Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-21 19:41:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

certs: Factor out the blacklist hash creation

Browse Source 
Factor out the blacklist hash creation with the get_raw_hash() helper.
This also centralize the "tbs" and "bin" prefixes and make them private,
which help to manage them consistently.

Cc: David Howells <dhowells@redhat.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Eric Snowberg <eric.snowberg@oracle.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Link: https://lore.kernel.org/r/20210712170313.884724-5-mic@digikod.net
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
Mickaël Salaün 2021-07-12 19:03:12 +02:00 committed by Jarkko Sakkinen
parent 58d416351e
commit 141e523914
4 changed files with 73 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
certs/blacklist.c
View File

@ -83,11 +83,43 @@ static struct key_type key_type_blacklist = {
.describe = blacklist_describe,
};
static char *get_raw_hash(const u8 *hash, size_t hash_len,
enum blacklist_hash_type hash_type)
{
size_t type_len;
const char *type_prefix;
char *buffer, *p;
switch (hash_type) {
case BLACKLIST_HASH_X509_TBS:
type_len = sizeof(tbs_prefix) - 1;
type_prefix = tbs_prefix;
break;
case BLACKLIST_HASH_BINARY:
type_len = sizeof(bin_prefix) - 1;
type_prefix = bin_prefix;
break;
default:
WARN_ON_ONCE(1);
return ERR_PTR(-EINVAL);
}
buffer = kmalloc(type_len + 1 + hash_len * 2 + 1, GFP_KERNEL);
if (!buffer)
return ERR_PTR(-ENOMEM);
p = memcpy(buffer, type_prefix, type_len);
p += type_len;
*p++ = ':';
bin2hex(p, hash, hash_len);
p += hash_len * 2;
*p = '\0';
return buffer;
}
/**
* mark_hash_blacklisted - Add a hash to the system blacklist
* mark_raw_hash_blacklisted - Add a hash to the system blacklist
* @hash: The hash as a hex string with a type prefix (eg. "tbs:23aa429783")
*/
int mark_hash_blacklisted(const char *hash)
static int mark_raw_hash_blacklisted(const char *hash)
{
key_ref_t key;
@ -107,29 +139,36 @@ int mark_hash_blacklisted(const char *hash)
return 0;
}
int mark_hash_blacklisted(const u8 *hash, size_t hash_len,
enum blacklist_hash_type hash_type)
{
const char *buffer;
int err;
buffer = get_raw_hash(hash, hash_len, hash_type);
if (IS_ERR(buffer))
return PTR_ERR(buffer);
err = mark_raw_hash_blacklisted(buffer);
kfree(buffer);
return err;
}
/**
* is_hash_blacklisted - Determine if a hash is blacklisted
* @hash: The hash to be checked as a binary blob
* @hash_len: The length of the binary hash
* @type: Type of hash
* @hash_type: Type of hash
*/
int is_hash_blacklisted(const u8 *hash, size_t hash_len, const char *type)
int is_hash_blacklisted(const u8 *hash, size_t hash_len,
enum blacklist_hash_type hash_type)
{
key_ref_t kref;
size_t type_len = strlen(type);
char *buffer, *p;
const char *buffer;
int ret = 0;
buffer = kmalloc(type_len + 1 + hash_len * 2 + 1, GFP_KERNEL);
if (!buffer)
return -ENOMEM;
p = memcpy(buffer, type, type_len);
p += type_len;
*p++ = ':';
bin2hex(p, hash, hash_len);
p += hash_len * 2;
*p = 0;
buffer = get_raw_hash(hash, hash_len, hash_type);
if (IS_ERR(buffer))
return PTR_ERR(buffer);
kref = keyring_search(make_key_ref(blacklist_keyring, true),
&key_type_blacklist, buffer, false);
if (!IS_ERR(kref)) {
@ -144,7 +183,8 @@ EXPORT_SYMBOL_GPL(is_hash_blacklisted);
int is_binary_blacklisted(const u8 *hash, size_t hash_len)
{
if (is_hash_blacklisted(hash, hash_len, "bin") == -EKEYREJECTED)
if (is_hash_blacklisted(hash, hash_len, BLACKLIST_HASH_BINARY) ==
-EKEYREJECTED)
return -EPERM;
return 0;
@ -217,7 +257,7 @@ static int __init blacklist_init(void)
panic("Can't allocate system blacklist keyring\n");
for (bl = blacklist_hashes; *bl; bl++)
if (mark_hash_blacklisted(*bl) < 0)
if (mark_raw_hash_blacklisted(*bl) < 0)
pr_err("- blacklisting failed\n");
return 0;
}

3
crypto/asymmetric_keys/x509_public_key.c
View File

@ -69,7 +69,8 @@ int x509_get_sig_params(struct x509_certificate *cert)
if (ret < 0)
goto error_2;
ret = is_hash_blacklisted(sig->digest, sig->digest_size, "tbs");
ret = is_hash_blacklisted(sig->digest, sig->digest_size,
BLACKLIST_HASH_X509_TBS);
if (ret == -EKEYREJECTED) {
pr_err("Cert %*phN is blacklisted\n",
sig->digest_size, sig->digest);

14
include/keys/system_keyring.h
View File

@ -10,6 +10,13 @@
#include <linux/key.h>
enum blacklist_hash_type {
/* TBSCertificate hash */
BLACKLIST_HASH_X509_TBS = 1,
/* Raw data hash */
BLACKLIST_HASH_BINARY = 2,
};
#ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
extern int restrict_link_by_builtin_trusted(struct key *keyring,
@ -54,13 +61,14 @@ static inline void __init set_machine_trusted_keys(struct key *keyring)
extern struct pkcs7_message *pkcs7;
#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
extern int mark_hash_blacklisted(const char *hash);
extern int mark_hash_blacklisted(const u8 *hash, size_t hash_len,
enum blacklist_hash_type hash_type);
extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
const char *type);
enum blacklist_hash_type hash_type);
extern int is_binary_blacklisted(const u8 *hash, size_t hash_len);
#else
static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
const char *type)
enum blacklist_hash_type hash_type)
{
return 0;
}

26
security/integrity/platform_certs/keyring_handler.c
View File

@ -16,35 +16,13 @@ static efi_guid_t efi_cert_x509_sha256_guid __initdata =
EFI_CERT_X509_SHA256_GUID;
static efi_guid_t efi_cert_sha256_guid __initdata = EFI_CERT_SHA256_GUID;
/*
* Blacklist a hash.
*/
static __init void uefi_blacklist_hash(const char *source, const void *data,
size_t len, const char *type,
size_t type_len)
{
char *hash, *p;
hash = kmalloc(type_len + len * 2 + 1, GFP_KERNEL);
if (!hash)
return;
p = memcpy(hash, type, type_len);
p += type_len;
bin2hex(p, data, len);
p += len * 2;
*p = 0;
mark_hash_blacklisted(hash);
kfree(hash);
}
/*
* Blacklist an X509 TBS hash.
*/
static __init void uefi_blacklist_x509_tbs(const char *source,
const void *data, size_t len)
{
uefi_blacklist_hash(source, data, len, "tbs:", 4);
mark_hash_blacklisted(data, len, BLACKLIST_HASH_X509_TBS);
}
/*
@ -53,7 +31,7 @@ static __init void uefi_blacklist_x509_tbs(const char *source,
static __init void uefi_blacklist_binary(const char *source,
const void *data, size_t len)
{
uefi_blacklist_hash(source, data, len, "bin:", 4);
mark_hash_blacklisted(data, len, BLACKLIST_HASH_BINARY);
}
/*