* [PATCH v8 1/4] kexec: clean up arch_kexec_kernel_verify_sig
[not found] <20220512070123.29486-1-coxu@redhat.com>
@ 2022-05-12 7:01 ` Coiby Xu
2022-06-09 21:57 ` Mimi Zohar
2022-05-12 7:01 ` [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic Coiby Xu
` (2 subsequent siblings)
3 siblings, 1 reply; 17+ messages in thread
From: Coiby Xu @ 2022-05-12 7:01 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee,
open list
Currently there is no arch-specific implementation of
arch_kexec_kernel_verify_sig. Even if we want to add an implementation
for an architecture in the future, we can simply use "(struct
kexec_file_ops*)->verify_sig". So clean it up.
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
include/linux/kexec.h | 4 ----
kernel/kexec_file.c | 34 +++++++++++++---------------------
2 files changed, 13 insertions(+), 25 deletions(-)
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 58d1b58a971e..413235c6c797 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -202,10 +202,6 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
const Elf_Shdr *relsec,
const Elf_Shdr *symtab);
int arch_kimage_file_post_load_cleanup(struct kimage *image);
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
- unsigned long buf_len);
-#endif
int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 8347fc158d2b..3720435807eb 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -89,25 +89,6 @@ int __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
return kexec_image_post_load_cleanup_default(image);
}
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
- unsigned long buf_len)
-{
- if (!image->fops || !image->fops->verify_sig) {
- pr_debug("kernel loader does not support signature verification.\n");
- return -EKEYREJECTED;
- }
-
- return image->fops->verify_sig(buf, buf_len);
-}
-
-int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
- unsigned long buf_len)
-{
- return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
/*
* arch_kexec_apply_relocations_add - apply relocations of type RELA
* @pi: Purgatory to be relocated.
@@ -184,13 +165,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
}
#ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+ unsigned long buf_len)
+{
+ if (!image->fops || !image->fops->verify_sig) {
+ pr_debug("kernel loader does not support signature verification.\n");
+ return -EKEYREJECTED;
+ }
+
+ return image->fops->verify_sig(buf, buf_len);
+}
+
static int
kimage_validate_signature(struct kimage *image)
{
int ret;
- ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
- image->kernel_buf_len);
+ ret = kexec_image_verify_sig(image, image->kernel_buf,
+ image->kernel_buf_len);
if (ret) {
if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
--
2.35.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* Re: [PATCH v8 1/4] kexec: clean up arch_kexec_kernel_verify_sig
2022-05-12 7:01 ` [PATCH v8 1/4] kexec: clean up arch_kexec_kernel_verify_sig Coiby Xu
@ 2022-06-09 21:57 ` Mimi Zohar
0 siblings, 0 replies; 17+ messages in thread
From: Mimi Zohar @ 2022-06-09 21:57 UTC (permalink / raw)
To: Coiby Xu, kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Chun-Yi Lee, open list
On Thu, 2022-05-12 at 15:01 +0800, Coiby Xu wrote:
> kimage_validate_signature(struct kimage *image)
> {
> int ret;
>
> - ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
> - image->kernel_buf_len);
> + ret = kexec_image_verify_sig(image, image->kernel_buf,
> + image->kernel_buf_len);
Please indent the above line to line up with the open parenthesis.
thanks,
Mimi
> if (ret) {
>
> if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
[not found] <20220512070123.29486-1-coxu@redhat.com>
2022-05-12 7:01 ` [PATCH v8 1/4] kexec: clean up arch_kexec_kernel_verify_sig Coiby Xu
@ 2022-05-12 7:01 ` Coiby Xu
2022-05-12 7:21 ` Baoquan He
2022-06-09 22:18 ` Mimi Zohar
2022-05-12 7:01 ` [PATCH v8 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature Coiby Xu
2022-05-12 7:01 ` [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification Coiby Xu
3 siblings, 2 replies; 17+ messages in thread
From: Coiby Xu @ 2022-05-12 7:01 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee,
keyrings, linux-security-module, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
signature verify") adds platform keyring support on x86 kexec but not
arm64.
The code in bzImage64_verify_sig makes use of system keyrings including
.buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
verify signed kernel image as PE file. Make it generic so both x86_64
and arm64 can use it.
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
include/linux/kexec.h | 7 +++++++
kernel/kexec_file.c | 17 +++++++++++++++++
3 files changed, 25 insertions(+), 19 deletions(-)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 170d0fd68b1f..f299b48f9c9f 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -17,7 +17,6 @@
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/efi.h>
-#include <linux/verification.h>
#include <asm/bootparam.h>
#include <asm/setup.h>
@@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
return 0;
}
-#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
-{
- int ret;
-
- ret = verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_SECONDARY_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
- if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
- ret = verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_PLATFORM_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
- }
- return ret;
-}
-#endif
-
const struct kexec_file_ops kexec_bzImage64_ops = {
.probe = bzImage64_probe,
.load = bzImage64_load,
.cleanup = bzImage64_cleanup,
#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
- .verify_sig = bzImage64_verify_sig,
+ .verify_sig = kexec_kernel_verify_pe_sig,
#endif
};
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 413235c6c797..da83abfc628b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -19,6 +19,7 @@
#include <asm/io.h>
#include <uapi/linux/kexec.h>
+#include <linux/verification.h>
/* Location of a reserved region to hold the crash kernel.
