[RFC 0/5] Another initramfs signature checking set

[RFC 0/5] Another initramfs signature checking set

[Jeremy Linton]

With the advent of UKI's wrapping kernel and cpio archives up into
single UEFI PE executables it seems like its probably time to
reconsider whether the core idea of signing the initrd and verifying
it in its entirely is a useful function of the core kernel.

Moving this functionality in the kernel should provide a similar
security statement to the UKIs with a more traditional kernel + initrd
boot flow and the ability to have a single kernel image that
selects between multiple signed initrd images. Say a normal boot
image, and a recovery image.

This set is a very basic implementation of that concept using the kernel
built in trusted keyring, and a signature format that is similar to the
existing module signature. The core change is quite trivial with the larger
questions around the policy for enforcing or simply checking
for a valid signature. I've considered various policies, tying it to
lockdown/etc but this set simply enforces it by default with an kernel
parameter to override the behavior.

Outside of the core patch the largest change revolves around making
sure that the asymmetric key and built in cert/keyring/blacklist logic
is started much earlier in the boot process than normal. This means
that beyond the hacky _initcall changes in patch 2 there are a bit of
additional Kconfig changes necessary.

Finally, before the RFC is dropped there are a number of
/Documentation changes that will be completed as needed.

Jeremy Linton (5):
  initramfs: Add initramfs signature checking
  KEYS/certs: Start the builtin key and cert system earlier
  initramfs: Use existing module signing infrastructure
  sign-file: Add -i option to sign initramfs images
  initramfs: Enforce initramfs signature

 certs/blacklist.c                        |  2 +-
 certs/system_keyring.c                   |  4 +-
 crypto/asymmetric_keys/asymmetric_type.c |  2 +-
 crypto/asymmetric_keys/x509_public_key.c |  2 +-
 include/linux/initrd.h                   |  3 +
 init/initramfs.c                         | 84 +++++++++++++++++++++++-
 scripts/sign-file.c                      | 11 +++-
 usr/Kconfig                              |  9 +++
 8 files changed, 109 insertions(+), 8 deletions(-)

-- 
2.46.0

[RFC 1/5] initramfs: Add initramfs signature checking

[Jeremy Linton]

Various root-level processes, configurations, and the like can exist
in the initramfs provided by the boot loader. The kernel does a
reasonable job of signature checking and blocking unsigned code from
running in the kernel, but this is only one aspect of system
security. The remaining init and early startup code running in
userspace are just as critical to system security.

This option provides a basic initramfs signature check, which reuses
the module signature checking infrastructure to validate the boot
loader provided initramfs. Later, a system policy can allow or deny
images that fail the signature check.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
---
 usr/Kconfig | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/usr/Kconfig b/usr/Kconfig
index 9279a2893ab0..a9c0dc0112eb 100644
--- a/usr/Kconfig
+++ b/usr/Kconfig
@@ -32,6 +32,15 @@ config INITRAMFS_FORCE
 	  and is useful if you cannot or don't want to change the image
 	  your bootloader passes to the kernel.
 
+config INITRAMFS_SIG
+	bool "Validate signed initramfs images"
+	depends on SYSTEM_DATA_VERIFICATION
+	help
+	  This option validates that image provided by the
+	  bootloader is signed. The decision to accept or
+	  reject the image is then left to the kernel lockdown
+	  logic.
+
 config INITRAMFS_ROOT_UID
 	int "User ID to map to 0 (user root)"
 	depends on INITRAMFS_SOURCE!=""
-- 
2.46.0

[RFC 2/5] KEYS/certs: Start the builtin key and cert system earlier

[Jeremy Linton]

This exists at the moment to assure that the module signature checking
logic can be utilized before the initramfs is mounted.

Assuming we want to use the built in keys as well as MOK's to validate
an init image, is just moving this stuff earlier in the boot process
the right choice?

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
---
 certs/blacklist.c                        | 2 +-
 certs/system_keyring.c                   | 4 ++--
 crypto/asymmetric_keys/asymmetric_type.c | 2 +-
 crypto/asymmetric_keys/x509_public_key.c | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/certs/blacklist.c b/certs/blacklist.c
index 675dd7a8f07a..e644dd4cfc2b 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -356,7 +356,7 @@ static int __init blacklist_init(void)
 /*
  * Must be initialised before we try and load the keys into the keyring.
  */
-device_initcall(blacklist_init);
+fs_initcall(blacklist_init);
 
 #ifdef CONFIG_SYSTEM_REVOCATION_LIST
 /*
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 9de610bf1f4b..81a86418cb00 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -260,7 +260,7 @@ static __init int system_trusted_keyring_init(void)
 /*
  * Must be initialised before we try and load the keys into the keyring.
  */
-device_initcall(system_trusted_keyring_init);
+subsys_initcall(system_trusted_keyring_init);
 
 __init int load_module_cert(struct key *keyring)
 {
@@ -293,7 +293,7 @@ static __init int load_system_certificate_list(void)
 
 	return x509_load_certificate_list(p, size, builtin_trusted_keys);
 }
-late_initcall(load_system_certificate_list);
+fs_initcall_sync(load_system_certificate_list);
 
