@@ -5,6 +5,9 @@
#define INITRD_MINOR 250 /* shouldn't collide with /dev/ram* too soon ... */
+/* the len here equals the modsig string len */
+#define INITRD_SIG_STRING "~initrd signature appended~\n"
+
/* starting block # of image */
extern int rd_image_start;
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
#include <linux/init.h>
+#include <linux/initrd.h>
#include <linux/async.h>
#include <linux/fs.h>
#include <linux/slab.h>
@@ -14,6 +15,7 @@
#include <linux/kstrtox.h>
#include <linux/memblock.h>
#include <linux/mm.h>
+#include <linux/module_signature.h>
#include <linux/namei.h>
#include <linux/init_syscalls.h>
#include <linux/umh.h>
@@ -688,8 +690,69 @@ static void __init populate_initrd_image(char *err)
}
#endif /* CONFIG_BLK_DEV_RAM */
+static int __init initrd_signature_check(size_t *initrd_len)
+{
+ struct module_signature *ms;
+ size_t sig_len;
+ int ret = -ENODATA;
+ const size_t m_len = sizeof(INITRD_SIG_STRING) - 1;
+
+ *initrd_len = (initrd_end - initrd_start);
+
+ if (*initrd_len < (m_len + sizeof(*ms)))
+ goto fail;
+
+ if (memcmp((char *)(initrd_end - m_len), INITRD_SIG_STRING, m_len)) {
+ pr_info("unsigned initramfs\n");
+ goto fail;
+ }
+
+ /* remove module sig string from len computations going forward */
+ *initrd_len -= m_len;
+
+ ms = (struct module_signature *)(initrd_end - sizeof(*ms) - m_len);
+
+ ret = mod_check_sig(ms, *initrd_len, "initramfs");
+ if (ret)
+ goto fail;
+
+ sig_len = be32_to_cpu(ms->sig_len);
+ *initrd_len -= sizeof(*ms) + sig_len;
+
+#ifdef CONFIG_INITRAMFS_SIG
+ ret = verify_pkcs7_signature((char *)initrd_start, *initrd_len,
+ (char *)(initrd_start + *initrd_len),
+ sig_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_UNSPECIFIED_SIGNATURE,
+ NULL, NULL);
+
+ switch (ret) {
+ case 0:
+ pr_info("initramfs: valid signature\n");
+ break;
+ case -ENODATA:
+ pr_err("initramfs: invalid signature\n");
+ break;
+ case -ENOPKG:
+ pr_err("initramfs: unsupported crypto\n");
+ break;
+ case -ENOKEY:
+ pr_err("initramfs: unknown key\n");
+ break;
+ default:
+ pr_err("initramfs: unknown error %d\n", ret);
+ }
+#endif
+
+fail:
+ return ret;
+}
+
static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)
{
+ size_t initrd_len;
+
/* Load the built in initramfs */
char *err = unpack_to_rootfs(__initramfs_start, __initramfs_size);
if (err)
@@ -703,7 +766,9 @@ static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)
else
printk(KERN_INFO "Unpacking initramfs...\n");
- err = unpack_to_rootfs((char *)initrd_start, initrd_end - initrd_start);
+ initrd_signature_check(&initrd_len);
+
+ err = unpack_to_rootfs((char *)initrd_start, initrd_len);
if (err) {
#ifdef CONFIG_BLK_DEV_RAM
populate_initrd_image(err);
Adding some security checks around the configuration data and early init processes running on the machine is a good idea. There is a move to do this via systemd UKIs using the UEFI and shim infrastructure to wrap a kernel and its associated initramfs into a single PE executable, which is then validated and measured together. The existing kernel boot methods can also provide a similar level of security by leveraging the kernel's signing and validation infrastructure to check a signature on the initramfs. Kernel-validated initramfs images maintain the existing UEFI boot flow while enabling functionality on non-UEFI machines. They keep the UEFI secure boot verification separate from current and future choices over how the kernel verifies data used after it boots. Additionally, this makes it possible for multiple signed initramfs images, for example, debug and recovery images, to share a single kernel image. Let's reuse the kernel's sign-file utility, which appends a trailing signature, signature description, and module signature string to sign the initramfs. Then, immediately before we unpack the image, detect if there is a signature, validate it, and strip it off. Then, with a later patch, we can decide what happens when the image is unsigned or cannot be verified. Signed-off-by: Jeremy Linton <jeremy.linton@arm.com> --- include/linux/initrd.h | 3 ++ init/initramfs.c | 67 +++++++++++++++++++++++++++++++++++++++++- 2 files changed, 69 insertions(+), 1 deletion(-)