*/
@@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
const Elf_Shdr *relsec,
const Elf_Shdr *symtab);
int arch_kimage_file_post_load_cleanup(struct kimage *image);
+#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel,
+ unsigned long kernel_len);
+#endif
+#endif
int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 3720435807eb..754885b96aab 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
}
#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
+{
+ int ret;
+
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ return ret;
+}
+#endif
+
static int kexec_image_verify_sig(struct kimage *image, void *buf,
unsigned long buf_len)
{
--
2.35.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* Re: [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-05-12 7:01 ` [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic Coiby Xu
@ 2022-05-12 7:21 ` Baoquan He
2022-06-09 22:18 ` Mimi Zohar
1 sibling, 0 replies; 17+ messages in thread
From: Baoquan He @ 2022-05-12 7:21 UTC (permalink / raw)
To: Coiby Xu
Cc: kexec, linux-arm-kernel, Michal Suchanek, Dave Young, Will Deacon,
Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, keyrings,
linux-security-module, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
On 05/12/22 at 03:01pm, Coiby Xu wrote:
> commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> signature verify") adds platform keyring support on x86 kexec but not
> arm64.
>
> The code in bzImage64_verify_sig makes use of system keyrings including
> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> verify signed kernel image as PE file. Make it generic so both x86_64
> and arm64 can use it.
LGTM,
Acked-by: Baoquan He <bhe@redhat.com>
>
> Cc: kexec@lists.infradead.org
> Cc: keyrings@vger.kernel.org
> Cc: linux-security-module@vger.kernel.org
> Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
> arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> include/linux/kexec.h | 7 +++++++
> kernel/kexec_file.c | 17 +++++++++++++++++
> 3 files changed, 25 insertions(+), 19 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 170d0fd68b1f..f299b48f9c9f 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -17,7 +17,6 @@
> #include <linux/kernel.h>
> #include <linux/mm.h>
> #include <linux/efi.h>
> -#include <linux/verification.h>
>
> #include <asm/bootparam.h>
> #include <asm/setup.h>
> @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> return 0;
> }
>
> -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> -{
> - int ret;
> -
> - ret = verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> - if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> - ret = verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_PLATFORM_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> - }
> - return ret;
> -}
> -#endif
> -
> const struct kexec_file_ops kexec_bzImage64_ops = {
> .probe = bzImage64_probe,
> .load = bzImage64_load,
> .cleanup = bzImage64_cleanup,
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> - .verify_sig = bzImage64_verify_sig,
> + .verify_sig = kexec_kernel_verify_pe_sig,
> #endif
> };
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 413235c6c797..da83abfc628b 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -19,6 +19,7 @@
> #include <asm/io.h>
>
> #include <uapi/linux/kexec.h>
> +#include <linux/verification.h>
>
> /* Location of a reserved region to hold the crash kernel.
> */
> @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> const Elf_Shdr *relsec,
> const Elf_Shdr *symtab);
> int arch_kimage_file_post_load_cleanup(struct kimage *image);
> +#ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel,
> + unsigned long kernel_len);
> +#endif
> +#endif
> int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>
> extern int kexec_add_buffer(struct kexec_buf *kbuf);
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 3720435807eb..754885b96aab 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> }
>
> #ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> +{
> + int ret;
> +
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> +}
> +#endif
> +
> static int kexec_image_verify_sig(struct kimage *image, void *buf,
> unsigned long buf_len)
> {
> --
> 2.35.3
>
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-05-12 7:01 ` [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic Coiby Xu
2022-05-12 7:21 ` Baoquan He
@ 2022-06-09 22:18 ` Mimi Zohar
2022-06-16 1:47 ` Coiby Xu
1 sibling, 1 reply; 17+ messages in thread
From: Mimi Zohar @ 2022-06-09 22:18 UTC (permalink / raw)
To: Coiby Xu, kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Chun-Yi Lee, keyrings,
linux-security-module, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
Hi Coiby,
On Thu, 2022-05-12 at 15:01 +0800, Coiby Xu wrote:
> commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> signature verify") adds platform keyring support on x86 kexec but not
> arm64.
>
> The code in bzImage64_verify_sig makes use of system keyrings including
> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> verify signed kernel image as PE file. Make it generic so both x86_64
> and arm64 can use it.
^uses the keys on the .builtin_trusted_keys, .machine, if configured
and enabled, .secondary_trusted_keys, also if configured, and .platform
keyrings to verify the signed kernel image as PE file.
>
> @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> const Elf_Shdr *relsec,
> const Elf_Shdr *symtab);
> int arch_kimage_file_post_load_cleanup(struct kimage *image);
> +#ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel,
> + unsigned long kernel_len);
Please join this line with the previous one.
> +#endif
> +#endif
> int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>
> extern int kexec_add_buffer(struct kexec_buf *kbuf);
thanks,
Mimi
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-06-09 22:18 ` Mimi Zohar
@ 2022-06-16 1:47 ` Coiby Xu
0 siblings, 0 replies; 17+ messages in thread
From: Coiby Xu @ 2022-06-16 1:47 UTC (permalink / raw)
To: Mimi Zohar
Cc: kexec, linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Chun-Yi Lee, keyrings,
linux-security-module, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
Hi Mimi,
On Thu, Jun 09, 2022 at 06:18:44PM -0400, Mimi Zohar wrote:
>Hi Coiby,
>
>On Thu, 2022-05-12 at 15:01 +0800, Coiby Xu wrote:
>> commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
>> signature verify") adds platform keyring support on x86 kexec but not
>> arm64.