 #ifdef CONFIG_SYSTEM_DATA_VERIFICATION
 
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index 43af5fa510c0..a0607e8cdafc 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -681,5 +681,5 @@ static void __exit asymmetric_key_cleanup(void)
 	unregister_key_type(&key_type_asymmetric);
 }
 
-module_init(asymmetric_key_init);
+subsys_initcall(asymmetric_key_init);
 module_exit(asymmetric_key_cleanup);
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 8409d7d36cb4..391db5f1ede6 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -246,7 +246,7 @@ static void __exit x509_key_exit(void)
 	unregister_asymmetric_key_parser(&x509_key_parser);
 }
 
-module_init(x509_key_init);
+fs_initcall(x509_key_init);
 module_exit(x509_key_exit);
 
 MODULE_DESCRIPTION("X.509 certificate parser");
-- 
2.46.0

[RFC 3/5] initramfs: Use existing module signing infrastructure

[Jeremy Linton]

Adding some security checks around the configuration data and early
init processes running on the machine is a good idea. There is a move
to do this via systemd UKIs using the UEFI and shim infrastructure to
wrap a kernel and its associated initramfs into a single PE
executable, which is then validated and measured together. The
existing kernel boot methods can also provide a similar level of
security by leveraging the kernel's signing and validation
infrastructure to check a signature on the initramfs.

Kernel-validated initramfs images maintain the existing UEFI boot flow
while enabling functionality on non-UEFI machines. They keep the UEFI
secure boot verification separate from current and future choices over
how the kernel verifies data used after it boots. Additionally, this
makes it possible for multiple signed initramfs images, for example,
debug and recovery images, to share a single kernel image.

Let's reuse the kernel's sign-file utility, which appends a trailing
signature, signature description, and module signature string to sign
the initramfs. Then, immediately before we unpack the image, detect if
there is a signature, validate it, and strip it off. Then, with a
later patch, we can decide what happens when the image is unsigned or
cannot be verified.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
---
 include/linux/initrd.h |  3 ++
 init/initramfs.c       | 67 +++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 69 insertions(+), 1 deletion(-)

diff --git a/include/linux/initrd.h b/include/linux/initrd.h
index f1a1f4c92ded..e123d3cb39bb 100644
--- a/include/linux/initrd.h
+++ b/include/linux/initrd.h
@@ -5,6 +5,9 @@
 
 #define INITRD_MINOR 250 /* shouldn't collide with /dev/ram* too soon ... */
 
+/* the len here equals the modsig string len */
+#define INITRD_SIG_STRING "~initrd signature appended~\n"
+
 /* starting block # of image */
 extern int rd_image_start;
 
diff --git a/init/initramfs.c b/init/initramfs.c
index bc911e466d5b..d2d2c68016c2 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/init.h>
+#include <linux/initrd.h>
 #include <linux/async.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
@@ -14,6 +15,7 @@
 #include <linux/kstrtox.h>
 #include <linux/memblock.h>
 #include <linux/mm.h>
+#include <linux/module_signature.h>
 #include <linux/namei.h>
 #include <linux/init_syscalls.h>
 #include <linux/umh.h>
@@ -688,8 +690,69 @@ static void __init populate_initrd_image(char *err)
 }
 #endif /* CONFIG_BLK_DEV_RAM */
 
+static int __init initrd_signature_check(size_t *initrd_len)
+{
+	struct module_signature *ms;
+	size_t sig_len;
+	int ret = -ENODATA;
+	const size_t m_len = sizeof(INITRD_SIG_STRING) - 1;
+
+	*initrd_len = (initrd_end - initrd_start);
+
+	if (*initrd_len < (m_len + sizeof(*ms)))
+		goto fail;
+
+	if (memcmp((char *)(initrd_end - m_len), INITRD_SIG_STRING, m_len)) {
+		pr_info("unsigned initramfs\n");
+		goto fail;
+	}
+
+	/* remove module sig string from len computations going forward */
+	*initrd_len -= m_len;
+
+	ms = (struct module_signature *)(initrd_end - sizeof(*ms) - m_len);
+
+	ret = mod_check_sig(ms, *initrd_len, "initramfs");
+	if (ret)
+		goto fail;
+
+	sig_len = be32_to_cpu(ms->sig_len);
+	*initrd_len -= sizeof(*ms) + sig_len;
+
+#ifdef CONFIG_INITRAMFS_SIG
+	ret = verify_pkcs7_signature((char *)initrd_start, *initrd_len,
+				     (char *)(initrd_start + *initrd_len),
+				     sig_len,
+				     VERIFY_USE_SECONDARY_KEYRING,
+				     VERIFYING_UNSPECIFIED_SIGNATURE,
+				     NULL, NULL);
+
+	switch (ret) {
+	case 0:
+		pr_info("initramfs: valid signature\n");
+		break;
+	case -ENODATA:
+		pr_err("initramfs: invalid signature\n");
+		break;
+	case -ENOPKG:
+		pr_err("initramfs: unsupported crypto\n");
+		break;
+	case -ENOKEY:
+		pr_err("initramfs: unknown key\n");
+		break;
+	default:
+		pr_err("initramfs: unknown error %d\n", ret);
+	}
+#endif
+
+fail:
+	return ret;
+}
+
 static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)
 {
+	size_t initrd_len;
+
 	/* Load the built in initramfs */
 	char *err = unpack_to_rootfs(__initramfs_start, __initramfs_size);
 	if (err)
@@ -703,7 +766,9 @@ static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)
 	else
 		printk(KERN_INFO "Unpacking initramfs...\n");
 
