From patchwork Thu Mar 2 16:46:47 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 658856 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 821DFC7EE36 for ; Thu, 2 Mar 2023 16:47:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230139AbjCBQro (ORCPT ); Thu, 2 Mar 2023 11:47:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230071AbjCBQrg (ORCPT ); Thu, 2 Mar 2023 11:47:36 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A20F4C6E3; Thu, 2 Mar 2023 08:47:29 -0800 (PST) Received: from pps.filterd (m0333521.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 322FCl1B028152; Thu, 2 Mar 2023 16:46:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2022-7-12; bh=0y0v3HYqXP8jxWz7DNC1natKc715TPpcOTI2z4B/XtY=; b=poheWPZ7SSSswg+7OZq4JAxEHCkkPmtj5QTzFSZ5jm0ezJixJZTAV6chTMW6nCQY5sNd DkjtyqaKFAuhu4sFHqUP1i1SiZaiOvS+TZ8bqDDM2rHzxHEUTO5qXGyxx4ZTwHIE5veU xeYfVNRSnT9LhxMQ1fJAaqbcx6tHpFmIqf97/Lmlr/v7ruBEYgrpmvHa0IeSztZ/HIHJ y34TPcv9AtRIgmtT2w4Sz6gKP+VMScE5mBUZS+IitY/4F2KS8HBUso0CcApM2rCfo/5u DZveuS9kdNVqwyDIOjVucSO8CEfdrQ1mNiS5/RzfEf6B7rhRkcNlecwA1DkZe2ifpVS5 3A== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3nyb7wvfq4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:46:54 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 322FVce2000634; Thu, 2 Mar 2023 16:46:53 GMT Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2168.outbound.protection.outlook.com [104.47.57.168]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3ny8sa9s9b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:46:53 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HRKN6O62ow51TZyxkfkR3885bKLMg5DUcEkDX4Mq83qDFH292D5o7Ra9c213/2G4i5r6MGu9ukI8QPx/3oLeAYkMRXkij/e28VMsE2wPatAOPHGghWnj2KtMTzOgHwTTtoQg3SRtpPBA8DBSZqpxynqIqkOg9aSHxYeLcUsOrk5+9a72Bnkn1+noqjwMJo646BEavkywBLIHkpg8lLCuHRdElCuVITEA2PLrKpWfejhYhiXCO8euWSPOlAFGFr3bexyaDOIIemRw8rfCRNz3kfbNGHf3AeIanRvDBCYBxrmNq8+dVutkLgpvUKf7fonhf1Qy1XODVlL5BD0KOQbbEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0y0v3HYqXP8jxWz7DNC1natKc715TPpcOTI2z4B/XtY=; b=jSGD605CVHPGwgQ6g0GiFvgBSnJEVlxqMjpEp8a4qqOGSz3EjZtq2fgcSYisu3VI02dBi5BNsT4nae9wSz1vRVOQEgYrXJbrbOv/ZmwSFTrO7bB7p5A6ku6W8RWRUe8ICM+HhR8LSe+mZtYPFJpATy/LsPmaJgC1YvegoldIb3ycjCPk0WSoaUDkBpJLEhiWkxX8/RLc5hb3nNzwlb3Qw9eR7SRvCXz9RC+bHFrwH5KCHvo0+JDe2yK+9R2B1Q1Pfl5SWrFkU4rNr7TGWgUQLDPHN5c8J/op50RFksyN6aaTCYmdSJasxJZ5IbwQw65xNdakhIdi04cPcSaCB/Taow== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0y0v3HYqXP8jxWz7DNC1natKc715TPpcOTI2z4B/XtY=; b=h1XisZg3oeJm9VRbSGnGSXtnACdeXOgSZeGP+bG7zL+VpgDZrp/vmlWKOUCh1N0HeBWtEn0cHb/FcOsfoM71kYw/WgjpUr3IREfAYic31IdVMpBLLIRLfuXQA3YyfP/XuRlQKuuoOOmHJZ8TWO28Ako1ov8vIkcnYCJP7rAljLs= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by PH8PR10MB6357.namprd10.prod.outlook.com (2603:10b6:510:1bc::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.16; Thu, 2 Mar 2023 16:46:51 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb%3]) with mapi id 15.20.6156.019; Thu, 2 Mar 2023 16:46:51 +0000 From: Eric Snowberg To: jarkko@kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org Cc: herbert@gondor.apana.org.au, davem@davemloft.net, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, pvorel@suse.cz, eric.snowberg@oracle.com, kanth.ghatraju@oracle.com, konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com, coxu@redhat.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v5 1/6] KEYS: Create static version of public_key_verify_signature Date: Thu, 2 Mar 2023 11:46:47 -0500 Message-Id: <20230302164652.83571-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20230302164652.83571-1-eric.snowberg@oracle.com> References: <20230302164652.83571-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BY5PR17CA0070.namprd17.prod.outlook.com (2603:10b6:a03:167::47) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|PH8PR10MB6357:EE_ X-MS-Office365-Filtering-Correlation-Id: 8932a5c5-106b-4497-e74e-08db1b3db8b0 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 05D5Le373oX6Crh7JXAgPAvtBq/v/xCVVUNqOnQIY7PyZJhX8ssTzFuzdI6ow3NnuYnmbrcAh6HgEq/POXv6AYT+RmhQjzGImgbAh7k5gmDkGgT47XmyE/UusRp1odK3fiFMF/HfOO9xPtcDoEIMyovNr7a5XyfYycUHfUAyz9oVfv2LHKkjjg/S2rrgiAmyrwm0BiDVXeTiAuN4KZhIm+7XdmqAAE/6CQ9lYGLZhulDB7m6CGLtjFC1MJ3gGWdg+couF8tufdBPicQ/Ws4YvX9Br1eqz6yeKaANiPUrhB/sf83vHZDeGLGFcGjJCtkI8szOAeWJcZ4tZPl5T1iLgaDfYp4fvF/n9yJ9hBAm8sFffGIW+mgf7avm8+0cswobq0F/7g6Y6m4UhS8THwKTJaDdPDP8Chm+nDN0dZN72MaxxrX+2FhDXgWwWLNGXl6ee0EPGxH7I3mGrzghR0NigKRVjMskJqtkJvmIb+mmFSVFeYCIEVRcZxQ45e0Y/Mjnl6a3kzWy4HTSEUB4aTsxglxD7jwh4qk56kayIJk2WRsKcfd4iDdUnr1qr8MzOCUvsYAoN18T1NZGhIkBcisHuVOMxh9uaPJlhN/cqJctfP6BKrCRwesQgnN25iyPseJeIHdn44taCb4UAzuO2S85hg== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230025)(366004)(376002)(136003)(39860400002)(346002)(396003)(451199018)(4326008)(38100700002)(86362001)(36756003)(6666004)(44832011)(2906002)(8936002)(66476007)(66556008)(66946007)(5660300002)(41300700001)(7416002)(8676002)(6506007)(186003)(1076003)(6512007)(2616005)(83380400001)(316002)(478600001)(6486002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: U8RQtdChm/5NpJ6o34joXUvorbhr6WJQzC4SG/H7cuVVPtisOcqM72K/hrHr9rn5lFKy1e7hCc9ktJIFlrXwJjjtxssN8VHPV2S7r6bVQTwlSTPCbIH2FuTfSChp0PvpJF83gpGRmpSW8GLoWf5V+FSeklY6mJgRe19yzmot8TRwK7svxOQjmqbBD6ybYGUZ72jVcBwwf+M3FgW1xsfC8PEIr11RbaPCcZUalu2sbA6k+oqfmYSuhpLwbww3IYhnPDjo25wUZq/cYKxCN0hrk5gAjkKVOX3SnVqXwRLvAxbiIZg028ujwoukz+2PqRhSNxl58nWCahr0MPd3ryXhiX0VA7wbPe2a1XzBKXRk1CUQE5F7k/OrDwhsKdVI3mkwj797fBFh6Rf14Vs5HBm2N9/GW6+39HUi3iaJCVFCEYdw9NM3Poekx9qeUsKZMW2KSOGtR87qtpEbL/n627Tk7vziyHZeTS8RO0MRGrN9pqXPbzjOo4tCvYfChzOBE8uVqkTrFMGDToiQPgs7xbUTSgQaX31/4J79fwepBA6ZcgjLdyZK3NSkWI1wGSF4u0GVmfTdwULXEb66A5cVmiiSxX/bcD3EJyvMYG/eCyd8Dqoa/G6wcLl1er+i+37dknget+ir+Ny1c/Wu8XQJkQY4d05PiOqvpectOiL0NpI4tArj+EASiwAjgD+KMu1ey8UDdafeEHxGWMpjPVA2tVWK6HHbEKBulCsYxq2JzVo6e3+MNdtiB1PDdpLLEB4lduiiTT4XkGoSZKWgUoGYfubFhGb/5TTKsVSDvXlBdZkN1YKILlswDHF7ndG17j1PY/DzVvEA8NwZ8Fmms5Gi7Z3K0mVwccCTP3vQwzf/8g0U7bPNdYAXbIqpEggcJi8nX61DOpuEb4GsN4J8cu67MInnlEduZiJplvX0e5I5HxNMsM8rK7J05JkrhpJe8dHhOrutSa7m22bzlTkLtQKTOUqUkvl0XU9Ct+NOPGe9wmCnSWMnHxJ4V3LwOkfHPIVvYrgE1uSAXzxn/xDSb5VkfchYnclEZsB8SwRS7VxOlJvZ3Tktj02YNc7E0RjT/fPEUFxD2iOtH0B5xKV0BqfY3hNrxEKC19RygTYc8b6ZV8D+v/RLdkozEZG4mC/eCn9ekN9sYb0TZjHtIaUadeSP2TAkH1LnQfDIGemgKKqt29joIUmLY4kXE74UN+nH/Zvvi6unAYNoO4P0/JLOpfWgszpvMOKr2FHYL9/p3DPrF3BUXWkxjiHQbp3552wvMbNZZjt08qFNXYMvDIYShsKn6sQLOa6vzVSBRPt3/Ex4J6iqIaYHmZUJiDmqSOsdTAuu4eWcDQ4z0CMkRX3toftWO+wec81Kaf8I6LC3DF26LjbGiy1qmc0JGn1IBFaIzhWCtmiNmikBpKmk4PIz1jbsXci8sxO2kagTQto5H5impAPHDsaaUfdfFxZweM73+bFeVuHhmYzAn3NqCL63r80qpHB0lwEw5lLUo7C6BeFIc+SrNNvvELGtvB+FiaWigwpo321Evy5v/q0P+rHaLffHq4+YtCfy3XHxgalFV81VkcJyzI9J3Xm+px6tUYwGN9133BaDtcSTGs/7Eisoob16rGr8QE47kto+VrdzJeB0g0jgDcY= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: XoClScFGop0m2jyYkig76aqGZe29+X/Y6GgPyDwJyXVy/0AF7D14Z50LfXc/2ceZuDhVzRzph/fVRyUO95i16dy5E686d+DbQzGZPdUzedqPXxgxfFwylX6T2VbbSmFU0csGO53LoNRV9JQ0vc89dKXh/dsIZx4RGjVxJuBpsuUaRdL3UF+zeD91awePb9QV02j6Ygih1PLZaLuGYuvGrzODox5RiQoVZ+hLCdtrVJFebpZ7sIvwTtMvQw/VxudzkWdj/cv4yBJuP2nXAmmRo0KfHrB7anRyRoswdUQAb4wGkduoBWBSMwSzjSYvQjNNgNcXfflOr6ptomBn7IX1H9fbXnLYKNwIrOfBhcohCT9evlG/098bcftRnfz/mbDFZkh0nX5IZ7l/5q6E0OReV62Z733B5LmlX63dshDBfcLDItBvPjkSYFbkEgWs5kfejU0Q66xSBwTFR7mmli/gcoXJpzfJJzjUN24SslnPD4JPUql9mFvOH1KjDbLctQWHL6f8iE1iIWoJGYKn8YtPFltbcr3OAy/VO2zbRrLleVq7jsZ1ICfwkbj7uZxtqMELsWLrRFE2bCA8XYju0VN/g+ff4GayKfhtVyTvlOy7xotwsTGowWBnu8T7GxeycXzBwgTGyJ94tqxuiOk1+Ci1GGcfKy9RNGnkbFCkC+OvnqYleCwJl19+Ycc5I3heiMxDMX5z/5WEtTkbcI8Y4vwgZqu3kwDz+h8ecfnX+79HZ4eGfKwqEt1mTYNNp23WEQjzf39nD6CjTIxC1cA8CGNADdC4hrhAJg/3XYkkJwE7TeQumo8FsmZMYqrkGQcQyl5+C56LtOlw/YgV64lafABB62Ta55BAu5z6ZgLejPgwaxDDPiy1a4bjgCwF6NSnK2bGnNYXD9TRqNIfxMQLkOXXpDKkc1v8gWRhp2sBs84X5fjMlDcIdo/LOEA2oKucMDYa/SjlWtkpRv10PnZDpnLfXIxW5ARzRNioS9aRhuFDG8FmNW495QqJRrs0pcwEyEaGd4BOHlrZaZDztMq+MxOr4TOf4b+vYe2uYaMw/IjgvYm5w7FD/xitXA6LXsg1MhHkxDZpdfajdX6s2f+fq4DEhxW8xBr0lAruK6IS7dAkl/9rpzjtNef6lA9Slvl0ug6lyFluFExkT/e6krxkfM2uPeeNfs+A1Sh/FccJurSYg2g= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8932a5c5-106b-4497-e74e-08db1b3db8b0 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2023 16:46:50.9706 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: XotLS/yOpdRlcX5/xkblJND64OJ6PeQt6crl6aX0ux8y1pFiIOirsuKVVj0Xgf8Q0loiMFDLM9YoF9dI+YquovNWQg9IKCPsKi+xU65ev74= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR10MB6357 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-02_10,2023-03-02_02,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=999 phishscore=0 bulkscore=0 spamscore=0 suspectscore=0 adultscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303020146 X-Proofpoint-GUID: pZwDn_-T_ltIMFrnhgkTyfbtLkxn5jFo X-Proofpoint-ORIG-GUID: pZwDn_-T_ltIMFrnhgkTyfbtLkxn5jFo Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org The kernel test robot reports undefined reference to public_key_verify_signature when CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not defined. Create a static version in this case and return -EINVAL. Fixes: db6c43bd2132 ("crypto: KEYS: convert public key and digsig asym to the akcipher api") Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Petr Vorel --- include/crypto/public_key.