* [PATCH v7 1/4] kexec: clean up arch_kexec_kernel_verify_sig
[not found] <20220512023402.9913-1-coxu@redhat.com>
@ 2022-05-12 2:33 ` Coiby Xu
2022-05-12 2:34 ` [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic Coiby Xu
` (2 subsequent siblings)
3 siblings, 0 replies; 9+ messages in thread
From: Coiby Xu @ 2022-05-12 2:33 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, stable,
open list
Currently there is no arch-specific implementation of
arch_kexec_kernel_verify_sig. Even if we want to add an implementation
for an architecture in the future, we can simply use "(struct
kexec_file_ops*)->verify_sig". So clean it up.
Note this patch is needed by later patches so Cc it to the stable tree
as well.
Cc: stable@vger.kernel.org
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
include/linux/kexec.h | 4 ----
kernel/kexec_file.c | 34 +++++++++++++---------------------
2 files changed, 13 insertions(+), 25 deletions(-)
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 58d1b58a971e..413235c6c797 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -202,10 +202,6 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
const Elf_Shdr *relsec,
const Elf_Shdr *symtab);
int arch_kimage_file_post_load_cleanup(struct kimage *image);
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
- unsigned long buf_len);
-#endif
int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 8347fc158d2b..3720435807eb 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -89,25 +89,6 @@ int __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
return kexec_image_post_load_cleanup_default(image);
}
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
- unsigned long buf_len)
-{
- if (!image->fops || !image->fops->verify_sig) {
- pr_debug("kernel loader does not support signature verification.\n");
- return -EKEYREJECTED;
- }
-
- return image->fops->verify_sig(buf, buf_len);
-}
-
-int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
- unsigned long buf_len)
-{
- return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
/*
* arch_kexec_apply_relocations_add - apply relocations of type RELA
* @pi: Purgatory to be relocated.
@@ -184,13 +165,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
}
#ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+ unsigned long buf_len)
+{
+ if (!image->fops || !image->fops->verify_sig) {
+ pr_debug("kernel loader does not support signature verification.\n");
+ return -EKEYREJECTED;
+ }
+
+ return image->fops->verify_sig(buf, buf_len);
+}
+
static int
kimage_validate_signature(struct kimage *image)
{
int ret;
- ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
- image->kernel_buf_len);
+ ret = kexec_image_verify_sig(image, image->kernel_buf,
+ image->kernel_buf_len);
if (ret) {
if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
--
2.35.3
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
[not found] <20220512023402.9913-1-coxu@redhat.com>
2022-05-12 2:33 ` [PATCH v7 1/4] kexec: clean up arch_kexec_kernel_verify_sig Coiby Xu
@ 2022-05-12 2:34 ` Coiby Xu
2022-05-12 2:46 ` Baoquan He
2022-05-12 2:34 ` [PATCH v7 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature Coiby Xu
2022-05-12 2:34 ` [PATCH v7 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification Coiby Xu
3 siblings, 1 reply; 9+ messages in thread
From: Coiby Xu @ 2022-05-12 2:34 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee,
keyrings, linux-security-module, stable, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
signature verify") adds platform keyring support on x86 kexec but not
arm64.
The code in bzImage64_verify_sig makes use of system keyrings including
.buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
verify signed kernel image as PE file. Make it generic so both x86_64
and arm64 can use it.
Note this patch is needed by a later patch so Cc it to the stable tree
as well.