>>
>> The code in bzImage64_verify_sig makes use of system keyrings including
>> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
>> verify signed kernel image as PE file. Make it generic so both x86_64
>> and arm64 can use it.
>
>^uses the keys on the .builtin_trusted_keys, .machine, if configured
>and enabled, .secondary_trusted_keys, also if configured, and .platform
>keyrings to verify the signed kernel image as PE file.
>
>>
>> @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>> const Elf_Shdr *relsec,
>> const Elf_Shdr *symtab);
>> int arch_kimage_file_post_load_cleanup(struct kimage *image);
>> +#ifdef CONFIG_KEXEC_SIG
>> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> +int kexec_kernel_verify_pe_sig(const char *kernel,
>> + unsigned long kernel_len);
>
>Please join this line with the previous one.
>
>> +#endif
>> +#endif
>> int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>>
>> extern int kexec_add_buffer(struct kexec_buf *kbuf);
I've applied the two suggestions, thanks!
>
>thanks,
>
>Mimi
>
--
Best regards,
Coiby
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH v8 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature
[not found] <20220512070123.29486-1-coxu@redhat.com>
2022-05-12 7:01 ` [PATCH v8 1/4] kexec: clean up arch_kexec_kernel_verify_sig Coiby Xu
2022-05-12 7:01 ` [PATCH v8 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic Coiby Xu
@ 2022-05-12 7:01 ` Coiby Xu
2022-06-09 23:15 ` Mimi Zohar
2022-05-12 7:01 ` [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification Coiby Xu
3 siblings, 1 reply; 17+ messages in thread
From: Coiby Xu @ 2022-05-12 7:01 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, stable,
keyrings, linux-security-module, Catalin Marinas, James Morse,
AKASHI Takahiro, open list
Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7".
This happens because image_verify_sig uses only the primary keyring that
contains only kernel built-in keys to verify the kexec image.
This patch allows to verify arm64 kernel image signature using not only
.builtin_trusted_keys but also .platform and .secondary_trusted_keys
keyring.
Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
Acked-by: Baoquan He <bhe@redhat.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Co-developed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
arch/arm64/kernel/kexec_image.c | 11 +----------
1 file changed, 1 insertion(+), 10 deletions(-)
diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index 9ec34690e255..5ed6a585f21f 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -14,7 +14,6 @@
#include <linux/kexec.h>
#include <linux/pe.h>
#include <linux/string.h>
-#include <linux/verification.h>
#include <asm/byteorder.h>
#include <asm/cpufeature.h>
#include <asm/image.h>
@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
return NULL;
}
-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
-{
- return verify_pefile_signature(kernel, kernel_len, NULL,
- VERIFYING_KEXEC_PE_SIGNATURE);
-}
-#endif
-
const struct kexec_file_ops kexec_image_ops = {
.probe = image_probe,
.load = image_load,
#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
- .verify_sig = image_verify_sig,
+ .verify_sig = kexec_kernel_verify_pe_sig,
#endif
};
--
2.35.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* Re: [PATCH v8 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature
2022-05-12 7:01 ` [PATCH v8 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature Coiby Xu
@ 2022-06-09 23:15 ` Mimi Zohar
2022-06-16 1:22 ` Coiby Xu
2022-06-17 9:34 ` Michal Suchánek
0 siblings, 2 replies; 17+ messages in thread
From: Mimi Zohar @ 2022-06-09 23:15 UTC (permalink / raw)
To: Coiby Xu, kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Chun-Yi Lee, stable, keyrings,
linux-security-module, Catalin Marinas, James Morse,
AKASHI Takahiro, open list
On Thu, 2022-05-12 at 15:01 +0800, Coiby Xu wrote:
> Currently, a problem faced by arm64 is if a kernel image is signed by a
> MOK key, loading it via the kexec_file_load() system call would be
> rejected with the error "Lockdown: kexec: kexec of unsigned images is
> restricted; see man kernel_lockdown.7".
>
> This happens because image_verify_sig uses only the primary keyring that
> contains only kernel built-in keys to verify the kexec image.
From the git history it's clear that .platform keyring was upstreamed
during the same open window as commit 732b7b93d849 ("arm64: kexec_file:
add kernel signature verification support"). Loading the MOK keys
onto the .platform keyring was upstreamed much later. For this reason,
commit 732b7b93d849 only used keys on the .builtin_trusted_keys
keyring. This patch is now addressing it and the newly upstreamed
.machine keyring.
Only using the .builtin_trusted_keys is the problem statement, which
should be one of the first lines of the patch description, if not the
first line.
>
> This patch allows to verify arm64 kernel image signature using not only
> .builtin_trusted_keys but also .platform and .secondary_trusted_keys
> keyring.
Please remember to update this to include the .machine keyring.
