From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4064gM0fZjzF0Vt for ; Thu, 22 Mar 2018 09:47:03 +1100 (AEDT) Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w2LMiSjS138655 for ; Wed, 21 Mar 2018 18:47:00 -0400 Received: from e06smtp11.uk.ibm.com (e06smtp11.uk.ibm.com [195.75.94.107]) by mx0b-001b2d01.pphosted.com with ESMTP id 2gux53n06d-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Wed, 21 Mar 2018 18:47:00 -0400 Received: from localhost by e06smtp11.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 21 Mar 2018 22:46:58 -0000 Subject: Re: [PATCH v6 05/12] integrity: Introduce integrity_keyring_from_id() From: Mimi Zohar To: Thiago Jung Bauermann , linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, Dmitry Kasatkin , James Morris , "Serge E. Hallyn" , David Howells , David Woodhouse , Jessica Yu , Herbert Xu , "David S. Miller" , "AKASHI, Takahiro" Date: Wed, 21 Mar 2018 18:46:51 -0400 In-Reply-To: <20180316203837.10174-6-bauerman@linux.vnet.ibm.com> References: <20180316203837.10174-1-bauerman@linux.vnet.ibm.com> <20180316203837.10174-6-bauerman@linux.vnet.ibm.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Message-Id: <1521672411.3848.219.camel@linux.vnet.ibm.com> List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Fri, 2018-03-16 at 17:38 -0300, Thiago Jung Bauermann wrote: > IMA will need to obtain the keyring used to verify file signatures so that > it can verify the module-style signature appended to files. > > Signed-off-by: Thiago Jung Bauermann Signed-off-by: Mimi Zohar > --- > security/integrity/digsig.c | 28 +++++++++++++++++++++------- > security/integrity/integrity.h | 6 ++++++ > 2 files changed, 27 insertions(+), 7 deletions(-) > > diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c > index 6f9e4ce568cd..e641a67b9fc7 100644 > --- a/security/integrity/digsig.c > +++ b/security/integrity/digsig.c > @@ -48,11 +48,10 @@ static bool init_keyring __initdata; > #define restrict_link_to_ima restrict_link_by_builtin_trusted > #endif > > -int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > - const char *digest, int digestlen) > +struct key *integrity_keyring_from_id(const unsigned int id) > { > - if (id >= INTEGRITY_KEYRING_MAX || siglen < 2) > - return -EINVAL; > + if (id >= INTEGRITY_KEYRING_MAX) > + return ERR_PTR(-EINVAL); > > if (!keyring[id]) { > keyring[id] = > @@ -61,17 +60,32 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > int err = PTR_ERR(keyring[id]); > pr_err("no %s keyring: %d\n", keyring_name[id], err); > keyring[id] = NULL; > - return err; > + return ERR_PTR(err); > } > } > > + return keyring[id]; > +} > + > +int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > + const char *digest, int digestlen) > +{ > + struct key *keyring; > + > + if (siglen < 2) > + return -EINVAL; > + > + keyring = integrity_keyring_from_id(id); > + if (IS_ERR(keyring)) > + return PTR_ERR(keyring); > + > switch (sig[1]) { > case 1: > /* v1 API expect signature without xattr type */ > - return digsig_verify(keyring[id], sig + 1, siglen - 1, > + return digsig_verify(keyring, sig + 1, siglen - 1, > digest, digestlen); > case 2: > - return asymmetric_verify(keyring[id], sig, siglen, > + return asymmetric_verify(keyring, sig, siglen, > digest, digestlen); > } > > diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h > index 79799a0d9195..2d245f44ca26 100644 > --- a/security/integrity/integrity.h > +++ b/security/integrity/integrity.h > @@ -150,6 +150,7 @@ int integrity_kernel_read(struct file *file, loff_t offset, > > #ifdef CONFIG_INTEGRITY_SIGNATURE > > +struct key *integrity_keyring_from_id(const unsigned int id); > int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, > const char *digest, int digestlen); > > @@ -157,6 +158,11 @@ int __init integrity_init_keyring(const unsigned int id); > int __init integrity_load_x509(const unsigned int id, const char *path); > #else > > +static inline struct key *integrity_keyring_from_id(const unsigned int id) > +{ > + return ERR_PTR(-EINVAL); > +} > + > static inline int integrity_digsig_verify(const unsigned int id, > const char *sig, int siglen, > const char *digest, int digestlen) >