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
include/linux/kexec.h | 7 +++++++
kernel/kexec_file.c | 17 +++++++++++++++++
3 files changed, 25 insertions(+), 19 deletions(-)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 170d0fd68b1f..f299b48f9c9f 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -17,7 +17,6 @@
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/efi.h>
-#include <linux/verification.h>
#include <asm/bootparam.h>
#include <asm/setup.h>
@@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
return 0;
}
-#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
-static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
-{
- int ret;
-
- ret = verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_SECONDARY_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
- if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
- ret = verify_pefile_signature(kernel, kernel_len,
- VERIFY_USE_PLATFORM_KEYRING,
- VERIFYING_KEXEC_PE_SIGNATURE);
- }
- return ret;
-}
-#endif
-
const struct kexec_file_ops kexec_bzImage64_ops = {
.probe = bzImage64_probe,
.load = bzImage64_load,
.cleanup = bzImage64_cleanup,
#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
- .verify_sig = bzImage64_verify_sig,
+ .verify_sig = kexec_kernel_verify_pe_sig,
#endif
};
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 413235c6c797..da83abfc628b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -19,6 +19,7 @@
#include <asm/io.h>
#include <uapi/linux/kexec.h>
+#include <linux/verification.h>
/* Location of a reserved region to hold the crash kernel.
*/
@@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
const Elf_Shdr *relsec,
const Elf_Shdr *symtab);
int arch_kimage_file_post_load_cleanup(struct kimage *image);
+#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel,
+ unsigned long kernel_len);
+#endif
+#endif
int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 3720435807eb..754885b96aab 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
}
#ifdef CONFIG_KEXEC_SIG
+#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
+int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
+{
+ int ret;
+
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+ ret = verify_pefile_signature(kernel, kernel_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ return ret;
+}
+#endif
+
static int kexec_image_verify_sig(struct kimage *image, void *buf,
unsigned long buf_len)
{
--
2.35.3
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-05-12 2:34 ` [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic Coiby Xu
@ 2022-05-12 2:46 ` Baoquan He
2022-05-12 3:52 ` Baoquan He
0 siblings, 1 reply; 9+ messages in thread
From: Baoquan He @ 2022-05-12 2:46 UTC (permalink / raw)
To: Coiby Xu
Cc: kexec, linux-arm-kernel, Michal Suchanek, Dave Young, Will Deacon,
Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, keyrings,
linux-security-module, stable, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
On 05/12/22 at 10:34am, Coiby Xu wrote:
> commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> signature verify") adds platform keyring support on x86 kexec but not
> arm64.
>
> The code in bzImage64_verify_sig makes use of system keyrings including
> .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> verify signed kernel image as PE file. Make it generic so both x86_64
> and arm64 can use it.
>
> Note this patch is needed by a later patch so Cc it to the stable tree
> as well.
This note should not be added in log.
>
> Cc: kexec@lists.infradead.org
> Cc: keyrings@vger.kernel.org
> Cc: linux-security-module@vger.kernel.org
> Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
You can put the note here, it won't be added to commit log when merged.
Maybe it can be removed when merged.
Otherwise, LGTM
Acked-by: Baoquan He <bhe@redhat.com>
> arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> include/linux/kexec.h | 7 +++++++
> kernel/kexec_file.c | 17 +++++++++++++++++
> 3 files changed, 25 insertions(+), 19 deletions(-)
>
> diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> index 170d0fd68b1f..f299b48f9c9f 100644
> --- a/arch/x86/kernel/kexec-bzimage64.c
> +++ b/arch/x86/kernel/kexec-bzimage64.c
> @@ -17,7 +17,6 @@
> #include <linux/kernel.h>
> #include <linux/mm.h>
> #include <linux/efi.h>
> -#include <linux/verification.h>
>
> #include <asm/bootparam.h>
> #include <asm/setup.h>
> @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> return 0;
> }
>
> -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> -{
> - int ret;
> -
> - ret = verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_SECONDARY_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> - if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> - ret = verify_pefile_signature(kernel, kernel_len,
> - VERIFY_USE_PLATFORM_KEYRING,
> - VERIFYING_KEXEC_PE_SIGNATURE);
> - }
> - return ret;
> -}
> -#endif
> -
> const struct kexec_file_ops kexec_bzImage64_ops = {
> .probe = bzImage64_probe,
> .load = bzImage64_load,
> .cleanup = bzImage64_cleanup,
> #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> - .verify_sig = bzImage64_verify_sig,
> + .verify_sig = kexec_kernel_verify_pe_sig,
> #endif
> };
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 413235c6c797..da83abfc628b 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -19,6 +19,7 @@
> #include <asm/io.h>
>
> #include <uapi/linux/kexec.h>
> +#include <linux/verification.h>
>
> /* Location of a reserved region to hold the crash kernel.