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index 68f7aa2a7e55..6d61695e1cde 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -80,7 +80,16 @@ extern int create_signature(struct kernel_pkey_params *, const void *, void *); extern int verify_signature(const struct key *, const struct public_key_signature *); +#if IS_REACHABLE(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) int public_key_verify_signature(const struct public_key *pkey, const struct public_key_signature *sig); +#else +static inline +int public_key_verify_signature(const struct public_key *pkey, + const struct public_key_signature *sig) +{ + return -EINVAL; +} +#endif #endif /* _LINUX_PUBLIC_KEY_H */ From patchwork Thu Mar 2 16:46:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 658235 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20889C678D4 for ; Thu, 2 Mar 2023 16:47:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230097AbjCBQrj (ORCPT ); Thu, 2 Mar 2023 11:47:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230064AbjCBQrg (ORCPT ); Thu, 2 Mar 2023 11:47:36 -0500 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 71703497C0; Thu, 2 Mar 2023 08:47:28 -0800 (PST) Received: from pps.filterd (m0333520.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 322FDtvX014359; Thu, 2 Mar 2023 16:46:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2022-7-12; bh=cAQFlTExmc++UK7mNtjwpUj5omxprR8upvNl8wEq/GU=; b=a3rDgUfHr+TMTCK6vinBkUYrQXE8pDjXK6P+0GHXn692u21ZaEGnHzJlMS3GSKa2vHxG QN//RxPqwDwGq0nRu4bo8pPct7+hU+FQuENwdtYGgg5apJ5JPlAoPkhN/ri0BOWVacNm FLZ7GMpLYgPysyvMOlR1NEhJjxKl8Dm+TnthKdcoDVYxpBIIuleHW1bg0ShS08hpPxqu 7B14eq4/6V84rW69pu4HRDTRMNlJTXz76Jqmif5oLGtgdkDHH32haCtQI6EZOsOBwg6o qHFzPm3yZeYTLyIvzHjzV1g2AtcLO/tSO2a/RJO3jq9U5Yq40pX1ftPIm3cYpn+/oNSQ Hw== Received: from iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta02.appoci.oracle.com [147.154.18.20]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3nyba2cfpe-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:46:57 +0000 Received: from pps.filterd (iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 322FWLhl031228; Thu, 2 Mar 2023 16:46:56 GMT Received: from nam12-bn8-obe.outbound.protection.outlook.com (mail-bn8nam12lp2177.outbound.protection.outlook.com [104.47.55.177]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3ny8sh4g08-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:46:56 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BRc1yj41o28BoyS8B0gdWCC9BcVF60nK/NltUosGfkgPOXekMc58VBLZI7qNsjds0SR9vKuzAIDwd+GjtazUPMcusyp9gnH7kY53mZ64fGgccMVAU3vyNWe/uCGSaMldGkV163nnfkDqP2kJlh1+PbSoFVoV7sdCFRSjm4rZ2mJTFcn1hGA3oVfKoy0wzuF2B3o9ZGvd1lCWTz6sFRxHkBV4NZm8cQkDbCYHFb4abqNnVw2HjZI4VCqsEW9kF5NMQSHvDb9585yHxuTXPCaPAqL1f//NYUmmWfv6c6d/DAIhMuwhui7fXsNRf7hj/Dzur4CRQZdkP3s8EvS1RVkFSQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cAQFlTExmc++UK7mNtjwpUj5omxprR8upvNl8wEq/GU=; b=L8XGycO2A2yq52ShwhsecTcw/Q0kJYzskdb4H8TqUYxuZvxvxfZbsy9MNaUki0UsfPPzktrCGIS97LBehHhrmsQdfpLl66iD/+2izgD7L5QeXSSHmrgD7RATSKICtx7SZoRzrxrgy/fWGIfZ6Sfe3hYX56lCV4RKvX/4rZQKICcjn2bQeLsCnFZEMAufQ+XNAe/q+AKBJ+QR9F5gpXjZ0d2DtaqcZZDvdua9gDJ6qDo8gx3BZrlyBD5MY4KqMKsRKMv1u6+atjKrDTZ5ebxAazlatMqwvHlcXPN0nh8woMyTUzQ0m4fTBZP/vEH++g/awaTdwsSP/COsjZzxNsHpqQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cAQFlTExmc++UK7mNtjwpUj5omxprR8upvNl8wEq/GU=; b=UYEcAGnDQbi8lhApMmdX+9s5E1Dj6WS851KiaK1sE7GCD7rbQ38qZpoHMeqptOeJ+5lXKnl89f5rXhvE+1WVz+EoLwwtIKYU4+OQOIyh6skxxOtTsIU28T793/lXAb5p/rFaIs3VAmfMhwQpyRT880GC75NaIERw7kr8YhBztUE= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by PH8PR10MB6357.namprd10.prod.outlook.com (2603:10b6:510:1bc::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.16; Thu, 2 Mar 2023 16:46:54 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb%3]) with mapi id 15.20.6156.019; Thu, 2 Mar 2023 16:46:54 +0000 From: Eric Snowberg To: jarkko@kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org Cc: herbert@gondor.apana.org.au, davem@davemloft.net, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, pvorel@suse.cz, eric.snowberg@oracle.com, kanth.ghatraju@oracle.com, konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com, coxu@redhat.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v5 2/6] KEYS: Add missing function documentation Date: Thu, 2 Mar 2023 11:46:48 -0500 Message-Id: <20230302164652.83571-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20230302164652.83571-1-eric.snowberg@oracle.com> References: <20230302164652.83571-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BY5PR17CA0065.namprd17.prod.outlook.com (2603:10b6:a03:167::42) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|PH8PR10MB6357:EE_ X-MS-Office365-Filtering-Correlation-Id: 09b5229e-f4eb-41d2-2da3-08db1b3dbaa3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: OWer0xXn8SoguGJjxcFigHTN272YKiWiWxZOqLmVVTtYmqYUwfYM71wRDp0SMLxDKxGz7Kw5OG+5ZT1BaiMj+ejO2U8oris7bbX86Vsd71K1xTuYPNJmspdXXh3Iv0wraDZfVTzcKFxaGiBLr8tV29YyElDjbN0uDMFVsN7iqXbV7LOe9x1wRt31H4rWWJo2P0vpfRQ7qDPbCPpfyuvy0CyVb7pZiDgoLOZWvNG9s0OXNrJ2RxjkrHvvmxW790PMjoW10FZykZi7wR+DvwDxpScXKLeT/hBO7zeoOf69e0cITXSafVzIC8LRmWFRgwbXPiLa7G8PhUP2OLy9H8s+GQmZ3hjYo7knMr6TrNRZpvzf2rIf15MO2mAGnpaQDk/TYHFLOGnmz716K+s42C9OPIVfdJBxOAaZZVTn7jNyK9+yCYd6pzoyDC5GE161BxHl6+R9RHTlX0E2f+HhtMkigNnRvOZ/Hea9ZDcQEBRdLtCZb+PhwxS/Y5t/w+aGvXgb1nWq06j5JnCLZLoZ5Mtn2PknRSWOoEeIOfRS+j5ePwLx33MFUAw2gL98BVY+ASGZuULVMLLZ54+q48hvpef6xRQWwLWG3dH5vUEMrwehSgZBpd4YtNHIyWbUpuixPq9ZKnuObriwon2rR7qe4KhrOQ== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230025)(366004)(376002)(136003)(39860400002)(346002)(396003)(451199018)(4326008)(38100700002)(86362001)(36756003)(6666004)(44832011)(2906002)(8936002)(66476007)(66556008)(66946007)(5660300002)(41300700001)(7416002)(8676002)(6506007)(186003)(1076003)(6512007)(2616005)(83380400001)(316002)(478600001)(6486002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 5psdT5f7CJu+//7ePk08DLxcLC506tvFtVFM6/9y5zlxtIW4EnQBW/TJ6NTUZMPshkWnsfVEfSTb7eNabemOuk7USLem+yxg1yivQjMI5+3x/fsAupFh0Z2nztWiqMqatk64yTc5ZOYX2rm8hGTdyYNmr9JU8r6e3+SYNZWCzt79Xez4xkgDWQ07qKG9J/lxJgVnUbzryaC4CWB3Ts+mtZN0V8twVz2PjY6anGWK2WfyQNbzbXfd3M8G3yr7TBoOtacM8PuLPotQ3D334aqqSUlkvj2f3HT/y8WcecjEwSaH7jijrr94pxsJbtxkXNGQy6JDGLRB+Ue9rg9+jvcqvHnJU3TPdHvvHlvzl8UCDQ/YOldb1R6pBJUMn4P7VBZHXEcPQP8ivYpc7KS+tgRbVFeU3rJBPZkTIAeYuQJzisWRyM6Cn/THjf7OPiom+rdq+Hiz4cETLgIVSwmwXFFSWsyTOctbcqpKFAvemKsa6lxRjTNiZGL2XsM+w54knJ72p6D1OBRXRGkP5SP7fDOY3fg4seutkQDZC/mpjCZkz3voF45Cn6X3zrWX+jBpLr3vaUiZthMXal6QOSPnm5624bFkQ59g+I230E0q+Pau8k+D8rBSVGf/PXacuMEa+daxT1CGLx3XcqPz3fm5vJoHrjAV/LEQ7r69aDdEz6ugA4MGoLZm3T74+tEDYEkaWlMmb3ClVCQHQXw+S72ZsW9b0ZEDsO7/p0QlKWVlbc/iZlLLw2+5nfcRan0ZHD+tTonqxnptiqXqxyzk+5GCwQgyqCz8E4M4ZfDSFCBPV/WyIG5og7J86t6E2yVi0Qmrkfjf2QoYz9zo24PaR2L0GGcvnE6qMrsxGWNdWj9J5EJL36U13s00/ZCdjjWp7k5zNh2Do4qIxWXwZPwBKkV9WNnx+wmuo2FpCZ2804qthIvZ0BNbgXQibBIsuMZc4rnArOP4uzkP/+j+6FX+z3VHGwmMwCjLbplZfFI+31sBw9GqzBXvQx8rsSE6OVDmobov7P7nLo9Bkc9uv1vwit7bMyDCSh7RYgs6u+YbZ6mC0AmCMmVg7U1RWPARNB4946bzd17FYv5Tcas4AqjWtWt2OVKSGLCBDgwVfrVVFEF4SnBc709WjB4TZlU4R0IYybL6nuryEUXmjTixCzmyXVhpJQRC+GnSbOhZraIolQJwYeII9ElMb8PC4ZJPy/+SFc7ekuCG5GBN/f/1BG8eAsQr2lEpN8o6cCTS+4ulwe6907iqkSwiYKm/ajt1QIx1XaS7Eaj1IJGp9ixX9ns9Q00SQMG4DrE7+3qH9VDN+kEw0SJT/mTG2JmNcrfGfa7HfihKV/hg5lVOpT13IMmc0t/Zc5g+rXMoms/JQfu9EYDrdcdaPJny6c3NY3ZAZ5VcSf27+40QNp7aeohYxjI5JcFyrDq3e22RdfoRvSxYQMZW1FQTyRErrzg04RaQT18TMvBOoK9N7xRXqIHHJ7xV4uPyyqRmlkuYsAxDgHdz10s32FKbrDmnNVu2qRbjUjRwdFzwcP86RtEfUPqlw4AcXkmhx+sisdEu/Swz6PYw5wD/XKvu0zI/W3LqKocTAwOpifxBdPSLPaYe+D64G3st2rKkwS0BJmLHrPkiRcaUHX+4PyTghY0= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: TcEbQqAhBSMVzuXDQrOM3nYs3hrYNg1sRfWivjcCenycNUL0eAoPnik7vG7M+6lBzLGIFtEKveWRJIrNHgKhwLjVMMDfvaUn4kizSLkdFlv63bHpLluWVTt4JOVKTNhuZwNL2NTBct7p18LIw06ic+fGi9kOT/ik6QCWTfBmX/Xxv/o++V0Sr3HxFq22dw6Xdbwuc+Uw1hyRPIk9QL8uG0LmUkQ3cH2odCYzOOwadTFrM1EzgJNUssdF2x7Ht8Cpp2t25cMHTxR3PMgvK8dcWxWgrN8MgsR8/RnJc9Efeh+kK2Aasm82/T41cbP7/bAcybvu2ZN8J2rmfh1/jp2LnhB+qUTribSmkJr6TyrPeE25RHkfYWvTOXjwwcuqTgS9f7B0ptEqHmqXbL0EQ4kjdv0sRFGfYDIbTNLsKd0KtoZkeY80CDBm3UvPpvnJDpuoTdHm0dL7GfpTP7wrdttUQBGUCrgzYChO/Y9cc18DEkDumkAAdeSUNB7Yv83Wuxex3QibMiekMPm7lWgE4dfeGHhDA9fjQv14Yi6Y4nG66mvAmMO/xgPriP0QhZuTkbCvBlD+5dRRzPrk+r++SFzZAPwjHXWiN19/PcEJ+FOjBbLgFNfB6/QbX5fpA89hbZcLnBTgrY0h35rWPXYhGUcnB9Wgr0XO1lw9fH3+GQvu3PRUmVd/I5rGzSUcvGRZODY7yDMxzPmQCgUF7TkT1yr0aaUyR9DtD7Sg7iO9cKI4XxBfpqPV/9xt6WKGSMvkhk5KXVE2E5vwtVGp04wFGgCUpN3Obhd0VWpL6SsTnm5neCi+CBJEzeWDVX17vGbhcJojs1BIHQK8lm1NmTZFpzRM9SXPOJkL5FiJfm6dKHfvjqi/hoGbX1VlNVllPrBZfqNWsuKVKasKgnC6lhIzY0rJYsgd+uRixK7qwhSH0N9F/GpTjZbxmjoFbdqyfb4HoS/9cWUNU1MhuaZCgRmxXMKKu5jftHVPGL+0ygb+eh6H3mKeo7JNB9R7g8hyu3tqgAs1RObi69HCczDRqkcoF78g8wgCXTGFFOXyogUNY+G1L+VuZ2hVr6dKHgS4qIPUsBXswHyvGBMtr5/Dp1ZBBntqI97lbG5ClUIZMySEFZsPs7GLeOlwrGnvpcwuuH5Px43iZx0thS7b51mCxw49hRCnP92b9GcjOWkBFopLvVo811g= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 09b5229e-f4eb-41d2-2da3-08db1b3dbaa3 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2023 16:46:54.2673 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: iQb795H4x9q3Kq3V5YSy/0ZTXXIrcJ5p1cqMj7rVY5ho2v09ZI/yCjlcVycN4steCv2ZJn1A4Vj/aEYKb6fyExzop87BC+VGWYcqi4lAmN0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR10MB6357 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-02_10,2023-03-02_02,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxlogscore=999 mlxscore=0 adultscore=0 bulkscore=0 malwarescore=0 phishscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303020146 X-Proofpoint-GUID: pQ332Ev7yNZ5sgl76UKGJB9auOR-6hjw X-Proofpoint-ORIG-GUID: pQ332Ev7yNZ5sgl76UKGJB9auOR-6hjw Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Compiling with 'W=1' results in warnings that 'Function parameter or member not described' Add the missing parameters for restrict_link_by_builtin_and_secondary_trusted and restrict_link_to_builtin_trusted. Use /* instead of /** for get_builtin_and_secondary_restriction, since it is a static function. Fix wrong function name restrict_link_to_builtin_trusted. Fixes: d3bfe84129f6 ("certs: Add a secondary system keyring that can be added to dynamically") Signed-off-by: Eric Snowberg Reviewed-by: Petr Vorel Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen --- certs/system_keyring.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 5042cc54fa5e..a7a49b17ceb1 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -33,7 +33,11 @@ extern __initconst const unsigned long system_certificate_list_size; extern __initconst const unsigned long module_cert_size; /** - * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA + * restrict_link_by_builtin_trusted - Restrict keyring addition by built-in CA + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @restriction_key: A ring of keys that can be used to vouch for the new cert. * * Restrict the addition of keys into a keyring based on the key-to-be-added * being vouched for by a key in the built in system keyring. @@ -50,7 +54,11 @@ int restrict_link_by_builtin_trusted(struct key *dest_keyring, #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING /** * restrict_link_by_builtin_and_secondary_trusted - Restrict keyring - * addition by both builtin and secondary keyrings + * addition by both built-in and secondary keyrings. + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @restrict_key: A ring of keys that can be used to vouch for the new cert. * * Restrict the addition of keys into a keyring based on the key-to-be-added * being vouched for by a key in either the built-in or the secondary system @@ -75,7 +83,7 @@ int restrict_link_by_builtin_and_secondary_trusted( secondary_trusted_keys); } -/** +/* * Allocate a struct key_restriction for the "builtin and secondary trust" * keyring. Only for use in system_trusted_keyring_init(). */ From patchwork Thu Mar 2 16:46:49 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 658234 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3CDE5C83005 for ; Thu, 2 Mar 2023 16:47:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230079AbjCBQrn (ORCPT ); Thu, 2 Mar 2023 11:47:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230070AbjCBQrg (ORCPT ); Thu, 2 Mar 2023 11:47:36 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 32DC34AFFE; Thu, 2 Mar 2023 08:47:29 -0800 (PST) Received: from pps.filterd (m0333521.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 322FCmhg028183; Thu, 2 Mar 2023 16:47:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2022-7-12; bh=ds3EDTffAzMh8JEz+W8FxnAH9vvZstp6bSSlX0uMyow=; b=m7K1RJRi99TYbSaLE/8j3fKo6yjHAc8VEr8ug3jDKW0LzcSi5mm9QF4MtuLGfQIHBcaG 2YQ1LrsTdFoa4i0twn4zvLUhKVZhSI5cGrT8b4BmX8wNJSF2UzmS+o9O6KzQcmH2WwI9 n9M8dJvtKN6siAkdsgiTzdE5r9bJcPEK+lnj/ueJgr1U/t320uvDI8JkO2DeDJ0nJQrW ejQQvL1nLCmnDMfvuAH2N/CVDlZxVuryDu5auQWaJL6IpiTji1c1vnTsmqAbxmx/AZ90 AwllWZjS8TyHd2ydW7UEPcsz1Bm/ywjd7xNPGB9xdztCLpuC7rMQ+JNCOHaNsdBC0r5p qw== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3nyb7wvfqf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:47:00 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 322FUguS000581; Thu, 2 Mar 2023 16:46:59 GMT Received: from nam12-dm6-obe.outbound.protection.outlook.com (mail-dm6nam12lp2175.outbound.protection.outlook.com [104.47.59.175]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3ny8sa9sff-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:46:59 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=VVt5Ptxike8Ha7tBmgss839EpFzh9Fzz2LuwHU53ozu+CNq/H2bzePBbIVZv78ynotzIP/htijdwaK/HzltiRME9/ofv0jpgIimPqu5PYiObKte3+shz/gYtslbLAOF3OvTW0//0WxLUCbgvT/iK4TfljJWfW6m/PvzFjesUUYvySY1LyNif7TC7iizGVp83v3PH3eAjJo8WpTqz/c4bwVaJ7SLrAteyRgGZhe9NQ7epxdUgCLqAgQDths5yHp2JSmY0VBwWnfyAm2yWMgYpM8xo/7nMVJTlIa2c0WDoiB4MKwIrpZWOI6OhJlR1Kv/j4sX14GxZbQWS1ccdSUyK2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ds3EDTffAzMh8JEz+W8FxnAH9vvZstp6bSSlX0uMyow=; b=MW8aSDJQo8IqrzF58cJsixzbA+5wxnCbA1pFQOaU45BgPFsYwUb8JdWPwbE6KUTeLCG+5EfuTp/xpAEZ45k4sIdnxdZXgKlqI6eIcWYlEOUYeCZvjAgSk3hYX33Wo+x6YSIicThj7X1wGd4LgK4iDasTo4E3mhaUukkpErUjAC1x2H8yb4VpX1alngC0ydKcTeQglURB8XatKjjJOLaQri2eEFw4KxxGIMp2G4MwAwW7W+GJof+JAoberzS2cBCc/cq13j7+aupyMdoROmAzG/H1h5ykEa5iGkGqqsmVOs6PZjXltYFcEZHygbTfzezIxgbJXj35uH1P4ZQaHL6sjg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ds3EDTffAzMh8JEz+W8FxnAH9vvZstp6bSSlX0uMyow=; b=Cm4iYOE9uyU5NwUM81rKjBCVlYxBgpbmhWULpEhwIW/jlMEj117iUYmB6OXCJ5knpLLJfv7/G108AFwZAS4OWk70wvXzm5t8VXiccYhLT2CG6jX9qKi6b+0AfE5zSsaBCJFeciciUbQ76Rwmlkeg573MTgkwZHcpzzZXEFw6XMA= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by DS7PR10MB5150.namprd10.prod.outlook.com (2603:10b6:5:3a1::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.19; Thu, 2 Mar 2023 16:46:57 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb%3]) with mapi id 15.20.6156.019; Thu, 2 Mar 2023 16:46:57 +0000 From: Eric Snowberg To: jarkko@kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org Cc: herbert@gondor.apana.org.au, davem@davemloft.net, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, pvorel@suse.cz, eric.snowberg@oracle.com, kanth.ghatraju@oracle.com, konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com, coxu@redhat.