>
> Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
Since the MOK keys weren't loaded onto the .platform keyring until much
later, I would not classify this as a fix.
thanks,
Mimi
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature
2022-06-09 23:15 ` Mimi Zohar
@ 2022-06-16 1:22 ` Coiby Xu
2022-06-17 9:34 ` Michal Suchánek
1 sibling, 0 replies; 17+ messages in thread
From: Coiby Xu @ 2022-06-16 1:22 UTC (permalink / raw)
To: Mimi Zohar
Cc: kexec, linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Chun-Yi Lee, stable, keyrings,
linux-security-module, Catalin Marinas, James Morse,
AKASHI Takahiro, open list
On Thu, Jun 09, 2022 at 07:15:27PM -0400, Mimi Zohar wrote:
>On Thu, 2022-05-12 at 15:01 +0800, Coiby Xu wrote:
>> Currently, a problem faced by arm64 is if a kernel image is signed by a
>> MOK key, loading it via the kexec_file_load() system call would be
>> rejected with the error "Lockdown: kexec: kexec of unsigned images is
>> restricted; see man kernel_lockdown.7".
>>
>> This happens because image_verify_sig uses only the primary keyring that
>> contains only kernel built-in keys to verify the kexec image.
>
>From the git history it's clear that .platform keyring was upstreamed
>during the same open window as commit 732b7b93d849 ("arm64: kexec_file:
>add kernel signature verification support"). Loading the MOK keys
>onto the .platform keyring was upstreamed much later. For this reason,
>commit 732b7b93d849 only used keys on the .builtin_trusted_keys
>keyring. This patch is now addressing it and the newly upstreamed
>.machine keyring.
Thanks for explaining the history to me!
>
>Only using the .builtin_trusted_keys is the problem statement, which
>should be one of the first lines of the patch description, if not the
>first line.
Thanks for the suggestion! I've provided a new version of commit message
in the end.
>
>>
>> This patch allows to verify arm64 kernel image signature using not only
>> .builtin_trusted_keys but also .platform and .secondary_trusted_keys
>> keyring.
>
>Please remember to update this to include the .machine keyring.
Sure, thanks for the reminder!
>
>>
>> Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
>
>Since the MOK keys weren't loaded onto the .platform keyring until much
>later, I would not classify this as a fix.
For this Fixes tag, I mean arm64 couldn't make use of the secondary
keyring because a secondary system keyring was introduced long before
commit 732b7b93d849 ("arm64: kexec_file: add kernel signature
verification support"),
commit d3bfe84129f65e0af2450743ebdab33d161d01c9
Author: David Howells <dhowells@redhat.com>
Date: Wed Apr 6 16:14:27 2016 +0100
certs: Add a secondary system keyring that can be added to dynamically
commit 732b7b93d849f8a44886ead563dfb6adec7f4419
Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
Date: Thu Nov 15 14:52:54 2018 +0900
arm64: kexec_file: add kernel signature verification support
Of course, my commit message is misleading since it talks about MOK key
in the first line. If stating the problem as arm64 only using the
.builtin_trusted_keys as suggested by you, I think this Fixes tag would
make sense. How about the following one?
Currently, when loading a kernel image via the kexec_file_load() system
call, arm64 can only use the .builtin_trusted_keys keyring to verify
a signature whereas x86 can use three more keyrings i.e.
.secondary_trusted_keys, .machine and .platform keyrings. For example,
one resulting problem is kexec'ing a kernel image would be rejected
with the error "Lockdown: kexec: kexec of unsigned images is restricted;
see man kernel_lockdown.7".
This patch set enables arm64 to make use of the same keyrings as x86 to
verify the signature kexec'ed kernel image.
Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
>
>thanks,
>
>Mimi
>
--
Best regards,
Coiby
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature
2022-06-09 23:15 ` Mimi Zohar
2022-06-16 1:22 ` Coiby Xu
@ 2022-06-17 9:34 ` Michal Suchánek
1 sibling, 0 replies; 17+ messages in thread
From: Michal Suchánek @ 2022-06-17 9:34 UTC (permalink / raw)
To: Mimi Zohar
Cc: Coiby Xu, kexec, linux-arm-kernel, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Chun-Yi Lee, stable, keyrings,
linux-security-module, Catalin Marinas, James Morse,
AKASHI Takahiro, open list
Hello,
On Thu, Jun 09, 2022 at 07:15:27PM -0400, Mimi Zohar wrote:
> On Thu, 2022-05-12 at 15:01 +0800, Coiby Xu wrote:
> > Currently, a problem faced by arm64 is if a kernel image is signed by a
> > MOK key, loading it via the kexec_file_load() system call would be
> > rejected with the error "Lockdown: kexec: kexec of unsigned images is
> > restricted; see man kernel_lockdown.7".
> >
> > This happens because image_verify_sig uses only the primary keyring that
> > contains only kernel built-in keys to verify the kexec image.
>
> From the git history it's clear that .platform keyring was upstreamed
> during the same open window as commit 732b7b93d849 ("arm64: kexec_file:
> add kernel signature verification support"). Loading the MOK keys
> onto the .platform keyring was upstreamed much later. For this reason,
> commit 732b7b93d849 only used keys on the .builtin_trusted_keys
> keyring. This patch is now addressing it and the newly upstreamed
> .machine keyring.
>
> Only using the .builtin_trusted_keys is the problem statement, which
> should be one of the first lines of the patch description, if not the
> first line.
>
> >
> > This patch allows to verify arm64 kernel image signature using not only
> > .builtin_trusted_keys but also .platform and .secondary_trusted_keys
> > keyring.
>
> Please remember to update this to include the .machine keyring.
>
> >
> > Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
>
> Since the MOK keys weren't loaded onto the .platform keyring until much
> later, I would not classify this as a fix.