> */
> @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> const Elf_Shdr *relsec,
> const Elf_Shdr *symtab);
> int arch_kimage_file_post_load_cleanup(struct kimage *image);
> +#ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel,
> + unsigned long kernel_len);
> +#endif
> +#endif
> int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>
> extern int kexec_add_buffer(struct kexec_buf *kbuf);
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 3720435807eb..754885b96aab 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> }
>
> #ifdef CONFIG_KEXEC_SIG
> +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> +{
> + int ret;
> +
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_SECONDARY_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> + ret = verify_pefile_signature(kernel, kernel_len,
> + VERIFY_USE_PLATFORM_KEYRING,
> + VERIFYING_KEXEC_PE_SIGNATURE);
> + }
> + return ret;
> +}
> +#endif
> +
> static int kexec_image_verify_sig(struct kimage *image, void *buf,
> unsigned long buf_len)
> {
> --
> 2.35.3
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-05-12 2:46 ` Baoquan He
@ 2022-05-12 3:52 ` Baoquan He
2022-05-12 4:33 ` Coiby Xu
0 siblings, 1 reply; 9+ messages in thread
From: Baoquan He @ 2022-05-12 3:52 UTC (permalink / raw)
To: Coiby Xu
Cc: kexec, linux-arm-kernel, Michal Suchanek, Dave Young, Will Deacon,
Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, keyrings,
linux-security-module, stable, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
On 05/12/22 at 10:46am, Baoquan He wrote:
> On 05/12/22 at 10:34am, Coiby Xu wrote:
> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > signature verify") adds platform keyring support on x86 kexec but not
> > arm64.
> >
> > The code in bzImage64_verify_sig makes use of system keyrings including
> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > verify signed kernel image as PE file. Make it generic so both x86_64
> > and arm64 can use it.
> >
> > Note this patch is needed by a later patch so Cc it to the stable tree
> > as well.
>
> This note should not be added in log.
>
> >
> > Cc: kexec@lists.infradead.org
> > Cc: keyrings@vger.kernel.org
> > Cc: linux-security-module@vger.kernel.org
> > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Hold on, should we CC stable when it's not fixing an issue?
Hi Coiby,
Just to make clear , is this patch fixing an issue, or it's just an
preparation for later patch's use?
Or I should ask in another way, any problem is solved with this patch?
> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > ---
>
> You can put the note here, it won't be added to commit log when merged.
> Maybe it can be removed when merged.
>
> Otherwise, LGTM
>
> Acked-by: Baoquan He <bhe@redhat.com>
>
> > arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> > include/linux/kexec.h | 7 +++++++
> > kernel/kexec_file.c | 17 +++++++++++++++++
> > 3 files changed, 25 insertions(+), 19 deletions(-)
> >
> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > index 170d0fd68b1f..f299b48f9c9f 100644
> > --- a/arch/x86/kernel/kexec-bzimage64.c
> > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > @@ -17,7 +17,6 @@
> > #include <linux/kernel.h>
> > #include <linux/mm.h>
> > #include <linux/efi.h>
> > -#include <linux/verification.h>
> >
> > #include <asm/bootparam.h>
> > #include <asm/setup.h>
> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> > return 0;
> > }
> >
> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > -{
> > - int ret;
> > -
> > - ret = verify_pefile_signature(kernel, kernel_len,
> > - VERIFY_USE_SECONDARY_KEYRING,
> > - VERIFYING_KEXEC_PE_SIGNATURE);
> > - if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > - ret = verify_pefile_signature(kernel, kernel_len,
> > - VERIFY_USE_PLATFORM_KEYRING,
> > - VERIFYING_KEXEC_PE_SIGNATURE);
> > - }
> > - return ret;
> > -}
> > -#endif
> > -
> > const struct kexec_file_ops kexec_bzImage64_ops = {
> > .probe = bzImage64_probe,
> > .load = bzImage64_load,
> > .cleanup = bzImage64_cleanup,
> > #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > - .verify_sig = bzImage64_verify_sig,
> > + .verify_sig = kexec_kernel_verify_pe_sig,
> > #endif
> > };
> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > index 413235c6c797..da83abfc628b 100644
> > --- a/include/linux/kexec.h
> > +++ b/include/linux/kexec.h
> > @@ -19,6 +19,7 @@
> > #include <asm/io.h>
> >
> > #include <uapi/linux/kexec.h>
> > +#include <linux/verification.h>
> >
> > /* Location of a reserved region to hold the crash kernel.