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v5 3/6] KEYS: X.509: Parse Basic Constraints for CA Date: Thu, 2 Mar 2023 11:46:49 -0500 Message-Id: <20230302164652.83571-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20230302164652.83571-1-eric.snowberg@oracle.com> References: <20230302164652.83571-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SJ0PR03CA0280.namprd03.prod.outlook.com (2603:10b6:a03:39e::15) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|DS7PR10MB5150:EE_ X-MS-Office365-Filtering-Correlation-Id: 4b7999d2-f1d3-46ca-a7d6-08db1b3dbc4b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: NtDH1qtf14yKF5Vg1UXVv66A5o+xRjfM/Dxlzo+tOXRVUloEsrsYw6USfanWbel0P6vprdpnQdSzJ1BPc8s57FXHDPekDkXXinmNMzRUUOsVe/x/jKxuhNjnKLwgYAfhU6fpCO5dUSKEEHkZLS7TmAX9m3bKgRuadz3SKYXrPPfP0zhn0fcoIif6l0MFARxakPv0nAYRQ2FAzHxlmCVN8ezZbqEtSjT86/oJBrSOavIUvqMJ4Hq5nXfunZQMm9KkX2/OdOML6vwkIDbYTVULBytUJUaMq7VQbOionncIHAZ60uPQ9kptBVtta3xLWlUuBUF4yRju8zW1BOzf/vcAUMClM1l2a9QSbtVOXRUvHF60KkXG02qstZiuW4dCHzjYRjK25RsVXmtn78gRxAZmwDefh8Uf8/loJToFwATC9oI3g2WnvO7yEhTtvH8ViBxG+i801oPC8l2P19PYLPBCsSOmoAD/2yMpGfj4qVzCEmBAbRK4DH8yc782zFpgyje0pjWD3SiDMCAbdxxbTI2W1TZAxIDC5XxlNsx9cWiwg+76rjhM/2SW8ayPk4nuDgqTt03dqtfVL/W5LdfWjHn8JKW53YpcJ2rNiKK/U3wDZNqWFTSjJD9o2XORHYkqwi3X X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230025)(39860400002)(396003)(136003)(346002)(376002)(366004)(451199018)(36756003)(86362001)(8676002)(41300700001)(66556008)(66476007)(5660300002)(7416002)(8936002)(4326008)(2906002)(44832011)(38100700002)(966005)(6486002)(316002)(478600001)(6666004)(66946007)(6512007)(1076003)(6506007)(2616005)(186003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: DlZgxoc+SRJQ+sHa8CMa1ptH+dmwnUEMqlwtW39Q4Nw65RI4fvcqByts812PJn0hZT3r8AjJetIMbkPg8YpTkvDGlpvsDlSRqnMRJs28Oc7IPWk9ott3B5MuCdRzhuycTJhMY3ZgJPttSXoKwqFtSdSrAvjZ8A8pPdm36ML/u/a+YlzoEMnVhrou6Uf7wPXiKWfUqq4ULQ0/E4ngspjulTvfe7MJNu3IH8cNFBW2DvtkZswYm7RMuhEOpmObM0cJL8fjmwrE1KBAoujj32481rPjju/klKQ9BY1pmLLhA5tMcJQM4lZe9nboCEBuTQdTevtQoCHZSA2lm/5giQ/SS03B45IFQAuqkPoe5pBfHWTDHcw6atuV00rIX9E9WgWdpFK5u2UfPT2csxGdImxmhfx7iOyr0nu+po1XR6xslX90zP2fZvXbPkLZToJUCfIYVZtvApmaqWQawzMa2vCt8szcygPD9NL5iYrZMzzBT8QC3WUJD+yXn4+38FZkD5qmr3M/hK0wGwEub9pVqWqsCrsqqhFLxY/7S2d20v3AIn/cktQ802W32qhXH4wPsqvdZwxpHOG1LT4qzfThCSU8eqq0o4Q2MTTwHIW56gss/go6S4JvSA9HtT+YUPzuUMfFeOK474jPFE2RTOAjgCBppexyKwdohc3TjXeoRRxC3bE3f/BL05BFxWoSOonOwJeaCpKbheXFUUYerMKaQoKyB7Xf37lal83E9w5+N519RBSAC/3ROU0IOGOO7ILjKr5ROV0tVvhtqSVo+E4yBdUYKjXoAhvxyesK6ti/iPRwHQgQuM1D07ARNts1Bw2gfl6iOd0CHkY0sxSWmw0iCUkhqyWW8mFWJk1xt3O1hABd7lWdlenBJAMF3hzoSoXnHpaUZLr7Hu0fu/3+clhirsDosdFHH7bt39jYR3KUJjAhBBw4K59L799f3Ck6S3qIi8ND8Oc31ZQ3YogyZJXzPhSXNRoUFm4IwfPyZN/LOCJSu7Nu15UOe8VHnvB4G2M6B/sizMlFqlxZL0tyTEg1pwDRRsO5texGKLnK9esSj9svjpUM3ePfE1bxBiiYC3b5mfEk1XP/Rs2Ts/t5n/Nl9K4vPsDQ7DH3RMzFcJoTT4LUMb7h9UTlaQIQEFpeLk+5EAlQBRXzYvS6hkDsUZvlspF6OewXWhUFSN+2sVW6abSzSLVCdRaECYBi6uS1CEYJIbKPFeIxiULawwwIVNnBc/XzSCixFbvpLMYgKF1MyOIKS1yhjZa5qDvFthDs/IMBQaCq6wKZXGuHUSZiBlIYlBbLVgIeLJ0eKnmmRvlDDDevIloN6Dm/O5D/8nbNi+Vd+W8Ar/6uNPBjKZwEJGYLuc82RGbtBafZ1I8VAb8sotsCUE/iIru3nNFEbi14kM0ycQn/sWkf+EzllRVywUUHN4g85GVfDYVNIqIeUsz+oP4gaf7MQvlRCxRa1JzpQj3f1Zf7+WWdaZvY+9jgnMWZYdlg0CBHmP4sNK2/k/MX3IBabttoYr2e1SbVhvT53q0Vsk14J8Fofr7sqIzTyk8NZf5WUShX4Sxe+84zR4ewfC3dR/4BxHH1xyprb+v9ws314AcKOoyLZ45y/CRR9/IqXrARsQTVTDHwPEkEIKPxlOcyrKI= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: jMmgT7Um/c/Awyb64mMHnHcgM5mFN+s2HM31ARHxkJChFv//lR+s4+xyj9EobICiKu2pIwPjn6QYq3BE7612jw3ciVk9eSf/NGEKSzQFgiK5ScFOyGH8mbfIwMJuv+dfrX1X73KW2ynAtRBQaQb2SHd+GQHvbKwJvYrmzMG654BEufqbv6OwT5pQ9eOW8CYLgzf9JAKWgwErYYkF0c7IE8lTywc0qcQ2f+CyihRM3pUaGnU47V7baDDjg2GwvhS+4SWyK2iJhXdjxQNp7tuLh0dSuNfMLvQmAk5BO0mvgyWJgkxAi8Lj+O8poZAT/HKwY9mrpwcBhWkRfdm4m17fXUuUmgjjhaM5f4PzYlIcVthI33wFy0ycmVpHDaGkpu7BXdP8lI7c5LjeLh8u12698WvOR5jhSWKqj8+7C8cMsTN1ylI6GfVxkVPibisFvfEyg9EmPvKj0fZHjN3fZMH1K9+xV1M4YymJlGwDrGlW+sQPHU44pWk5SYW8UNj+tCAr3ADOs65z38sWbMsY3gRTpMnDiEGHHPqrX/Xx6T/SKScDl+f8sk1NDuFX5fp3w7TEFbtpaI9scIrMbMoqKmbra+0uoODpsUTS/oLZLECYKEzVe7Fy/H0iRKPygpb0RzPa8YyjTOdiX91Q9XHQyDGMCvo+0nC9qo9sliB+xdzI8ZXfxTa5dt/+EYcgqL8IRTpbdt5Z8splsjBWvMgI0Q8tI5JY94qNOfCQt0RxmwxPPai4X4xI7p8MS+UsIwCo74mIUwnJQIWogMFitMa2BmaHUux7U0fp2DVA4UyYikEwP8Gt3X9b/qaBT1f3j/ek/tq18Kb+9xTDHuDTM9rbKpcgiCYk6uQJJBjJk+yuxOnvFfZZttXZMy69RO2PCk6TBs+0McFv8q9tZr7saUHd6BgEreNI/wWEFR9D+LcmoWzZK4RnmIplCkie3WZPZwD64ROFIx2NbCWveSIH4Y0MNUDotrQEGnnNyHeY2hsvHMsIAp4r4A5eMKDFT855YNskbmbfF3u1onu66Ltyb50Pzb2H5Hxmxoje6vLCnqk7QiV3wUjqMexS0NmTtdG4ot3dVf2R/zCh32gwQmpl3VjL1J+aaVwEZo6fAr6otYLDe+D0I4p1/FasxsJGHomlzaLY+4821A1fXrfl6f5Z7o0ShoAYcEBK4CG3SGNQT7RGGQfYKvM= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4b7999d2-f1d3-46ca-a7d6-08db1b3dbc4b X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2023 16:46:57.0806 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 4wMRyb66OFQyi70WfzCewRZM0HogrdQENiDawkbArdIFCp1yWAugRmLQn0f4L4PwI4kCj5DvOzhMGI3p6aaOxdpcSrvmya4mpd5ADiCbUCw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5150 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-02_10,2023-03-02_02,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=999 phishscore=0 bulkscore=0 spamscore=0 suspectscore=0 adultscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303020146 X-Proofpoint-GUID: 0qX1nu4vHPoXAgJg-1qMkVj_Xg0j0jkh X-Proofpoint-ORIG-GUID: 0qX1nu4vHPoXAgJg-1qMkVj_Xg0j0jkh Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Parse the X.509 Basic Constraints. The basic constraints extension identifies whether the subject of the certificate is a CA. BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } If the CA is true, store it in the public_key. This will be used in a follow on patch that requires knowing if the public key is a CA. Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9 Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen --- crypto/asymmetric_keys/x509_cert_parser.c | 22 ++++++++++++++++++++++ include/crypto/public_key.h | 2 ++ 2 files changed, 24 insertions(+) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index 7a9b084e2043..77547d4bd94d 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -586,6 +586,28 @@ int x509_process_extension(void *context, size_t hdrlen, return 0; } + if (ctx->last_oid == OID_basicConstraints) { + /* + * Get hold of the basicConstraints + * v[1] is the encoding size + * (Expect 0x2 or greater, making it 1 or more bytes) + * v[2] is the encoding type + * (Expect an ASN1_BOOL for the CA) + * v[3] is the contents of the ASN1_BOOL + * (Expect 1 if the CA is TRUE) + * vlen should match the entire extension size + */ + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) + return -EBADMSG; + if (vlen < 2) + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; + if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; + return 0; + } + return 0; } diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index 6d61695e1cde..c401762850f2 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -28,6 +28,8 @@ struct public_key { bool key_is_private; const char *id_type; const char *pkey_algo; + unsigned long key_eflags; /* key extension flags */ +#define KEY_EFLAG_CA 0 /* set if the CA basic constraints is set */ }; extern void public_key_free(struct public_key *key); From patchwork Thu Mar 2 16:46:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 658857 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42AE5C7EE43 for ; Thu, 2 Mar 2023 16:47:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230119AbjCBQrl (ORCPT ); Thu, 2 Mar 2023 11:47:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230056AbjCBQrg (ORCPT ); Thu, 2 Mar 2023 11:47:36 -0500 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AEF1557D29; Thu, 2 Mar 2023 08:47:28 -0800 (PST) Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 322FE3RJ012480; Thu, 2 Mar 2023 16:47:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2022-7-12; bh=I77HzmKdZaGDrTgNYjcGpGrNW49DZzvHc37sxhVc3Zc=; b=xBn21OE4zw4DlAIhKFHQd1hAAk920KRS2N/LyqlqapgPj+lWMPq4GWdOU54S7DcgxMz2 V4jUhSIVsuBD/Igta7ytRRE8QdvMvCw0MKq0szogQGa8rL9dmp0h+bV2rTKPy8Yun9cf +whIYOGijYf1d4FYFpSUjGxLKbneKB7dSlY7j3tL2GZL9x/BntHQQBznI86wgkf2vO0/ s3zEaa0L/FMivLVb9YeUX03LnE7XWEEOE/n7mp7vFEKfV8+3RhRPKQVc0a7vTvL42h57 qYl73n9IESV0Pi7tAyFOvMHF76sHLSpLiT1gcs0+UiQvA5+4+gjn6Nn/caqDoR09rJRC 7A== Received: from iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta01.appoci.oracle.com [130.35.100.223]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3nyb72m6pq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:47:02 +0000 Received: from pps.filterd (iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 322FVdcG034939; Thu, 2 Mar 2023 16:47:02 GMT Received: from nam12-dm6-obe.outbound.protection.outlook.com (mail-dm6nam12lp2168.outbound.protection.outlook.com [104.47.59.168]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3ny8sgcuwp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:47:02 