It's definitely a fix
ea93102f32244e3f45c8b26260be77ed0cc1d16c v4.19-rc1 Fix kexec forbidding kernels signed with keys in the secondary keyring to boot
732b7b93d849f8a44886ead563dfb6adec7f4419 v5.0-rc1 arm64: kexec_file: add kernel signature verification support
the arm code does not reflect the preexisting use of the secondary keyring.
278311e417be60f7caef6fcb12bda4da2711ceff v5.1-rc1 kexec, KEYS: Make use of platform keyring for signature
This was added a bit later, indeed.
Cherry-picking the changes one by one to the arm code you can get
separate fixes tag for each change.
Replacing the arm code with the x86 code by code deduplication you get
whatever is the state of the art in the kernel in question. In 5.0 you
get the secondary keyring, and since 5.1 you also get the platform
keyring.
Nonetheless, it's a fix for the arm code which is deficient from the
very start.
Thanks
Michal
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
[not found] <20220512070123.29486-1-coxu@redhat.com>
` (2 preceding siblings ...)
2022-05-12 7:01 ` [PATCH v8 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature Coiby Xu
@ 2022-05-12 7:01 ` Coiby Xu
2022-05-18 11:29 ` Heiko Carstens
3 siblings, 1 reply; 17+ messages in thread
From: Coiby Xu @ 2022-05-12 7:01 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, stable,
Philipp Rudo, keyrings, linux-security-module, Heiko Carstens,
Vasily Gorbik, Alexander Gordeev, Christian Borntraeger,
Sven Schnelle, Martin Schwidefsky, open list:S390, open list
From: Michal Suchanek <msuchanek@suse.de>
commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
adds support for KEXEC_SIG verification with keys from platform keyring
but the built-in keys and secondary keyring are not used.
Add support for the built-in keys and secondary keyring as x86 does.
Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
Cc: stable@vger.kernel.org
Cc: Philipp Rudo <prudo@linux.ibm.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
index 8f43575a4dd3..fc6d5f58debe 100644
--- a/arch/s390/kernel/machine_kexec_file.c
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -31,6 +31,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;
struct module_signature *ms;
unsigned long sig_len;
+ int ret;
/* Skip signature verification when not secure IPLed. */
if (!ipl_secure_flag)
@@ -65,11 +66,18 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
return -EBADMSG;
}
- return verify_pkcs7_signature(kernel, kernel_len,
- kernel + kernel_len, sig_len,
- VERIFY_USE_PLATFORM_KEYRING,
- VERIFYING_MODULE_SIGNATURE,
- NULL, NULL);
+ ret = verify_pkcs7_signature(kernel, kernel_len,
+ kernel + kernel_len, sig_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_MODULE_SIGNATURE,
+ NULL, NULL);
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
+ ret = verify_pkcs7_signature(kernel, kernel_len,
+ kernel + kernel_len, sig_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_MODULE_SIGNATURE,
+ NULL, NULL);
+ return ret;
}
#endif /* CONFIG_KEXEC_SIG */
--
2.35.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* Re: [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
2022-05-12 7:01 ` [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification Coiby Xu
@ 2022-05-18 11:29 ` Heiko Carstens
2022-05-19 0:39 ` Baoquan He
0 siblings, 1 reply; 17+ messages in thread
From: Heiko Carstens @ 2022-05-18 11:29 UTC (permalink / raw)
To: Coiby Xu
Cc: kexec, linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, stable,
Philipp Rudo, keyrings, linux-security-module, Vasily Gorbik,
Alexander Gordeev, Christian Borntraeger, Sven Schnelle,
Martin Schwidefsky, open list:S390, open list
On Thu, May 12, 2022 at 03:01:23PM +0800, Coiby Xu wrote:
> From: Michal Suchanek <msuchanek@suse.de>
>
> commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> adds support for KEXEC_SIG verification with keys from platform keyring
> but the built-in keys and secondary keyring are not used.
>
> Add support for the built-in keys and secondary keyring as x86 does.
>
> Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> Cc: stable@vger.kernel.org
> Cc: Philipp Rudo <prudo@linux.ibm.com>
> Cc: kexec@lists.infradead.org
> Cc: keyrings@vger.kernel.org
> Cc: linux-security-module@vger.kernel.org
> Signed-off-by: Michal Suchanek <msuchanek@suse.de>
> Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
> Acked-by: Baoquan He <bhe@redhat.com>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
> arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
> 1 file changed, 13 insertions(+), 5 deletions(-)
As far as I can tell this doesn't have any dependency to the other
patches in this series, so should I pick this up for the s390 tree, or
how will this go upstream?
In any case:
Acked-by: Heiko Carstens <hca@linux.ibm.com>
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
2022-05-18 11:29 ` Heiko Carstens
@ 2022-05-19 0:39 ` Baoquan He
2022-05-19 11:56 ` Mimi Zohar
0 siblings, 1 reply; 17+ messages in thread
From: Baoquan He @ 2022-05-19 0:39 UTC (permalink / raw)
To: Heiko Carstens, akpm, zohar
Cc: Coiby Xu, kexec, keyrings, linux-arm-kernel, Michal Suchanek,
Dave Young, Will Deacon, Eric W . Biederman, Mimi Zohar,
Chun-Yi Lee, stable, Philipp Rudo, linux-security-module,
Vasily Gorbik, Alexander Gordeev, Christian Borntraeger,
Sven Schnelle, Martin Schwidefsky, open list:S390, open list
On 05/18/22 at 01:29pm, Heiko Carstens wrote:
> On Thu, May 12, 2022 at 03:01:23PM +0800, Coiby Xu wrote:
> > From: Michal Suchanek <msuchanek@suse.de>
> >
> > commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > adds support for KEXEC_SIG verification with keys from platform keyring
> > but the built-in keys and secondary keyring are not used.