> > */
> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> > const Elf_Shdr *relsec,
> > const Elf_Shdr *symtab);
> > int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > +#ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > + unsigned long kernel_len);
> > +#endif
> > +#endif
> > int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> >
> > extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > index 3720435807eb..754885b96aab 100644
> > --- a/kernel/kexec_file.c
> > +++ b/kernel/kexec_file.c
> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> > }
> >
> > #ifdef CONFIG_KEXEC_SIG
> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > +{
> > + int ret;
> > +
> > + ret = verify_pefile_signature(kernel, kernel_len,
> > + VERIFY_USE_SECONDARY_KEYRING,
> > + VERIFYING_KEXEC_PE_SIGNATURE);
> > + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > + ret = verify_pefile_signature(kernel, kernel_len,
> > + VERIFY_USE_PLATFORM_KEYRING,
> > + VERIFYING_KEXEC_PE_SIGNATURE);
> > + }
> > + return ret;
> > +}
> > +#endif
> > +
> > static int kexec_image_verify_sig(struct kimage *image, void *buf,
> > unsigned long buf_len)
> > {
> > --
> > 2.35.3
> >
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-05-12 3:52 ` Baoquan He
@ 2022-05-12 4:33 ` Coiby Xu
2022-05-12 6:22 ` Baoquan He
0 siblings, 1 reply; 9+ messages in thread
From: Coiby Xu @ 2022-05-12 4:33 UTC (permalink / raw)
To: Baoquan He
Cc: kexec, linux-arm-kernel, Michal Suchanek, Dave Young, Will Deacon,
Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, keyrings,
linux-security-module, stable, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
>On 05/12/22 at 10:46am, Baoquan He wrote:
>> On 05/12/22 at 10:34am, Coiby Xu wrote:
>> > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
>> > signature verify") adds platform keyring support on x86 kexec but not
>> > arm64.
>> >
>> > The code in bzImage64_verify_sig makes use of system keyrings including
>> > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
>> > verify signed kernel image as PE file. Make it generic so both x86_64
>> > and arm64 can use it.
>> >
>> > Note this patch is needed by a later patch so Cc it to the stable tree
>> > as well.
>>
>> This note should not be added in log.
>>
>> >
>> > Cc: kexec@lists.infradead.org
>> > Cc: keyrings@vger.kernel.org
>> > Cc: linux-security-module@vger.kernel.org
>> > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
>
>Hold on, should we CC stable when it's not fixing an issue?
>
>Hi Coiby,
Hi Baoquan,
>
>Just to make clear , is this patch fixing an issue, or it's just an
>preparation for later patch's use?
>
>Or I should ask in another way, any problem is solved with this patch?
At least it doesn't fix an issue that satisfy the criteria listed in
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
>
>> > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > ---
>>
>> You can put the note here, it won't be added to commit log when merged.
>> Maybe it can be removed when merged.
Thanks for the suggestion! Shall I send a version to fix this problem or
can I just bother the maintainer to remove it?