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fGvR5SX9pp5z3FRTLL/vbc3Xpid7F3hAtx6QredYa2ceOdQZBU5a388pcWi2RwKRzUx2CpDkRTbXddEqi0S1VHn1JO0jRBMcp5VEwpPdthE18zC+cTXgqZ/jOOeFztZtmov1nTySzWMKvZllhrTDG/k0ZrTDMurlyM/q/xUF5jIXjC/05eKxNLhDXdfJytRoqIXXg/KCtkUNFRQSlUcz2QH6eO4JikmvsBxw9bpAgDQCJuEKo4n4BO1HCipKeWuxg17SMpQnSG45R0wIQd7og/p7yuWGgtAk1f/4Ilx6QdbHck4o7zFDa47R3iwzaZsWeE/URPZvNKKA3nn32xB1rQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=I77HzmKdZaGDrTgNYjcGpGrNW49DZzvHc37sxhVc3Zc=; b=l8hHdNCSTrhzDUQBtoMQI67O594qPBiocOA7oaarlv3NfocUiUZPFXi1S76M/VWMYrd2ZxI98gM3C7tuAb8wUMrr/hR7g1isMXxHxHWJUlfNMzCiQj0B+bDb1vjLEa9W2gZ84m2YZJmb+/prkR/8Dmpk2FXgcAXVNwhQm5y+v5VrcPje7f5ErLOb5MG2iQIYPPAAw2Kcc3PWeBwtoSt473SZbsdxMLZft/jwKzXVoXbEtJSt+jG6MB95U4WaeS01N3YKV/Tqm231Np0gZ5w1uAyTAa22ATrGuQMG3R4N6d98O+YtZul66ypnpItMdihK3EAq3q3v0nJCkr31SRRAuw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I77HzmKdZaGDrTgNYjcGpGrNW49DZzvHc37sxhVc3Zc=; b=y4iQULa20sluVe4sDKFtNwqE6qQwSeelIV+xn2Pr2lXd2YNrLUIGx5/KljO4B4/zJj8IWt/ctyjMIwZqcxyXJwXNc3CKmsgUQF8Pauev0N+NOGg3y6ykvjvxMSI8rRe94d/2Z61va9m9wW6FSWEQRflq2xNujyegrvx9CXWpGkQ= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by DS7PR10MB5150.namprd10.prod.outlook.com (2603:10b6:5:3a1::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.19; Thu, 2 Mar 2023 16:47:00 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb%3]) with mapi id 15.20.6156.019; Thu, 2 Mar 2023 16:47:00 +0000 From: Eric Snowberg To: jarkko@kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org Cc: herbert@gondor.apana.org.au, davem@davemloft.net, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, pvorel@suse.cz, eric.snowberg@oracle.com, kanth.ghatraju@oracle.com, konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com, coxu@redhat.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v5 4/6] KEYS: X.509: Parse Key Usage Date: Thu, 2 Mar 2023 11:46:50 -0500 Message-Id: <20230302164652.83571-5-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20230302164652.83571-1-eric.snowberg@oracle.com> References: <20230302164652.83571-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BYAPR02CA0066.namprd02.prod.outlook.com (2603:10b6:a03:54::43) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|DS7PR10MB5150:EE_ X-MS-Office365-Filtering-Correlation-Id: 3d60e4c4-b978-4c6e-f629-08db1b3dbe1e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: sLJ2vdjJW4H204Gsf9WrMAdAcDUP/yOHzg03nKQ6BA4FQGc4qn3qh/LCt/yKqILxhSYzjgWD2tFrzwMPHHDzCO4V+VpW1QycYzovhqgVYTACamZu0BvpcNbFCHWsneqNRkwD7MRYGWPWIFuxdUSz8MJ/BAY4Co6R/UR4zejP23th8WT5MIblgWM5pPlLiutiFam9WzeXNBuPtzWa9AqIPU0Qs6viAXxjghON9dHntP/30cw8118bjX/0bUyhpVluN2IAqwzmSEdf1Zt9++aw5+ED/FYTI1PvH1rle92TwcPbmR2OmZS9qTcjto7YvP5bDiwbCsPAEckXEp/p9QzfLQN/k+Wb3encOQsNOjINXaYMoA6D6p/pUGdolnoxB6fhZ+XsiEVIccnFC/pN6IaJ6d/NCRfIL8SHt5m7bUQ8kyPTSKyMvDx5JpXhPk+elipnlrUaXCHVQqYr+FWnQ8dI2L/0ZEBLuRV+rX5+oUM28GRkSCGQJf3NNGpKzyzhUaaGbgHpmY5SU2yTf88VRjR48S0B6m+K/O6mjpWxNYztd4RrY4JLYN2TPaCBbRFAh2euHGYTR8Kxyl3jYEyVr9jhb7rt2Cs3plvD23gGA9TI+flmfPCiZHjQU4HKkkqIsvxk X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230025)(39860400002)(396003)(136003)(346002)(376002)(366004)(451199018)(36756003)(86362001)(8676002)(41300700001)(66556008)(66476007)(5660300002)(7416002)(8936002)(4326008)(2906002)(44832011)(38100700002)(966005)(6486002)(316002)(478600001)(6666004)(66946007)(6512007)(1076003)(6506007)(2616005)(186003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: E6q5Pz4W4Ys5iN7F+rNSPsU0OJDp5dx/Wi0866C2K0JAZIXMBqAZTs5map+URkGyrxsrkpaLqRLrAKmZUrxYbE1VnVCfTn7H1I1xrihqnIQxh9r+xQIy4zh/jhD4NeS0lL7aukB4uzbR0v0ADX4LpLyZ84GPIJl+/oQdWS5UEsFPjUuIKkKp5FgY7tOX/vrLnfIbv6/RRAaq97imDOYbnru6+82jOfV+lDUDhU1o0vSmmHAqTui4JNAj+jrlyF2GmLtokMmLd9ufNbdLcq8qV3CIczlgANCjGmdtSuaN0CXC5J+KJXiF5PEY9mo8KbjZMb1kOhclgKaw2JQkcokNhCn0TU6mX6FJgMm7AOKwZuUFJCNEzBpoZlGgcVzpSf+n3EReWMWXM/aa04yJuzPvBnYrs6VftuaIT7LB0hksfM+OmLV/xy4SxuSNmKx0PIKo+vFrlrnUAvtXBfETo6d8YPW0FD0ZLvPcarKaSRKUURCs6MKd9cFtP6VEiugOqWaCFe0tadAMg0DsHxWpP2zF6LZf1EhaulZxd86p73IMRkUD0cfw2+g9UL/4y5EHGNuSxAbFaV2ZGxSnVZ7s4OfzcSnSt2Ag0GFkQ/ON11ErPOteiw9dMS4rLLTQR0pMs9l7fIdif2r4ZsEpMFzsNXZai/nlV3aSzbpcl+h2HuWUL5VLJaqZNj8jxNb6UxRi9VYv0otLzv/8Xvj6oGMdvd7+Xz5QeIzz0GRt2REmLL0ulMoC1XpK5z1v0Qwfyeh08rNaMCuXDNRHX54Wgj79qrKKHD73MQeqOZLWg3tDRf3i7cy+TRHlu1pDhHkwWsGuAbjXucHuyUfE3bya4Wic9I+5zYg5HnHSEficbvpHXBQLzB1utds0Z1JEO/u1XvWD39wK1BBFLQwq1Tc6g6zAmL1moXzZLMhQXxk0m5+2CFXLbLygeTBZ0+TZpknlduDE7oW7Jk3jrwLwHZGP1Zw3OEjibTUVYJIYnAZe47Ql0twv5xoKwx8MvKXqI3ZkcRNeNoghSpt3E6phunYe206BtAcU6OuxBajn+7JwG5056maesWcTQ0ze/PMKg6vDJAuF2itWjC7WQ2II8eWOROSIOWoYvCOlIuhiSA5eto77+BU38j9DuS1DxyQFs1a5sFIhQJdvSUe+mdnKwgJBGxaRoa+72utK6Bq+8Hp3Ghm4lLvgYzZsFjw5nhs4AKRs7kenhyF2n1CRxGFL8HVWgLOKBEt1il2hc7r+ijYl3S9B0wvgnoNvkIDsHRCtsovMvOw5Qdu7stDCxEX+T2DndoXihgZBFnsQXme1AdS9YMVzIjy/lGOC1g3z7BB/B9u+Sn8eChRPm9Bv5Tes260ghU2+/I7CDrYhFiq4T6HCHm/J/0F5Nj6UcBZ5aJbTunr3WKBS20AYlHODK95CosEgjtKpsjHArbvOF561v5R3ociS+y4joE4J1Bd52BDpaCsLIYIHJZl90M/eBOvYsCECx29FtawLacHlReYvyGOM07Gl31887TvMDhSu/E+F5oxDtZjGzGzHYvpS64Qt/lxuOddizhM5GX1PNMuB7xys1G2Z0VvYhs85dgvlmf3logRTxMFU2j03VQHCr7p8BrMpjs8JVsUV04msnZjLl8EauraLsye9/lA= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 8izzVg+eSWOEG9w1V7oGcTyYTW7zhY4tzYlwkBsEKSUSbj5BIemx3oGRbcnXyin/RzU0DXTz9gMv9xW/fXo9i8FfRkTiuqIr8qufztjbNr2nH1bXM+MPx/jZAvTXRZyS3GfIizT9VTIsL6yKEGNdZ6uRV39L2ghPAF8qObRZgNB/loVdzVxF0V6iXZDaBA3DKLbt/RCKbcplF5S8/Ez9sb50PsIcHqVUYLS+5XouAVDdiafZqH1n/OjF1oB7Z/EHrsrcRj/wpPdp/FPkWd0qwZ0HiP+aU3WgSK8bCdMrew7iDC2gqW7NoLe/z6G6WhytNDke74Xof26qJHeUpHwrGibxH9fCWCBu44EfsIsKDrBZ9AzAzl209k5v0PyMDx0zin1ug7nVG5ZRQ5NAxC3L+eSP1B0Ea9inB1dCC1aNVikHxJA6bL3gIXeqZnzUz73JnjtIeup0Gma//8we9DcwfwN+ZYi/tv4sEeJL7fRjZkrB8APzokGR3hpkQJz2PntO9OfNwAzcpbCbEeJvNFxYGJOB0zkXQDhaLffIr/1dTKd09s1H2Jyux4DN2BOtave7tH18VOxbfLp9atDIFmvMbrRnGpa8sRl3a//uhGOpXgdjAyZlrwN22zv/XQ8sflwseOAtT2vL1kS4QkO2lNtPVhLF55TjtGtq8Y9QyXgFaD9f4pxAm06r5APwRyWbQ2swXXl4eC4SX812SQdDZ0ChHMsuYXE9jORy4TgH/+gRbJwlXvso+DxIlmpDk2XLrN2HM8+dvZ7QDu5fTgkCj2TKITLdEIqXx6rR8QWMRquul8vjFauWJagYxEgO4Bi3S/4WDErR4mYCZsQRp+JaSwq/VL+PGJRUnoVuD4HF3oPguXLmawk9VIrwPbC8RJhQLx7mzZ5rkjlUT4F9MrDqMh7jKj6Bbl2/R4E7c+VP3VhGHnn0quo0m+YVQafReDA9EN5s+DOp84W/J7b5tPfNcikHa+YM3fJ4pJoy2P3mmTg4HfsQpNZE02d7jvZDTaD3m6Euluc3I4XNBd83KNoNNb6dV6V1HMvLkAxwCc+nID59IFNH5i8VuoxtI6vRi7BSHs6tG9NxVGIxUX9QgLEdS03j8x0WC5YjlGE4u52sgPSAwRjfcHQ24mgKaEE+nUsPlp6jbHGQ2d8os2Hcdj267vjg0KgpPjprQvNERxbz7w+66Nk= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3d60e4c4-b978-4c6e-f629-08db1b3dbe1e X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2023 16:47:00.2227 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ErDQyfdtPnkw5mRrOc9Jte6m02yeIOWkV9grgx/VTpZlptC+QSLHmapYUB9XGx6/2N/PykMy2x8NjEBr6ijiUgMXS5WPyZzEW3sjyZh4mmM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5150 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-02_10,2023-03-02_02,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 mlxscore=0 suspectscore=0 spamscore=0 adultscore=0 phishscore=0 malwarescore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303020146 X-Proofpoint-ORIG-GUID: nuGtegfKy1-jtaRp7kvnrKxZSrX49jw9 X-Proofpoint-GUID: nuGtegfKy1-jtaRp7kvnrKxZSrX49jw9 Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Parse the X.509 Key Usage. The key usage extension defines the purpose of the key contained in the certificate. id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } KeyUsage ::= BIT STRING { digitalSignature (0), contentCommitment (1), keyEncipherment (2), dataEncipherment (3), keyAgreement (4), keyCertSign (5), cRLSign (6), encipherOnly (7), decipherOnly (8) } If the keyCertSign or digitalSignature is set, store it in the public_key structure. Having the purpose of the key being stored during parsing, allows enforcement on the usage field in the future. This will be used in a follow on patch that requires knowing the certificate key usage type. Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3 Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- crypto/asymmetric_keys/x509_cert_parser.c | 28 +++++++++++++++++++++++ include/crypto/public_key.h | 2 ++ 2 files changed, 30 insertions(+) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index 77547d4bd94d..0a7049b470c1 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -579,6 +579,34 @@ int x509_process_extension(void *context, size_t hdrlen, return 0; } + if (ctx->last_oid == OID_keyUsage) { + /* + * Get hold of the keyUsage bit string + * v[1] is the encoding size + * (Expect either 0x02 or 0x03, making it 1 or 2 bytes) + * v[2] is the number of unused bits in the bit string + * (If >= 3 keyCertSign is missing when v[1] = 0x02) + * v[3] and possibly v[4] contain the bit string + * + * From RFC 5280 4.2.1.3: + * 0x04 is where keyCertSign lands in this bit string + * 0x80 is where digitalSignature lands in this bit string + */ + if (v[0] != ASN1_BTS) + return -EBADMSG; + if (vlen < 4) + return -EBADMSG; + if (v[2] >= 8) + return -EBADMSG; + if (v[3] & 0x80) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_DIGITALSIG; + if (v[1] == 0x02 && v[2] <= 2 && (v[3] & 0x04)) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_KEYCERTSIGN; + else if (vlen > 4 && v[1] == 0x03 && (v[3] & 0x04)) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_KEYCERTSIGN; + return 0; + } + if (ctx->last_oid == OID_authorityKeyIdentifier) { /* Get hold of the CA key fingerprint */ ctx->raw_akid = v; diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index c401762850f2..03c3fb990d59 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -30,6 +30,8 @@ struct public_key { const char *pkey_algo; unsigned long key_eflags; /* key extension flags */ #define KEY_EFLAG_CA 0 /* set if the CA basic constraints is set */ +#define KEY_EFLAG_DIGITALSIG 1 /* set if the digitalSignature usage is set */ +#define KEY_EFLAG_KEYCERTSIGN 2 /* set if the keyCertSign usage is set */ }; extern void public_key_free(struct public_key *key); From patchwork Thu Mar 2 16:46:51 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 658855 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 641AEC83003 for ; Thu, 2 Mar 2023 16:47:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230164AbjCBQrr (ORCPT ); Thu, 2 Mar 2023 11:47:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56000 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230075AbjCBQrg (ORCPT ); Thu, 2 Mar 2023 11:47:36 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 81A5F57D2B; Thu, 2 Mar 2023 08:47:29 -0800 (PST) Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 322FCifF006148; Thu, 2 Mar 2023 16:47:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2022-7-12; bh=HLaUN75QrwKILjjgmQMqceZ0QkdpkJ8Mw62vwbcq+mQ=; b=jy0sfO7lph/yWW83gIkYpS6UReky9JCascI0gdjvpOCgA93OdDI6pnl2iUFxXX7wxBA/ 1zhVxLAoZS7HctaUfp5poDB13ChU0eZT2C5baJuvcof7jBxeyzJZ54qcaC10exuFPZvM INPtweHiq2qwgEn9+55TwLpR6VuFedHmZBLv50Y/cCO4tELyF1zAUhbcPBOcFT7sJQNB x4ROIKy5b82GtPPlhTz7uLCZRe8iOKcbwZi4ibHYNT/n6lazn5ApMq4Lnd2RfI1AAZvx QEZcsbheSJ26qeDt8wbcrwt7jBVl6c02Wvy0sv7kQ7xSIHQnkRU/p6LSPKR4Ws8w0wMd Ug== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3nyb9amd7j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:47:06 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 322FYCOk000609; Thu, 2 Mar 2023 16:47:06 GMT Received: from nam12-bn8-obe.outbound.protection.outlook.com (mail-bn8nam12lp2173.outbound.protection.outlook.com [104.47.55.173]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3ny8sa9snb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:47:06 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WeGaCrz7d21Nf50S9Kbzv8b2Gn9NXgsA2OOdbLUd9pv5ADafEOvubgm56f1zRV86kLkMXgA2LfgUVI5lT41eevjfoYnfwtx5slao5/Ejoe3OIowso0GDf+BuX+gSzKeIfbkHODIVDq1hD6OgnVHkPeYH7BqVdXEIBWoZCqZ3XhyfwOD1xlRDNIQNLTl2U2a28Cbk4L7WnFojv/TftoQscrJGyPl/xb1FpEe7TE4HGGHVNNukyRUFINToePygo300vPtLnL9ArDa3eyd+9CaAOsIxdEYHizxs5PMBL8urGyrKtABjQEW1S8U3XP10pP8//LHCcDyIb3F2a7OWnGi3FA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HLaUN75QrwKILjjgmQMqceZ0QkdpkJ8Mw62vwbcq+mQ=; b=f02KV+Qa1M/Y0yexDRt6ZD5lGwq5KEHAKdswWBc7wtfSHO1DDUA+fz63I7B2UFG4VGDXwSF+/PY7QHYRguntbVUxFboYA9abynziOPS6aQ6TavkzGUZ9GmkJTLAGSNZSQwE8qeqzteFypk+G7yusjlbaKIPH/PEbcBA/A66uU7GLbznowHveP7pGp+hhQ/1VXKCMAxIKslSh5FHiMQAGV1SycJ3/TY4mnq2Q4ybPsOa70i7vZ+Aop+iD7HQDyeQ//VzpFQnMriapAmligNolzvsd6z0IGudeQGX1PuoO87+Fp7LdsZpOs9FMmpLEMpJnFBZbQ1w56ABTQLuVE98z1g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HLaUN75QrwKILjjgmQMqceZ0QkdpkJ8Mw62vwbcq+mQ=; b=CE3HgjqhejQLiqLTdKYfy/Dx4octX2hofWZbkDAFQF0t7yH2GvgyW/asYOSoK6RAm/lT4yitGInR3gpe2d6iBBNLycEj0TKz6RSab2BicGG4etzfc2Wm2QCZxc9AGiGO3NxRGymJXQq+RuqiNl3js7ueiopu8jmzfMgXbx84kMM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by DS7PR10MB5150.namprd10.prod.outlook.com (2603:10b6:5:3a1::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.19; Thu, 2 Mar 2023 16:47:03 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb%3]) with mapi id 15.20.6156.019; Thu, 2 Mar 2023 16:47:03 +0000 From: Eric Snowberg To: jarkko@kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org Cc: herbert@gondor.apana.org.au, davem@davemloft.net, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, pvorel@suse.cz, eric.snowberg@oracle.com, kanth.ghatraju@oracle.com, konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com, coxu@redhat.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v5 5/6] KEYS: CA link restriction Date: Thu, 2 Mar 2023 11:46:51 -0500 Message-Id: <20230302164652.83571-6-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20230302164652.83571-1-eric.snowberg@oracle.com> References: <20230302164652.83571-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BYAPR08CA0042.namprd08.prod.outlook.com (2603:10b6:a03:117::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|DS7PR10MB5150:EE_ X-MS-Office365-Filtering-Correlation-Id: 0fa2a518-ead7-4b4b-fa92-08db1b3dc021 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: zQXLi9mWm70QPgQKGXFOzANODnGM0pdpnXEW9tCN41IrHLxsMMqkccOvA0ZcHy6zb8oeoWzBqam4KXmXg03X98M13tUBFtyazWLfdwdZSW3Ib2M51ldDbVsoHbNzKp8g0Nrb8did3w6hHghzhlsBzOlbD+xCeFCmBcdOXdLrcCj1RT9XavV1mgbjXWoaG3RJUBvD+6T/cG5QaJWg7gD1Hd9er5up4TyBPSIjMRYLVDlV8T2+hGzwFXhyH8iomsvelOWGXjYeYPN4NPin2pNvE+rWvvgDBixPVzX43XZB9WxWI0ptf6HqSEtQjAFgoZZNZAwP4EbBbPNRyk+LQ9JEkgqcH6DrTlzN+TxXIS+YZQGDHnzmInbSL4pr0y4TFu448wfG1+hLHdjGu4SZCquBDkJySJoeyxLTIP4UvmPmjXlWBOhAx7CApHeka6eVD26VHqAprFQqw8E85p8t4QBpOETVYUSk3u1B3tp3d/J0ino9KBdty77JL/R+IMaGOqueQyA/Meiqm9cETU/HvRBQsXGO65jGZB1unOjreRS67o/qHs8W9n1QLhG+YqOOTlI/pdQd5DZyuum3ad01S7spZAXKXSelQ6k90UUY3xXuRUCocbxRo8SBnYq5du+qlzegXHhS1umrZwII/w+GgnxTjw== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230025)(39860400002)(396003)(136003)(346002)(376002)(366004)(451199018)(36756003)(86362001)(8676002)(41300700001)(66556008)(66476007)(5660300002)(7416002)(8936002)(4326008)(2906002)(44832011)(38100700002)(6486002)(316002)(478600001)(6666004)(66946007)(6512007)(1076003)(6506007)(2616005)(186003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: yAq3/HGO1JJp9ESeS6rpKMN6ztdh3ECtdcWJLTKJgUBDfm3IFO2fMPTEPWvGNpD1Nrlq+cd6GSNnzACuW0A+7gTeHOvbO0kau8PkbxRHMe81WoJApe+QY9kEmes2L/ABEY7T2AjS7y0vHPOZBkegK0bEqws0mPKPDgfWTUoGaTIetBOcnK+Po4BIerL6c5V6+ezLgiP1WTEVySfyiiM1ood6EQd5ZCnvYY9IYkhh/DpfXihqvCClIMQ+U7/n8TO0ydrsH5JM/sV4h5msLqfCTQeEsM0zVIv5LVlDnEi3uZ148g+Ybv5BC/lIH8dPAGEI1kfAAmbptrA7TnMvTDxpQG6BrQTV3Wl+6k7/vpEh4+j+P9Hi2IIMXdvMvXBgjtcm1lce/Hj8FFoS/cpIVi7fQpUTDsT2yOpeiqCL6EkIX7p4AvJLql944qSr2diC7UpQNiEqMwZsVHIp8QwVSWAZYCTGWP5HZMJ6mYHp8yxBkFCUwpLYJHwAvt+AhW9kokxRRDt2e9hknzQ1eQLzij7xZHxrP6lclSLHRv6Uth/VQovdVmg9BxO3RcHtLPHzcjs1p+MJpgMh2TZPT3Edj3hsbn5tQ75HR9e9PsYWAEvmhQ1CsQcXFW4PZYjNQAVPg4v4cvg5vDZnhQqgqlfSakanpbR5t8z9kuaDClJfe9WAxFEaHU33A3QurDtrBOTRyX9sxZsPas+NwkE3Ttdgez881BwfTNn4F+fgobpeA0PpiO9ZMSPmd3Fy/2O+lTzVW0Fmndd/sHxL7xvHto4V2yqFPdlQkMLzNDLadL8PUOJfpO4i4ux8WMoBlCfTeyhhjsUDxAlY8qBeKH2QwD6K6hk2YJYSaqsq6b+6oHpXoY3s6Uz0GLGX8IMUd8cTHgEXWmFN3R/1WRlspe5kcDGNwljI4TcO7WxTyqmjhIt07z3mCU2MbjKNDyPLRuC/8tJYOBPI/OfCGZkBcl24c18uJnY7W3/XjraUByz/l3nZ5KdiZ9Faijdeua+mR6+g9oXdb6v/f31kLsZlvVtrKL4CJyxpSZx05hIX0t7X/lYzr0KznhsbIECQheI+/eNBoLJYTuosO2NfTcQuqa+OpoXEDVtOxCSGdkEl7isOngvjVY+utsHYTSSYu5EkViESDdrqg1P8WiV0hH8T0Tp8NWhOVRQS3kYKihTo19nwnS/iI9p0kW5zP6xSOdVhXRMI/Qm/CxzciPXjgbEad8md48HYWXNE/HMDxSJ2mhNTBz81z+ojLkZKtS5pwtbmsFprfwGt6R0azMbywvzxWv2ZTaJAVzWJ3NOTZVkbooNBph3xTJKwdS9b9+TcG5xyrqrj+hlWu3MHsUhQFqPNVLbKJNyyLM0AsUp8DxewGlzOd+jd9pgruUXiJR3RSUMeNUaETljC/blGrvsDJ+hTeMx327MTmFgIeaqbgySTjJe/tnMBB3Get8o+SVILOqGM/jsZxfADQo7uFrimt7eVGBuxM/oWtwwmm0fT0j31yVCJAI1IAl9w6tYSNVwWBLeoSaxu9xu32cMVEMPb7mRCO1lFH0IHc3MZsKE5NdLU2oCvSeWA9oEln/ICGwqeBfgE9dCPkTOy7wUcYJz6xOCPgiman4mDHV3JMDeOP3y3lKcBzl5qLo59rcY= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: sVtYYx793I2/3w+LgSvO9882ca/Bvopj0l4HwseS3kwhee2811dicneIizxHpyuF0uex8vaUEJngMzCaT5UgUCCzk7Y610aff7SuvMPO4m2FjgIfejuuAh9qPeBjDus/ZMBkSaW7NozPj56154KCjayf2xvPFMKVZfcdJgB4CFPtoIyle1UNh2velM7ZHtwiDaCI1ViSalJ3/f+Z1WROHfwDzdxHwFg247EQY6AN4soz6YgbAA4iwaO/gOtpHqSab9yFGB2LE0ZrIOv7iugICTH/I/wvgQsdhXKenyAan9uf/wBfbdIHKd03LYa0VaaCQeh3uyV4f2f3+PaDxrxpwNOdpxnqBiNaxCG8YpOatK+6E+witmyaHLG1QyqIYgvD9EI7F5wtwdrhhGVSFEoYgCBsSTmM+Oa9u0OcSTDRd1+TPAlnKGpEJCY0AvqngY4w/aN7p//hrKrTF8WGYUwitZNLpV65mUQhM40coBJKbWyqA+oVWla7MgVz1hYxT2q68eZajXmNAX8kTZjp0R0aZSLfpw3QRUCKyY9/i9VolrdCZrYXqdtyZaIhLTwNUYYxhI3d3QY2p/LxAnm/bXL7q+7EnD1Bf0R3C/bWnTnVSsnyGcG52COqEKTZ0GdLspmYVlu1Tzl6aqGAcf7F5573prg9MIIkV+5liqifsZ5fuOE74awRz9DK+I3SoMjBzeBDPW0NYCYYJhv31hcXBY4jTpFGfJthP/WMuhOAFiVbUTfGsRogNc+notZ4I5GYHOL3BP9glkXvbRoj6zEyRsoD5XPODNJkDkIHUe8XZIxIo4NDJE+ipZoSA2PnyFIu67Z6+Pw+VDc1p7tBaDOVzDtfbcEHvqq743F6TqrlOADCkYkEorOQeveu2JH1R2OhvcMrXirXXPwKUjclvjjLfdfXSGAm/KlgUU3ER1FRoWvcZTkP831BOtRgo5ZD9iZSlqZLwC8mi8l82Au+L3zdwBUR8aq8ops5zC3f1LRpDssvMDdO1GgRVmBBX+mXzOXINVV2JKsuN6wPr/1aykvfZaOlvg2JnuEjL/+4cN5C085Mg0JSk7L4ROhXFl9lJNAKuZZCI5NrOVxreRXNotJDMaWAB7HY5NZmibZfZhso64i96b784W39U/CjzGzfI1a9oqhU2WGHX0ud5ir3sJvOLFQWBBxdDGRVBBlH0Lxdm42VF2s= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0fa2a518-ead7-4b4b-fa92-08db1b3dc021 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2023 16:47:03.5339 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 5Dsk+FMlY7XIup5MU2tR/10tEJdwB1eVQ2BLbaS8EgXzo/IL7j8Cg6HHxErOzysfX96LAcrXUWSfRj0poduaXUU6LgWtXY2oKT4oMtGFQlA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5150 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-02_10,2023-03-02_02,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=999 phishscore=0 bulkscore=0 spamscore=0 suspectscore=0 adultscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303020146 X-Proofpoint-GUID: YOvRWeNHYcxanEhvwxptLIq5QTuFhvxw X-Proofpoint-ORIG-GUID: YOvRWeNHYcxanEhvwxptLIq5QTuFhvxw Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Add a new link restriction. Restrict the addition of keys in a keyring based on the key to be added being a CA. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- crypto/asymmetric_keys/restrict.c | 38 +++++++++++++++++++++++++++++++ include/crypto/public_key.h | 15 ++++++++++++ 2 files changed, 53 insertions(+) diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c index 6b1ac5f5896a..48457c6f33f9 100644 --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -108,6 +108,44 @@ int restrict_link_by_signature(struct key *dest_keyring, return ret; } +/** + * restrict_link_by_ca - Restrict additions to a ring of CA keys + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @trust_keyring: Unused. + * + * Check if the new certificate is a CA. If it is a CA, then mark the new + * certificate as being ok to link. + * + * Returns 0 if the new certificate was accepted, -ENOKEY if the + * certificate is not a CA. -ENOPKG if the signature uses unsupported + * crypto, or some other error if there is a matching certificate but + * the signature check cannot be performed. + */ +int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring) +{ + const struct public_key *pkey; + + if (type != &key_type_asymmetric) + return -EOPNOTSUPP; + + pkey = payload->data[asym_crypto]; + if (!pkey) + return -ENOPKG; + if (!test_bit(KEY_EFLAG_CA, &pkey->key_eflags)) + return -ENOKEY; + if (!test_bit(KEY_EFLAG_KEYCERTSIGN, &pkey->key_eflags)) + return -ENOKEY; + if (test_bit(KEY_EFLAG_DIGITALSIG, &pkey->key_eflags)) + return -ENOKEY; + + return 0; +} + static bool match_either_id(const struct asymmetric_key_id **pair, const struct asymmetric_key_id *single) { diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index 03c3fb990d59..653992a6e941 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -75,6 +75,21 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring, const union key_payload *payload, struct key *trusted); +#if IS_REACHABLE(CONFIG_ASYMMETRIC_KEY_TYPE) +extern int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring); +#else +static inline int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring) +{ + return 0; +} +#endif + extern int query_asymmetric_key(const struct kernel_pkey_params *, struct kernel_pkey_query *); From patchwork Thu Mar 2 16:46:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 658233 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CDC9C87FE7 for ; Thu, 2 Mar 2023 16:47:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230148AbjCBQrq (ORCPT ); Thu, 2 Mar 2023 11:47:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56140 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230078AbjCBQrh (ORCPT ); Thu, 2 Mar 2023 11:47:37 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C4DE57D35; Thu, 2 Mar 2023 08:47:30 -0800 (PST) Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 322FCjIL004981; Thu, 2 Mar 2023 16:47:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2022-7-12; bh=mk7czw9jc+Rlf7Qxbe08muBQWZadm99m02jpV5kbr/M=; b=0UZXg4P5jeSiPYNkqTUjXrC5VHFZPJUCqq5l++sk4qpyi85rNpRUIzPgRsP7AuTmjPW4 FeEw/Iwuk7nY5/aJiOVP0zocnHtzmMHfNc+vN4Q9iwPFQMehZVTVEniZ2KOzn7UWWSN6 asNte3/CpvhD8Q4tv+VQ7puzD3tK3zaBpb3DgaBshHy7CftzjdexvFsPWYkf7Q9y1CJd HXokz7Wv6DFEVw0Y3NrVgoRxwT0PEOr0XXwGZOVGFHO0++9SHmI148pmqOGXmGpWWACx 9AN4/U4rPC0zWvWeaJEsGIootnGHfg+Wm3FezHNfbEtRUZUoqIwzlfAVpsnkRfVXFW3R oA== Received: from phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta02.appoci.oracle.com [147.154.114.232]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3nyba7maej-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:47:09 +0000 Received: from pps.filterd (phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 322FTkuJ033023; Thu, 2 Mar 2023 16:47:08 GMT Received: from nam12-bn8-obe.outbound.protection.outlook.com (mail-bn8nam12lp2172.outbound.protection.outlook.com [104.47.55.172]) by phxpaimrmta02.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3ny8saa221-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 02 Mar 2023 16:47:08 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TsR3OUjXaVVlKXmzqNtSg3TAPwwo8BieH3V5lvFGPKoV0Tem7a0/1j0PshmxMA4tK76lCOrBJojsIQtmAM+k3ywKmQRNR4hjBFMGIaPdq3MoOPxjhSctyEb1yBnVLZZEZ85FaNniOUELqMDao8RFEYdNI/7WrFiwwiXs5KzyjNSz56ZkHpYTaL9pFShPaTfs5eye2HXzu+7PKXubL6EULSYZdJAHdAEdySOJXilRV/l4+TdZU0/jIacP8doRIho8MfPRwplkiSIyhx0LuAu+0FbPP4kxkhP+RaJpi7kVIrskJbevx/8+pqkG3lrJ3EEK4neUNWP7XorYWTCO+72Bfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=mk7czw9jc+Rlf7Qxbe08muBQWZadm99m02jpV5kbr/M=; b=LoAQNrKq1GaoepXMfOL6QhyQZzsRhn8+IBTailuctlH0UseokyvbYyy2BI2NA4rg/W//bgD9WEmY7Wl10K5h+cYuE8TTlYwcuzopNi3ADNd713+b5kAF2E7lmVkEoxBClUd0pArutRw+tRQ9hCmFEt13mMu/w1QTjtxMOr53/DCnDl3vXOVaMkDz85nuETxKYtzigCM2+TmficwZsB0ndgo3H5I5U9GSP4Z5S0DYcnplrWrjVf5k66JJrkm2F6/W3kqFV7+AKXxLgiXSszBXq77G0utWiSMHYZmndsHFax9vcSkeVnQshxFombSlr0xkuKwWOa04KGPugH1iv4kBhA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mk7czw9jc+Rlf7Qxbe08muBQWZadm99m02jpV5kbr/M=; b=BgFIAarAPa3wkUgP8KJwHrXZbCJXVdVg2hK1f0H4ZfQojvmNHXp42xc4R+QfIdO+JIDZxKsyA6rcl3YmA4uTSm8oDSDG9sf/tzzACcg97nVfvGCIxtqWK4lEExtn0oNnrsmnKDPPpB0sWKjWBFkGnZOacqsv+hbPbBTlVPJKSzk= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by DS7PR10MB5150.namprd10.prod.outlook.com (2603:10b6:5:3a1::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.19; Thu, 2 Mar 2023 16:47:06 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::a326:1794:402f:1adb%3]) with mapi id 15.20.6156.019; Thu, 2 Mar 2023 16:47:05 +0000 From: Eric Snowberg To: jarkko@kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org Cc: herbert@gondor.apana.org.au, davem@davemloft.net, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, pvorel@suse.cz, eric.snowberg@oracle.com, kanth.ghatraju@oracle.com, konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com, coxu@redhat.