> >
> > Add support for the built-in keys and secondary keyring as x86 does.
> >
> > Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > Cc: stable@vger.kernel.org
> > Cc: Philipp Rudo <prudo@linux.ibm.com>
> > Cc: kexec@lists.infradead.org
> > Cc: keyrings@vger.kernel.org
> > Cc: linux-security-module@vger.kernel.org
> > Signed-off-by: Michal Suchanek <msuchanek@suse.de>
> > Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
> > Acked-by: Baoquan He <bhe@redhat.com>
> > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > ---
> > arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
> > 1 file changed, 13 insertions(+), 5 deletions(-)
>
> As far as I can tell this doesn't have any dependency to the other
> patches in this series, so should I pick this up for the s390 tree, or
> how will this go upstream?
Thanks, Heiko.
I want to ask Mimi if this can be taken into KEYS-ENCRYPTED tree.
Otherwise I will ask Andrew to help pick this whole series.
Surely, this patch 4 can be taken into s390 seperately since it's
independent, both looks good.
Thanks
Baoquan
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
2022-05-19 0:39 ` Baoquan He
@ 2022-05-19 11:56 ` Mimi Zohar
2022-05-19 14:22 ` Baoquan He
0 siblings, 1 reply; 17+ messages in thread
From: Mimi Zohar @ 2022-05-19 11:56 UTC (permalink / raw)
To: Baoquan He, Heiko Carstens, akpm
Cc: Coiby Xu, kexec, keyrings, linux-arm-kernel, Michal Suchanek,
Dave Young, Will Deacon, Eric W . Biederman, Chun-Yi Lee, stable,
Philipp Rudo, linux-security-module, Vasily Gorbik,
Alexander Gordeev, Christian Borntraeger, Sven Schnelle,
Martin Schwidefsky, open list:S390, open list, linux-integrity,
Jarkko Sakkinen
[Cc'ing Jarkko, linux-integrity]
On Thu, 2022-05-19 at 08:39 +0800, Baoquan He wrote:
> On 05/18/22 at 01:29pm, Heiko Carstens wrote:
> > On Thu, May 12, 2022 at 03:01:23PM +0800, Coiby Xu wrote:
> > > From: Michal Suchanek <msuchanek@suse.de>
> > >
> > > commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > > adds support for KEXEC_SIG verification with keys from platform keyring
> > > but the built-in keys and secondary keyring are not used.
> > >
> > > Add support for the built-in keys and secondary keyring as x86 does.
> > >
> > > Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > > Cc: stable@vger.kernel.org
> > > Cc: Philipp Rudo <prudo@linux.ibm.com>
> > > Cc: kexec@lists.infradead.org
> > > Cc: keyrings@vger.kernel.org
> > > Cc: linux-security-module@vger.kernel.org
> > > Signed-off-by: Michal Suchanek <msuchanek@suse.de>
> > > Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
> > > Acked-by: Baoquan He <bhe@redhat.com>
> > > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > > ---
> > > arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
> > > 1 file changed, 13 insertions(+), 5 deletions(-)
> >
> > As far as I can tell this doesn't have any dependency to the other
> > patches in this series, so should I pick this up for the s390 tree, or
> > how will this go upstream?
>
> Thanks, Heiko.
>
> I want to ask Mimi if this can be taken into KEYS-ENCRYPTED tree.
> Otherwise I will ask Andrew to help pick this whole series.
>
> Surely, this patch 4 can be taken into s390 seperately since it's
> independent, both looks good.
KEYS-ENCRYTPED is a type of key, unrelated to using the .platform,
.builtin, .machine, or .secondary keyrings. One of the main reasons
for this patch set is to use the new ".machine" keyring, which, if
enabled, is linked to the "secondary" keyring. However, the only
reference to the ".machine" keyring is in the cover letter, not any of
the patch descriptions. Since this is the basis for the system's
integrity, this seems like a pretty big omission.
From patch 2/4:
"The code in bzImage64_verify_sig makes use of system keyrings
including
.buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
verify signed kernel image as PE file..."
From patch 3/4:
"This patch allows to verify arm64 kernel image signature using not
only
.builtin_trusted_keys but also .platform and .secondary_trusted_keys
keyring."
From patch 4/4:
"... with keys from platform keyring but the built-in keys and
secondary keyring are not used."