>>
>> Otherwise, LGTM
>>
>> Acked-by: Baoquan He <bhe@redhat.com>
>>
>> > arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
>> > include/linux/kexec.h | 7 +++++++
>> > kernel/kexec_file.c | 17 +++++++++++++++++
>> > 3 files changed, 25 insertions(+), 19 deletions(-)
>> >
>> > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
>> > index 170d0fd68b1f..f299b48f9c9f 100644
>> > --- a/arch/x86/kernel/kexec-bzimage64.c
>> > +++ b/arch/x86/kernel/kexec-bzimage64.c
>> > @@ -17,7 +17,6 @@
>> > #include <linux/kernel.h>
>> > #include <linux/mm.h>
>> > #include <linux/efi.h>
>> > -#include <linux/verification.h>
>> >
>> > #include <asm/bootparam.h>
>> > #include <asm/setup.h>
>> > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
>> > return 0;
>> > }
>> >
>> > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
>> > -{
>> > - int ret;
>> > -
>> > - ret = verify_pefile_signature(kernel, kernel_len,
>> > - VERIFY_USE_SECONDARY_KEYRING,
>> > - VERIFYING_KEXEC_PE_SIGNATURE);
>> > - if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > - ret = verify_pefile_signature(kernel, kernel_len,
>> > - VERIFY_USE_PLATFORM_KEYRING,
>> > - VERIFYING_KEXEC_PE_SIGNATURE);
>> > - }
>> > - return ret;
>> > -}
>> > -#endif
>> > -
>> > const struct kexec_file_ops kexec_bzImage64_ops = {
>> > .probe = bzImage64_probe,
>> > .load = bzImage64_load,
>> > .cleanup = bzImage64_cleanup,
>> > #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
>> > - .verify_sig = bzImage64_verify_sig,
>> > + .verify_sig = kexec_kernel_verify_pe_sig,
>> > #endif
>> > };
>> > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
>> > index 413235c6c797..da83abfc628b 100644
>> > --- a/include/linux/kexec.h
>> > +++ b/include/linux/kexec.h
>> > @@ -19,6 +19,7 @@
>> > #include <asm/io.h>
>> >
>> > #include <uapi/linux/kexec.h>
>> > +#include <linux/verification.h>
>> >
>> > /* Location of a reserved region to hold the crash kernel.
>> > */
>> > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
>> > const Elf_Shdr *relsec,
>> > const Elf_Shdr *symtab);
>> > int arch_kimage_file_post_load_cleanup(struct kimage *image);
>> > +#ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel,
>> > + unsigned long kernel_len);
>> > +#endif
>> > +#endif
>> > int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
>> >
>> > extern int kexec_add_buffer(struct kexec_buf *kbuf);
>> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
>> > index 3720435807eb..754885b96aab 100644
>> > --- a/kernel/kexec_file.c
>> > +++ b/kernel/kexec_file.c
>> > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>> > }
>> >
>> > #ifdef CONFIG_KEXEC_SIG
>> > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
>> > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
>> > +{
>> > + int ret;
>> > +
>> > + ret = verify_pefile_signature(kernel, kernel_len,
>> > + VERIFY_USE_SECONDARY_KEYRING,
>> > + VERIFYING_KEXEC_PE_SIGNATURE);
>> > + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
>> > + ret = verify_pefile_signature(kernel, kernel_len,
>> > + VERIFY_USE_PLATFORM_KEYRING,
>> > + VERIFYING_KEXEC_PE_SIGNATURE);
>> > + }
>> > + return ret;
>> > +}
>> > +#endif
>> > +
>> > static int kexec_image_verify_sig(struct kimage *image, void *buf,
>> > unsigned long buf_len)
>> > {
>> > --
>> > 2.35.3
>> >
>>
>
--
Best regards,
Coiby
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-05-12 4:33 ` Coiby Xu
@ 2022-05-12 6:22 ` Baoquan He
2022-05-12 6:54 ` Coiby Xu
0 siblings, 1 reply; 9+ messages in thread
From: Baoquan He @ 2022-05-12 6:22 UTC (permalink / raw)
To: Coiby Xu
Cc: kexec, linux-arm-kernel, Michal Suchanek, Dave Young, Will Deacon,
Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, keyrings,
linux-security-module, stable, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
On 05/12/22 at 12:33pm, Coiby Xu wrote:
> On Thu, May 12, 2022 at 11:52:09AM +0800, Baoquan He wrote:
> > On 05/12/22 at 10:46am, Baoquan He wrote:
> > > On 05/12/22 at 10:34am, Coiby Xu wrote:
> > > > commit 278311e417be ("kexec, KEYS: Make use of platform keyring for
> > > > signature verify") adds platform keyring support on x86 kexec but not
> > > > arm64.