-	err = unpack_to_rootfs((char *)initrd_start, initrd_end - initrd_start);
+	initrd_signature_check(&initrd_len);
+
+	err = unpack_to_rootfs((char *)initrd_start, initrd_len);
 	if (err) {
 #ifdef CONFIG_BLK_DEV_RAM
 		populate_initrd_image(err);
-- 
2.46.0

[RFC 4/5] sign-file: Add -i option to sign initramfs images

[Jeremy Linton]

The initramfs signature is the mod signature with a differing string
to assure that cpio archives with a signed module at the end can never
be confused for a valid signed initramfs.

To support this, add a -i option to sign-file, which replaces the
"Module signature appended" string with "initrd signature appended",
which is the same length.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
---
 scripts/sign-file.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 7070245edfc1..bbf97a57311a 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -75,6 +75,7 @@ struct module_signature {
 #define PKEY_ID_PKCS7 2
 
 static char magic_number[] = "~Module signature appended~\n";
+static char magic_initrd[] = "~initrd signature appended~\n";
 
 static __attribute__((noreturn))
 void format(void)
@@ -226,6 +227,7 @@ int main(int argc, char **argv)
 	bool save_sig = false, replace_orig;
 	bool sign_only = false;
 	bool raw_sig = false;
+	bool initrd_sig = false;
 	unsigned char buf[4096];
 	unsigned long module_size, sig_size;
 	unsigned int use_signed_attrs;
@@ -253,7 +255,7 @@ int main(int argc, char **argv)
 #endif
 
 	do {
-		opt = getopt(argc, argv, "sdpk");
+		opt = getopt(argc, argv, "sdpki");
 		switch (opt) {
 		case 's': raw_sig = true; break;
 		case 'p': save_sig = true; break;
@@ -261,6 +263,7 @@ int main(int argc, char **argv)
 #ifndef USE_PKCS7
 		case 'k': use_keyid = CMS_USE_KEYID; break;
 #endif
+		case 'i': initrd_sig = true; break;
 		case -1: break;
 		default: format();
 		}
@@ -398,7 +401,11 @@ int main(int argc, char **argv)
 	sig_size = BIO_number_written(bd) - module_size;
 	sig_info.sig_len = htonl(sig_size);
 	ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name);
-	ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name);
+	if (initrd_sig)
+		ERR(BIO_write(bd, magic_initrd, sizeof(magic_initrd) - 1) < 0, "%s", dest_name);
+	else
+		ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name);
+
 
 	ERR(BIO_free(bd) != 1, "%s", dest_name);
 
-- 
2.46.0

[RFC 5/5] initramfs: Enforce initramfs signature

[Jeremy Linton]

Now that the infrastructure is in place to verify and sign initramfs
images, let's refuse them if the signature is invalid. Additionally, a
command-line option `initrdsig=[enforcing|checking]` is provided to
switch between failing to boot or reporting signature failures.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
---
 init/initramfs.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/init/initramfs.c b/init/initramfs.c
index d2d2c68016c2..bb42ba6c0730 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -573,6 +573,20 @@ static int __init initramfs_async_setup(char *str)
 }
 __setup("initramfs_async=", initramfs_async_setup);
 
+static bool  __initdata enforce_initrd_sig = IS_ENABLED(CONFIG_INITRAMFS_SIG);
+#ifdef CONFIG_INITRAMFS_SIG
+static int __init initrd_sig_setup(char *str)
+{
+	if (!strcmp(str, "enforcing"))
+		enforce_initrd_sig = true;
+	else if (!strcmp(str, "checking"))
+		enforce_initrd_sig = false;
+	return 1;
+}
+__setup("initrdsig=", initrd_sig_setup);
+#endif
+
+
 extern char __initramfs_start[];
 extern unsigned long __initramfs_size;
 #include <linux/initrd.h>
@@ -766,7 +780,10 @@ static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)
 	else
 		printk(KERN_INFO "Unpacking initramfs...\n");
 
-	initrd_signature_check(&initrd_len);
+	if (initrd_signature_check(&initrd_len) && enforce_initrd_sig) {
+		printk(KERN_EMERG "Initramfs signature required\n");
+		goto done;
+	}
 
 	err = unpack_to_rootfs((char *)initrd_start, initrd_len);
 	if (err) {
-- 
2.46.0