This patch set could probably go through KEYS/KEYRINGS_INTEGRITY, but
it's kind of late to be asking. Has it been in linux-next? Should I
assume this patch set has been fully tested or can we get some "tags"?
thanks,
Mimi
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
2022-05-19 11:56 ` Mimi Zohar
@ 2022-05-19 14:22 ` Baoquan He
2022-05-19 17:11 ` Michal Suchánek
0 siblings, 1 reply; 17+ messages in thread
From: Baoquan He @ 2022-05-19 14:22 UTC (permalink / raw)
To: Mimi Zohar, Coiby Xu
Cc: Heiko Carstens, akpm, kexec, keyrings, linux-arm-kernel,
Michal Suchanek, Dave Young, Will Deacon, Eric W . Biederman,
Chun-Yi Lee, stable, Philipp Rudo, linux-security-module,
Vasily Gorbik, Alexander Gordeev, Christian Borntraeger,
Sven Schnelle, Martin Schwidefsky, open list:S390, open list,
linux-integrity, Jarkko Sakkinen
On 05/19/22 at 07:56am, Mimi Zohar wrote:
> [Cc'ing Jarkko, linux-integrity]
>
> On Thu, 2022-05-19 at 08:39 +0800, Baoquan He wrote:
> > On 05/18/22 at 01:29pm, Heiko Carstens wrote:
> > > On Thu, May 12, 2022 at 03:01:23PM +0800, Coiby Xu wrote:
> > > > From: Michal Suchanek <msuchanek@suse.de>
> > > >
> > > > commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > > > adds support for KEXEC_SIG verification with keys from platform keyring
> > > > but the built-in keys and secondary keyring are not used.
> > > >
> > > > Add support for the built-in keys and secondary keyring as x86 does.
> > > >
> > > > Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > > > Cc: stable@vger.kernel.org
> > > > Cc: Philipp Rudo <prudo@linux.ibm.com>
> > > > Cc: kexec@lists.infradead.org
> > > > Cc: keyrings@vger.kernel.org
> > > > Cc: linux-security-module@vger.kernel.org
> > > > Signed-off-by: Michal Suchanek <msuchanek@suse.de>
> > > > Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
> > > > Acked-by: Baoquan He <bhe@redhat.com>
> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > > > ---
> > > > arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
> > > > 1 file changed, 13 insertions(+), 5 deletions(-)
> > >
> > > As far as I can tell this doesn't have any dependency to the other
> > > patches in this series, so should I pick this up for the s390 tree, or
> > > how will this go upstream?
> >
> > Thanks, Heiko.
> >
> > I want to ask Mimi if this can be taken into KEYS-ENCRYPTED tree.
> > Otherwise I will ask Andrew to help pick this whole series.
> >
> > Surely, this patch 4 can be taken into s390 seperately since it's
> > independent, both looks good.
>
> KEYS-ENCRYTPED is a type of key, unrelated to using the .platform,
> .builtin, .machine, or .secondary keyrings. One of the main reasons
> for this patch set is to use the new ".machine" keyring, which, if
> enabled, is linked to the "secondary" keyring. However, the only
> reference to the ".machine" keyring is in the cover letter, not any of
> the patch descriptions. Since this is the basis for the system's
> integrity, this seems like a pretty big omission.
>
> From patch 2/4:
> "The code in bzImage64_verify_sig makes use of system keyrings
> including
> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> verify signed kernel image as PE file..."
>
> From patch 3/4:
> "This patch allows to verify arm64 kernel image signature using not
> only
> .builtin_trusted_keys but also .platform and .secondary_trusted_keys
> keyring."
>
> From patch 4/4:
> "... with keys from platform keyring but the built-in keys and
> secondary keyring are not used."
>
> This patch set could probably go through KEYS/KEYRINGS_INTEGRITY, but
> it's kind of late to be asking. Has it been in linux-next? Should I
> assume this patch set has been fully tested or can we get some "tags"?
Right, it should be KEYS/KEYRINGS_INTEGRITY related, I made mistaken.
Now it got two ACKs from Michal and me. Michal met the same issue on
arm64 and posted another series of patches, finally Coiby integrated
Michal's patch and his to make this patchset. That would be great if
this can get reviewing from experts on key/keyring. Surely, Coiby need
update the patch log to add the '.machine' keyring into patch logs as
you pointed out.
IIRC, Coiby has tested it on x86_64/arm64, not sure if he took test on
s390. No, this hasn't been in linux-next.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
2022-05-19 14:22 ` Baoquan He
@ 2022-05-19 17:11 ` Michal Suchánek
2022-06-16 1:46 ` Coiby Xu
0 siblings, 1 reply; 17+ messages in thread
From: Michal Suchánek @ 2022-05-19 17:11 UTC (permalink / raw)
To: Baoquan He
Cc: Mimi Zohar, Coiby Xu, Heiko Carstens, akpm, kexec, keyrings,
linux-arm-kernel, Dave Young, Will Deacon, Eric W . Biederman,
Chun-Yi Lee, stable, Philipp Rudo, linux-security-module,
Vasily Gorbik, Alexander Gordeev, Christian Borntraeger,
Sven Schnelle, Martin Schwidefsky, open list:S390, open list,
linux-integrity, Jarkko Sakkinen
On Thu, May 19, 2022 at 10:22:15PM +0800, Baoquan He wrote:
> On 05/19/22 at 07:56am, Mimi Zohar wrote:
> > [Cc'ing Jarkko, linux-integrity]
> >
> > On Thu, 2022-05-19 at 08:39 +0800, Baoquan He wrote:
> > > On 05/18/22 at 01:29pm, Heiko Carstens wrote:
> > > > On Thu, May 12, 2022 at 03:01:23PM +0800, Coiby Xu wrote:
> > > > > From: Michal Suchanek <msuchanek@suse.de>
> > > > >
> > > > > commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > > > > adds support for KEXEC_SIG verification with keys from platform keyring
> > > > > but the built-in keys and secondary keyring are not used.
> > > > >
> > > > > Add support for the built-in keys and secondary keyring as x86 does.