> > > >
> > > > The code in bzImage64_verify_sig makes use of system keyrings including
> > > > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to
> > > > verify signed kernel image as PE file. Make it generic so both x86_64
> > > > and arm64 can use it.
> > > >
> > > > Note this patch is needed by a later patch so Cc it to the stable tree
> > > > as well.
> > >
> > > This note should not be added in log.
> > >
> > > >
> > > > Cc: kexec@lists.infradead.org
> > > > Cc: keyrings@vger.kernel.org
> > > > Cc: linux-security-module@vger.kernel.org
> > > > Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
> >
> > Hold on, should we CC stable when it's not fixing an issue?
> >
> > Hi Coiby,
>
> Hi Baoquan,
>
> >
> > Just to make clear , is this patch fixing an issue, or it's just an
> > preparation for later patch's use?
> >
> > Or I should ask in another way, any problem is solved with this patch?
>
> At least it doesn't fix an issue that satisfy the criteria listed in
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
Then it should not be CC-ed to stable.
>
> >
> >
> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
> > > > ---
> > >
> > > You can put the note here, it won't be added to commit log when merged.
> > > Maybe it can be removed when merged.
>
> Thanks for the suggestion! Shall I send a version to fix this problem or
> can I just bother the maintainer to remove it?
Better send a clean one, it will save maintainer's time, they can pick
it directly.
>
>
> > >
> > > Otherwise, LGTM
> > >
> > > Acked-by: Baoquan He <bhe@redhat.com>
> > >
> > > > arch/x86/kernel/kexec-bzimage64.c | 20 +-------------------
> > > > include/linux/kexec.h | 7 +++++++
> > > > kernel/kexec_file.c | 17 +++++++++++++++++
> > > > 3 files changed, 25 insertions(+), 19 deletions(-)
> > > >
> > > > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > > > index 170d0fd68b1f..f299b48f9c9f 100644
> > > > --- a/arch/x86/kernel/kexec-bzimage64.c
> > > > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > > > @@ -17,7 +17,6 @@
> > > > #include <linux/kernel.h>
> > > > #include <linux/mm.h>
> > > > #include <linux/efi.h>
> > > > -#include <linux/verification.h>
> > > >
> > > > #include <asm/bootparam.h>
> > > > #include <asm/setup.h>
> > > > @@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)
> > > > return 0;
> > > > }
> > > >
> > > > -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > -static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
> > > > -{
> > > > - int ret;
> > > > -
> > > > - ret = verify_pefile_signature(kernel, kernel_len,
> > > > - VERIFY_USE_SECONDARY_KEYRING,
> > > > - VERIFYING_KEXEC_PE_SIGNATURE);
> > > > - if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > - ret = verify_pefile_signature(kernel, kernel_len,
> > > > - VERIFY_USE_PLATFORM_KEYRING,
> > > > - VERIFYING_KEXEC_PE_SIGNATURE);
> > > > - }
> > > > - return ret;
> > > > -}
> > > > -#endif
> > > > -
> > > > const struct kexec_file_ops kexec_bzImage64_ops = {
> > > > .probe = bzImage64_probe,
> > > > .load = bzImage64_load,
> > > > .cleanup = bzImage64_cleanup,
> > > > #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
> > > > - .verify_sig = bzImage64_verify_sig,
> > > > + .verify_sig = kexec_kernel_verify_pe_sig,
> > > > #endif
> > > > };
> > > > diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> > > > index 413235c6c797..da83abfc628b 100644
> > > > --- a/include/linux/kexec.h
> > > > +++ b/include/linux/kexec.h
> > > > @@ -19,6 +19,7 @@
> > > > #include <asm/io.h>
> > > >
> > > > #include <uapi/linux/kexec.h>
> > > > +#include <linux/verification.h>
> > > >
> > > > /* Location of a reserved region to hold the crash kernel.
