Commit 5807fcaa authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 

Pull security subsystem updates from James Morris:

 - EVM gains support for loading an x509 cert from the kernel
   (EVM_LOAD_X509), into the EVM trusted kernel keyring.

 - Smack implements 'file receive' process-based permission checking for
   sockets, rather than just depending on inode checks.

 - Misc enhancments for TPM & TPM2.

 - Cleanups and bugfixes for SELinux, Keys, and IMA.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (41 commits)
  selinux: Inode label revalidation performance fix
  KEYS: refcount bug fix
  ima: ima_write_policy() limit locking
  IMA: policy can be updated zero times
  selinux: rate-limit netlink message warnings in selinux_nlmsg_perm()
  selinux: export validatetrans decisions
  gfs2: Invalid security labels of inodes when they go invalid
  selinux: Revalidate invalid inode security labels
  security: Add hook to invalidate inode security labels
  selinux: Add accessor functions for inode->i_security
  security: Make inode argument of inode_getsecid non-const
  security: Make inode argument of inode_getsecurity non-const
  selinux: Remove unused variable in selinux_inode_init_security
  keys, trusted: seal with a TPM2 authorization policy
  keys, trusted: select hash algorithm for TPM2 chips
  keys, trusted: fix: *do not* allow duplicate key options
  tpm_ibmvtpm: properly handle interrupted packet receptions
  tpm_tis: Tighten IRQ auto-probing
  tpm_tis: Refactor the interrupt setup
  tpm_tis: Get rid of the duplicate IRQ probing code
  ...
parents 2d663b55 acb2cfdb

Documentation/security/keys-trusted-encrypted.txt

+20 −11
Original line number Diff line number Diff line
@@ -38,6 +38,15 @@ Usage: 
       pcrlock=	     pcr number to be extended to "lock" blob

       migratable=   0|1 indicating permission to reseal to new PCR values,

                     default 1 (resealing allowed)

       hash=         hash algorithm name as a string. For TPM 1.x the only

                     allowed value is sha1. For TPM 2.x the allowed values

                     are sha1, sha256, sha384, sha512 and sm3-256.

       policydigest= digest for the authorization policy. must be calculated

                     with the same hash algorithm as specified by the 'hash='

                     option.

       policyhandle= handle to an authorization policy session that defines the

                     same policy and with the same hash algorithm as was used to

                     seal the key.



"keyctl print" returns an ascii hex copy of the sealed key, which is in standard

TPM_STORED_DATA format.  The key length for new keys are always in bytes.

crypto/asymmetric_keys/x509_public_key.c

+2 −0
Original line number Diff line number Diff line
@@ -321,6 +321,8 @@ static int x509_key_preparse(struct key_preparsed_payload *prep) 
			goto error_free_cert;

	} else if (!prep->trusted) {

		ret = x509_validate_trust(cert, get_system_trusted_keyring());

		if (ret)

			ret = x509_validate_trust(cert, get_ima_mok_keyring());

		if (!ret)

			prep->trusted = 1;

	}

crypto/hash_info.c

+2 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ const char *const hash_algo_name[HASH_ALGO__LAST] = { 
	[HASH_ALGO_TGR_128]	= "tgr128",

	[HASH_ALGO_TGR_160]	= "tgr160",

	[HASH_ALGO_TGR_192]	= "tgr192",

	[HASH_ALGO_SM3_256]	= "sm3-256",

};

EXPORT_SYMBOL_GPL(hash_algo_name);
@@ -52,5 +53,6 @@ const int hash_digest_size[HASH_ALGO__LAST] = { 
	[HASH_ALGO_TGR_128]	= TGR128_DIGEST_SIZE,

	[HASH_ALGO_TGR_160]	= TGR160_DIGEST_SIZE,

	[HASH_ALGO_TGR_192]	= TGR192_DIGEST_SIZE,

	[HASH_ALGO_SM3_256]	= SM3256_DIGEST_SIZE,

};

EXPORT_SYMBOL_GPL(hash_digest_size);

drivers/char/tpm/tpm-interface.c

+20 −3
Original line number Diff line number Diff line
@@ -310,10 +310,12 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, 
{

	int duration_idx = TPM_UNDEFINED;

	int duration = 0;

	u8 category = (ordinal >> 24) & 0xFF;



	if ((category == TPM_PROTECTED_COMMAND && ordinal < TPM_MAX_ORDINAL) ||

	    (category == TPM_CONNECTION_COMMAND && ordinal < TSC_MAX_ORDINAL))

	/*

	 * We only have a duration table for protected commands, where the upper

	 * 16 bits are 0. For the few other ordinals the fallback will be used.

	 */

	if (ordinal < TPM_MAX_ORDINAL)

		duration_idx = tpm_ordinal_duration[ordinal];



	if (duration_idx != TPM_UNDEFINED)
@@ -501,6 +503,21 @@ int tpm_get_timeouts(struct tpm_chip *chip) 
	struct duration_t *duration_cap;

	ssize_t rc;



	if (chip->flags & TPM_CHIP_FLAG_TPM2) {

		/* Fixed timeouts for TPM2 */

		chip->vendor.timeout_a = msecs_to_jiffies(TPM2_TIMEOUT_A);

		chip->vendor.timeout_b = msecs_to_jiffies(TPM2_TIMEOUT_B);

		chip->vendor.timeout_c = msecs_to_jiffies(TPM2_TIMEOUT_C);

		chip->vendor.timeout_d = msecs_to_jiffies(TPM2_TIMEOUT_D);

		chip->vendor.duration[TPM_SHORT] =

		    msecs_to_jiffies(TPM2_DURATION_SHORT);

		chip->vendor.duration[TPM_MEDIUM] =

		    msecs_to_jiffies(TPM2_DURATION_MEDIUM);

		chip->vendor.duration[TPM_LONG] =

		    msecs_to_jiffies(TPM2_DURATION_LONG);

		return 0;

	}



	tpm_cmd.header.in = tpm_getcap_header;

	tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;

	tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);

drivers/char/tpm/tpm.h

+7 −4
Original line number Diff line number Diff line
@@ -83,16 +83,20 @@ enum tpm2_structures { 
};



enum tpm2_return_codes {

	TPM2_RC_INITIALIZE	= 0x0100,

	TPM2_RC_TESTING		= 0x090A,

	TPM2_RC_HASH		= 0x0083, /* RC_FMT1 */

	TPM2_RC_INITIALIZE	= 0x0100, /* RC_VER1 */

	TPM2_RC_DISABLED	= 0x0120,

	TPM2_RC_TESTING		= 0x090A, /* RC_WARN */

};



enum tpm2_algorithms {

	TPM2_ALG_SHA1		= 0x0004,

	TPM2_ALG_KEYEDHASH	= 0x0008,

	TPM2_ALG_SHA256		= 0x000B,

	TPM2_ALG_NULL		= 0x0010

	TPM2_ALG_SHA384		= 0x000C,

	TPM2_ALG_SHA512		= 0x000D,

	TPM2_ALG_NULL		= 0x0010,

	TPM2_ALG_SM3_256	= 0x0012,

};



enum tpm2_command_codes {
@@ -138,7 +142,6 @@ struct tpm_vendor_specific { 
	unsigned long base;		/* TPM base address */



	int irq;

	int probed_irq;



	int region_size;

	int have_region;

CRA Git | Maintained and supported by SUSTech CRA and CCSE