
+++ b/include/crypto/pkcs7.h
@@ -30,7 +30,9 @@  extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
  * pkcs7_trust.c
  */
 extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
-				struct key *trust_keyring);
+				struct key *trust_keyring,
+				enum key_being_used_for usage,
+				bool check_eku);
 
 /*
  * pkcs7_verify.c
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 6acd3cf13a18..3da982c3aef5 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -9,6 +9,7 @@ 
 #define _KEYS_SYSTEM_KEYRING_H
 
 #include <linux/key.h>
+#include <keys/asymmetric-type.h>
 
 #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
 
@@ -59,13 +60,15 @@  static inline int is_binary_blacklisted(const u8 *hash, size_t hash_len)
 
 #ifdef CONFIG_SYSTEM_REVOCATION_LIST
 extern int add_key_to_revocation_list(const char *data, size_t size);
-extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7);
+extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
+				     enum key_being_used_for usage);
 #else
 static inline int add_key_to_revocation_list(const char *data, size_t size)
 {
 	return 0;
 }
-static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7)
+static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7,
+					    enum key_being_used_for usage);
 {
 	return -ENOKEY;
 }