> > > > */
> > > > @@ -202,6 +203,12 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
> > > > const Elf_Shdr *relsec,
> > > > const Elf_Shdr *symtab);
> > > > int arch_kimage_file_post_load_cleanup(struct kimage *image);
> > > > +#ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel,
> > > > + unsigned long kernel_len);
> > > > +#endif
> > > > +#endif
> > > > int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
> > > >
> > > > extern int kexec_add_buffer(struct kexec_buf *kbuf);
> > > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > > > index 3720435807eb..754885b96aab 100644
> > > > --- a/kernel/kexec_file.c
> > > > +++ b/kernel/kexec_file.c
> > > > @@ -165,6 +165,23 @@ void kimage_file_post_load_cleanup(struct kimage *image)
> > > > }
> > > >
> > > > #ifdef CONFIG_KEXEC_SIG
> > > > +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
> > > > +int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
> > > > +{
> > > > + int ret;
> > > > +
> > > > + ret = verify_pefile_signature(kernel, kernel_len,
> > > > + VERIFY_USE_SECONDARY_KEYRING,
> > > > + VERIFYING_KEXEC_PE_SIGNATURE);
> > > > + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
> > > > + ret = verify_pefile_signature(kernel, kernel_len,
> > > > + VERIFY_USE_PLATFORM_KEYRING,
> > > > + VERIFYING_KEXEC_PE_SIGNATURE);
> > > > + }
> > > > + return ret;
> > > > +}
> > > > +#endif
> > > > +
> > > > static int kexec_image_verify_sig(struct kimage *image, void *buf,
> > > > unsigned long buf_len)
> > > > {
> > > > --
> > > > 2.35.3
> > > >
> > >
> >
>
> --
> Best regards,
> Coiby
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic
2022-05-12 6:22 ` Baoquan He
@ 2022-05-12 6:54 ` Coiby Xu
0 siblings, 0 replies; 9+ messages in thread
From: Coiby Xu @ 2022-05-12 6:54 UTC (permalink / raw)
To: Baoquan He
Cc: kexec, linux-arm-kernel, Michal Suchanek, Dave Young, Will Deacon,
Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, keyrings,
linux-security-module, stable, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)
On Thu, May 12, 2022 at 02:22:57PM +0800, Baoquan He wrote:
>On 05/12/22 at 12:33pm, Coiby Xu wrote:
[...]
>> > Just to make clear , is this patch fixing an issue, or it's just an
>> > preparation for later patch's use?
>> >
>> > Or I should ask in another way, any problem is solved with this patch?
>>
>> At least it doesn't fix an issue that satisfy the criteria listed in
>> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
>Then it should not be CC-ed to stable.
OK, I'll drop "CC:" in next version.
>
>>
>> >
>> >
>> > > > Reviewed-by: Michal Suchanek <msuchanek@suse.de>
>> > > > Signed-off-by: Coiby Xu <coxu@redhat.com>
>> > > > ---
>> > >
>> > > You can put the note here, it won't be added to commit log when merged.
>> > > Maybe it can be removed when merged.
>>
>> Thanks for the suggestion! Shall I send a version to fix this problem or
>> can I just bother the maintainer to remove it?
>
>Better send a clean one, it will save maintainer's time, they can pick
>it directly.
Thanks for the confirmation! I'll simply delete them because,
1. these notes don't make sense anymore if I don't CC the patches to the stable
tree
2. I've explained in the cover letter the first two patches
are the prerequisite patches for the 3rd patch.
--
Best regards,
Coiby
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v7 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature
[not found] <20220512023402.9913-1-coxu@redhat.com>
2022-05-12 2:33 ` [PATCH v7 1/4] kexec: clean up arch_kexec_kernel_verify_sig Coiby Xu
2022-05-12 2:34 ` [PATCH v7 2/4] kexec, KEYS: make the code in bzImage64_verify_sig generic Coiby Xu
@ 2022-05-12 2:34 ` Coiby Xu
2022-05-12 2:34 ` [PATCH v7 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification Coiby Xu
3 siblings, 0 replies; 9+ messages in thread
From: Coiby Xu @ 2022-05-12 2:34 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, stable,
keyrings, linux-security-module, Catalin Marinas, James Morse,
AKASHI Takahiro, open list
Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7".