> > > > >
> > > > > Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
> > > > > Cc: stable@vger.kernel.org
> > > > > Cc: Philipp Rudo <prudo@linux.ibm.com>
> > > > > Cc: kexec@lists.infradead.org
> > > > > Cc: keyrings@vger.kernel.org
> > > > > Cc: linux-security-module@vger.kernel.org
> > > > > Signed-off-by: Michal Suchanek <msuchanek@suse.de>
> > > > > Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
> > > > > Acked-by: Baoquan He <bhe@redhat.com>
> > > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > > > > ---
> > > > > arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
> > > > > 1 file changed, 13 insertions(+), 5 deletions(-)
> > > >
> > > > As far as I can tell this doesn't have any dependency to the other
> > > > patches in this series, so should I pick this up for the s390 tree, or
> > > > how will this go upstream?
> > >
> > > Thanks, Heiko.
> > >
> > > I want to ask Mimi if this can be taken into KEYS-ENCRYPTED tree.
> > > Otherwise I will ask Andrew to help pick this whole series.
> > >
> > > Surely, this patch 4 can be taken into s390 seperately since it's
> > > independent, both looks good.
> >
> > KEYS-ENCRYTPED is a type of key, unrelated to using the .platform,
> > .builtin, .machine, or .secondary keyrings. One of the main reasons
> > for this patch set is to use the new ".machine" keyring, which, if
> > enabled, is linked to the "secondary" keyring. However, the only
> > reference to the ".machine" keyring is in the cover letter, not any of
> > the patch descriptions. Since this is the basis for the system's
> > integrity, this seems like a pretty big omission.
> >
> > From patch 2/4:
> > "The code in bzImage64_verify_sig makes use of system keyrings
> > including
> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > verify signed kernel image as PE file..."
> >
> > From patch 3/4:
> > "This patch allows to verify arm64 kernel image signature using not
> > only
> > .builtin_trusted_keys but also .platform and .secondary_trusted_keys
> > keyring."
> >
> > From patch 4/4:
> > "... with keys from platform keyring but the built-in keys and
> > secondary keyring are not used."
> >
> > This patch set could probably go through KEYS/KEYRINGS_INTEGRITY, but
> > it's kind of late to be asking. Has it been in linux-next? Should I
> > assume this patch set has been fully tested or can we get some "tags"?
>
> Right, it should be KEYS/KEYRINGS_INTEGRITY related, I made mistaken.
> Now it got two ACKs from Michal and me. Michal met the same issue on
> arm64 and posted another series of patches, finally Coiby integrated
> Michal's patch and his to make this patchset. That would be great if
> this can get reviewing from experts on key/keyring. Surely, Coiby need
> update the patch log to add the '.machine' keyring into patch logs as
> you pointed out.
>
> IIRC, Coiby has tested it on x86_64/arm64, not sure if he took test on
> s390. No, this hasn't been in linux-next.
I used the s390 code on powerpc and there it did not work because the
built-in key was needed to verify the kernel.
I did not really run this on s390, only ported the fix I needed on
powerpc back to s390.
Thanks
Michal
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
2022-05-19 17:11 ` Michal Suchánek
@ 2022-06-16 1:46 ` Coiby Xu
0 siblings, 0 replies; 17+ messages in thread
From: Coiby Xu @ 2022-06-16 1:46 UTC (permalink / raw)
To: Mimi Zohar
Cc: Baoquan He, Michal Suchánek, Heiko Carstens, akpm, kexec,
keyrings, linux-arm-kernel, Dave Young, Will Deacon,
Eric W . Biederman, Chun-Yi Lee, stable, Philipp Rudo,
linux-security-module, Vasily Gorbik, Alexander Gordeev,
Christian Borntraeger, Sven Schnelle, Martin Schwidefsky,
open list:S390, open list, linux-integrity, Jarkko Sakkinen
Hi Mimi,
>> >
>> > This patch set could probably go through KEYS/KEYRINGS_INTEGRITY, but
>> > it's kind of late to be asking. Has it been in linux-next? Should I
>> > assume this patch set has been fully tested or can we get some "tags"?
>>
[...]
>>
>> IIRC, Coiby has tested it on x86_64/arm64, not sure if he took test on
>> s390. No, this hasn't been in linux-next.
For arm64, recently I did a new round of test and the patches works as
expected,
1. Build 5.19.0-rc2
2. generate keys and add them to .secondary_trusted_keys, MOK, UEFI
db;
3. sign different kernel images with different keys including keys
from .builtin_trusted_key, .secondary_trusted_keys keyring, UEFI db
key and MOK key
4. Without lockdown, all kernel images can be kexec'ed; with lockdown
enabled, only the kernel image signed by the key from
.builtin_trusted_key can be kexec'ed
Then I build a new kernel with the patches applied and confirm all
kernel images can be kexec'ed.
>
>I used the s390 code on powerpc and there it did not work because the
>built-in key was needed to verify the kernel.
>
>I did not really run this on s390, only ported the fix I needed on
>powerpc back to s390.
For 390, I commented out the code that skips signature verification
when secure boot is not enabled since I couldn't find a machine that
supports secure boot and confirm before applying the patch, kernel
images signed by keys from .builtin_trusted_key, .secondary_trusted_keys
couldn't be kexec'ed when lockdown is enabled; after applying the
patch, those kernel images could be kexec'ed.
>
>Thanks
>
>Michal
>
--
Best regards,
Coiby
^ permalink raw reply [flat|nested] 17+ messages in thread