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v5 6/6] integrity: machine keyring CA configuration Date: Thu, 2 Mar 2023 11:46:52 -0500 Message-Id: <20230302164652.83571-7-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20230302164652.83571-1-eric.snowberg@oracle.com> References: <20230302164652.83571-1-eric.snowberg@oracle.com> X-ClientProxiedBy: BL1PR13CA0006.namprd13.prod.outlook.com (2603:10b6:208:256::11) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR10MB4150:EE_|DS7PR10MB5150:EE_ X-MS-Office365-Filtering-Correlation-Id: 187f25bf-e5c0-467b-c014-08db1b3dc194 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: AzsOzBmwQTCJv45itIOaTQzp2scMOtPEYyZthFDgxKs7r4Gp/wAIUaynPMMfLxf/PaL3jftQ4hgzbhnRxBkOjhiFLgIUGmP4LgM7rvu6l/JBHtHspYaxmy0Zwr93R09eJexZTdUDMxolgIuAwp+tf3xpvBw79Wfpau57zQ7xbQprzItx3eC9AYs+lTCmedQtGB8BOkngv93IMDr9cFIdvdx/sMmFPy8HCJMEGbZ0ZmAtC6z1Www+oBGaBrhkjNrZow0AIvVXAHiskpW48S7jDfCVVTmv5hjKn7tkXd07hAKYizkfR70uANXz//oDnjLf0DHrcjM5WdcfefqN1age16BK+5vZ6ZlgyLgzOmIygOLLsabpxaLSPfaO+4sJJzPzFU7p+AkN5CtGuzT3pUyYvn+IHRQNwv52/QVFm5ncPeWpRmYNjxc+lw8zp4RcKzw5D70x8bviypas5vHpwhiwDwUWkAfz7VOkqpKl0mJsMNVqB/zpw09FnwyA5qVgpq3kHL3cuRu7fAV/FfxeFCmdzjyrY7DAklW/sKRStRSJxx0+zpHaFIjX7sJDzEtS2DVmj5GZiHkkRFK5gkozDBR/Y5csj3Oc4UHQZ7bAtzPHRWdI74OcPrC7AQeFCogi6J3wlClKSVz6KDd+MuH0lTSdNg== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230025)(39860400002)(396003)(136003)(346002)(376002)(366004)(451199018)(36756003)(86362001)(8676002)(41300700001)(66556008)(66476007)(5660300002)(7416002)(8936002)(4326008)(2906002)(44832011)(38100700002)(6486002)(316002)(478600001)(6666004)(66946007)(83380400001)(6512007)(1076003)(6506007)(2616005)(186003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: A7+ORA5vWGScfU/HQ0SAQAv+Fc1ZQpGNdpfYn57+/iw0FGP74x24tl0pvZWEGnTjAKrcJHxn3zbyeuflZw8qrlwAnODdVzs4VhKvNxFH5j/6GSc6e5PxYtvV++dhJ2c4AfegYRl1f2N/tvE9wzxIzUQY04oAkUYaK5qJETwni+GnJtwn4ksVoNXxKaORTVBAyEGkECJXC7nuc+Z8OIBgBB89WChyCvAGMnQY8sa/OZF2lgkH47wveRCyD4uGPhN2XJQuxJq4NigSq5Pt+NcoRg3JhjyFWMamJu9+d526hdXuOWZOgt730TJZ6EliIf3l4SXlwrWfGst3VnxOKaskzjU33Ht2sbQ1wRQuv5DTIxqbWV35YZxco8HDieXH2tjCCWnqFraP3F1SdlhiwTcLapWg73TV/NF1k9HeiUmNTKZKfqQes+aH6EvmxzJYzLlo3HLs40fmOpX3E5bJ+fJFMRZu1x9/f+9+Trz1S09/qGDvDltunPeGwbdjiOATH++F/NyxRCS6/neNZPBtFvXSpPS+61WG1xH+y0NslfEIk8kb1kVgha2cciZw/WtvsOtBRAiHXTg3BifWYI1ylxAVSnQFrs2cnAOVKvlqqhTJGmlRy91BA8giDczOkIdnW1cSXaiYt5ShCXpBLNp/sag6criJpTabZjMlIk4HQPWcHY7VHDl7pXrGlwtBS1F9Gtjbdq7ynYY8vpi9xS+kXjJuVDFi/kSF6j1fFE4XRqPB4nfX+dk1hx/I00lFcAjHB/zdRM8jX8/qtiyh5sCnAVKdnkip+YRth+rbICIjVRs7rP0eA2+xO6sX8fsSQo8QsxQkTj0S4OUYsovg1epNiFM8Wyhn1OJvM6pz5UJ4kgP8Gl9fLhvs3nJxF2kfSLfBaEa6Xvdx7lOq1KH7YYeBVqc8wcWhPhpSx+2X8NxrpPVnnbGZ+QuCJm1jY4CjsKl1lQ06mOiirOAw7V8ng0CsX/MWgD9JJniveW2wJCXkecnsfKgX7S2vNxkhEy+Dp6bsf7Mg+/tLLyTu9lehlDR8sHCsp++CWKacpczn+gZHaq/QBjV1XmCEQdkyY5MvSeHXCxEDBmz8VNGXLcSMFAqS1IDDI6KvCRPSPHTFkI/CBLN9QzcWOnJR1qMCkHR5YTWN1dE187LMJznssL5olobFvCL0DFCGSfkcgKmUQvkhCtZdVcUc+nuuLy4S2PFBg0WmQNG0euFflHhCGjnjcqBWvp5biKGxxJwOFZDqAZxosU/eMFctDdaohXCme9KeFM+C4YA0KpBRO/Og3redHlJM1d7SOAOjvqS4SHd5zgyaDv1n+Lgne7Esff07RAFIluOMlT2JUd66YGCvAhRIA5VsB3x3DgtRDvgPsFyE4MfMGXaPHUe1yTQ439BdSCgBal4o3FKJS/sW0ZSnCf6wD8esRefFZcG+1dL7c455fx9hWUAgNZ1lUwIqYPfV995hawTHL2CGbqU+lKbjHdKVVKI1Bt5tcEdK/3ygLts5fX3gc79dNzymb5Xe2o21CUKNspkeOFKENTc8dPpwuwavD6PvmAdQKAMCeIZT4cyyoU2D1WvSCOwVoxwy7VyHh+RgtCB8TmgghgDy8haI8wroOPQhOzSpZN8+MsouI4gkk/wNOxIChmk= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: lmKOpgOXjaXEzxrKxKZ4TS5hYvI+TCBGRVN5HbiKfIDiP74YHlwXmC8eVQ+BNLB9kFmYn7NitwpCSak3ug7oMVHZ3x1YgBAFXLh0LsYKB1pLe96nJ0m5BDdI3lki9pUvIZOMNJoCHJZoo3CoS+dJl4BXnfcn2KlgGMl100HrFLfk6BUFbsRINOEpXlpKUVrq5etOPRbiYdCx3SwwpU0GMr6cvbTg5aNUIjcd8gXVwD5GPBovq9OgB2du7jArL+Z2uXOYGDqj6T0OkT++b06C9eLNQmG+Vy++YzwfqLV/a5VwnApVUFy1sCQ4a/t6M3gE6/sa7xRfC3mqBSj9OabFRflrnGxO7U2bG3VuM2r5AjUIlpNiGCW2OrIkDRWco289l4b9lDMyJAC9lGInMXyqofBOMsDDYuF56eXLOgTm4OApgxVlf7o0Hdp7kMkSfO89a4r61Zj0uoIaTMsRoUiVkuu1JVunrmtrc8T70OG/A7ZWpeTTidb1u4vtPNYx9jg3HKuNOeCNVGF+1XGpVvmzFaWIhm4g6eiG3mng5mXiR9t/AaHs06ouvHUlSsgOwAdfJ8Qg3qsz8zEd9vVgBrAYNYOJdn87PsNysaeO3K7QNJVPE1l5eTp7mt+Gb4slIyLa0tnz5Ugf76K2VgghayzZoYTe1mbTh8UjNx+OcemsuNNjR6j50Tehbc8SYm9Ue6co6olhSi1HP1HZcBYIkjINOipSx707PodFOgDORvHNbEWe1326wInNNUTG9WUVY3oyggspVQJUODnO90esTe8HNLjisP8DxuwYURcYow8LYCfDZjNGBn9/OZEy3U7hzonHT0ObsxDAyM8BCQjpPgTZdG/hPMGEk4l8+1BVFVxnE5k9nGvMlLV/CnyVspIltpMFPdia8vFaat1pfmv+FqUiZNX9p+Q5zjOKeln5rNWSgRCfyWc5ahuQTfjqrzKoSoCEbDfxFZEkpb6TehtOOhyDLyt/iqDjnulmsAohs4YB7xAz9cQzXbDZM1MofTyJL0YSsNqm+iUXQtE4tK+PnBt5ea/77aHczjFpB2UhQ1F0bpslsFN09iqlxakcSN7VHI+FQG9/EAse+wfPNV6e2ZsOuEUZM2aA9d2uVEJyBEbI20patsIoLbjjV8NO+KJys9o4Do6HENWZnjGqsGSsD/EG7BHec4n1cHVIvAJgWYmm+uY= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 187f25bf-e5c0-467b-c014-08db1b3dc194 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2023 16:47:05.9481 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 95FCFD1G9jld4533WpCVsNxJ+RPBN7NfU4+1EVMaGfsauagaDnjXgqp7oLmDZQ9hmVq8lEvhQpsbP2dXDUo0/rXpDSSxoT0OfcOUV+ruJs8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5150 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-02_10,2023-03-02_02,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 malwarescore=0 spamscore=0 mlxscore=0 phishscore=0 suspectscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303020146 X-Proofpoint-ORIG-GUID: AjO_p501VsE0LG65sNKAClowrPnLSTbE X-Proofpoint-GUID: AjO_p501VsE0LG65sNKAClowrPnLSTbE Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Add machine keyring CA restriction options to control the type of keys that may be added to it. The motivation is separation of certificate signing from code signing keys. Subsquent work will limit certificates being loaded into the IMA keyring to code signing keys used for signature verification. When no restrictions are selected, all Machine Owner Keys (MOK) are added to the machine keyring. When CONFIG_INTEGRITY_CA_MACHINE_KEYRING is selected, the CA bit must be true. Also the key usage must contain keyCertSign, any other usage field may be set as well. When CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX is selected, the CA bit must be true. Also the key usage must contain keyCertSign and the digitialSignature usage may not be set. Signed-off-by: Eric Snowberg Acked-by: Mimi Zohar --- crypto/asymmetric_keys/restrict.c | 2 ++ security/integrity/Kconfig | 23 ++++++++++++++++++++++- security/integrity/digsig.c | 8 ++++++-- 3 files changed, 30 insertions(+), 3 deletions(-) diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c index 48457c6f33f9..276bdb627498 100644 --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -140,6 +140,8 @@ int restrict_link_by_ca(struct key *dest_keyring, return -ENOKEY; if (!test_bit(KEY_EFLAG_KEYCERTSIGN, &pkey->key_eflags)) return -ENOKEY; + if (!IS_ENABLED(CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX)) + return 0; if (test_bit(KEY_EFLAG_DIGITALSIG, &pkey->key_eflags)) return -ENOKEY; diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 599429f99f99..ec6e0d789da1 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -68,13 +68,34 @@ config INTEGRITY_MACHINE_KEYRING depends on INTEGRITY_ASYMMETRIC_KEYS depends on SYSTEM_BLACKLIST_KEYRING depends on LOAD_UEFI_KEYS - depends on !IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY help If set, provide a keyring to which Machine Owner Keys (MOK) may be added. This keyring shall contain just MOK keys. Unlike keys in the platform keyring, keys contained in the .machine keyring will be trusted within the kernel. +config INTEGRITY_CA_MACHINE_KEYRING + bool "Enforce Machine Keyring CA Restrictions" + depends on INTEGRITY_MACHINE_KEYRING + default n + help + The .machine keyring can be configured to enforce CA restriction + on any key added to it. By default no restrictions are in place + and all Machine Owner Keys (MOK) are added to the machine keyring. + If enabled only CA keys are added to the machine keyring, all + other MOK keys load into the platform keyring. + +config INTEGRITY_CA_MACHINE_KEYRING_MAX + bool "Only CA keys without DigitialSignature usage set" + depends on INTEGRITY_CA_MACHINE_KEYRING + default n + help + When selected, only load CA keys are loaded into the machine + keyring that contain the CA bit set along with the keyCertSign + Usage field. Keys containing the digitialSignature Usage field + will not be loaded. The remaining MOK keys are loaded into the + .platform keyring. + config LOAD_UEFI_KEYS depends on INTEGRITY_PLATFORM_KEYRING depends on EFI diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index f2193c531f4a..6f31ffe23c48 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -132,7 +132,8 @@ int __init integrity_init_keyring(const unsigned int id) | KEY_USR_READ | KEY_USR_SEARCH; if (id == INTEGRITY_KEYRING_PLATFORM || - id == INTEGRITY_KEYRING_MACHINE) { + (id == INTEGRITY_KEYRING_MACHINE && + !IS_ENABLED(CONFIG_INTEGRITY_CA_MACHINE_KEYRING))) { restriction = NULL; goto out; } @@ -144,7 +145,10 @@ int __init integrity_init_keyring(const unsigned int id) if (!restriction) return -ENOMEM; - restriction->check = restrict_link_to_ima; + if (id == INTEGRITY_KEYRING_MACHINE) + restriction->check = restrict_link_by_ca; + else + restriction->check = restrict_link_to_ima; /* * MOK keys can only be added through a read-only runtime services