This happens because image_verify_sig uses only the primary keyring that
contains only kernel built-in keys to verify the kexec image.
This patch allows to verify arm64 kernel image signature using not only
.builtin_trusted_keys but also .platform and .secondary_trusted_keys
keyring.
Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
Acked-by: Baoquan He <bhe@redhat.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Co-developed-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
arch/arm64/kernel/kexec_image.c | 11 +----------
1 file changed, 1 insertion(+), 10 deletions(-)
diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index 9ec34690e255..5ed6a585f21f 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -14,7 +14,6 @@
#include <linux/kexec.h>
#include <linux/pe.h>
#include <linux/string.h>
-#include <linux/verification.h>
#include <asm/byteorder.h>
#include <asm/cpufeature.h>
#include <asm/image.h>
@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
return NULL;
}
-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
-{
- return verify_pefile_signature(kernel, kernel_len, NULL,
- VERIFYING_KEXEC_PE_SIGNATURE);
-}
-#endif
-
const struct kexec_file_ops kexec_image_ops = {
.probe = image_probe,
.load = image_load,
#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
- .verify_sig = image_verify_sig,
+ .verify_sig = kexec_kernel_verify_pe_sig,
#endif
};
--
2.35.3
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v7 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
[not found] <20220512023402.9913-1-coxu@redhat.com>
` (2 preceding siblings ...)
2022-05-12 2:34 ` [PATCH v7 3/4] arm64: kexec_file: use more system keyrings to verify kernel image signature Coiby Xu
@ 2022-05-12 2:34 ` Coiby Xu
3 siblings, 0 replies; 9+ messages in thread
From: Coiby Xu @ 2022-05-12 2:34 UTC (permalink / raw)
To: kexec
Cc: linux-arm-kernel, Michal Suchanek, Baoquan He, Dave Young,
Will Deacon, Eric W . Biederman, Mimi Zohar, Chun-Yi Lee, stable,
Philipp Rudo, keyrings, linux-security-module, Heiko Carstens,
Vasily Gorbik, Alexander Gordeev, Christian Borntraeger,
Sven Schnelle, Martin Schwidefsky, open list:S390, open list
From: Michal Suchanek <msuchanek@suse.de>
commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
adds support for KEXEC_SIG verification with keys from platform keyring
but the built-in keys and secondary keyring are not used.
Add support for the built-in keys and secondary keyring as x86 does.
Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype")
Cc: stable@vger.kernel.org
Cc: Philipp Rudo <prudo@linux.ibm.com>
Cc: kexec@lists.infradead.org
Cc: keyrings@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
index 8f43575a4dd3..fc6d5f58debe 100644
--- a/arch/s390/kernel/machine_kexec_file.c
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -31,6 +31,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;
struct module_signature *ms;
unsigned long sig_len;
+ int ret;
/* Skip signature verification when not secure IPLed. */
if (!ipl_secure_flag)
@@ -65,11 +66,18 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len)
return -EBADMSG;
}
- return verify_pkcs7_signature(kernel, kernel_len,
- kernel + kernel_len, sig_len,
- VERIFY_USE_PLATFORM_KEYRING,
- VERIFYING_MODULE_SIGNATURE,
- NULL, NULL);
+ ret = verify_pkcs7_signature(kernel, kernel_len,
+ kernel + kernel_len, sig_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_MODULE_SIGNATURE,
+ NULL, NULL);
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
+ ret = verify_pkcs7_signature(kernel, kernel_len,
+ kernel + kernel_len, sig_len,
+ VERIFY_USE_PLATFORM_KEYRING,
+ VERIFYING_MODULE_SIGNATURE,
+ NULL, NULL);
+ return ret;
}
#endif /* CONFIG_KEXEC_SIG */
--
2.35.3
^ permalink raw reply related [flat|nested] 9+ messages in thread