Commit c8424e77 authored by Thiago Jung Bauermann's avatar Thiago Jung Bauermann Committed by Mimi Zohar
Browse files

MODSIGN: Export module signature definitions 



IMA will use the module_signature format for append signatures, so export
the relevant definitions and factor out the code which verifies that the
appended signature trailer is valid.

Also, create a CONFIG_MODULE_SIG_FORMAT option so that IMA can select it
and be able to use mod_check_sig() without having to depend on either
CONFIG_MODULE_SIG or CONFIG_MODULES.

s390 duplicated the definition of struct module_signature so now they can
use the new <linux/module_signature.h> header instead.

Signed-off-by: default avatarThiago Jung Bauermann <bauerman@linux.ibm.com>
Acked-by: default avatarJessica Yu <jeyu@kernel.org>
Reviewed-by: default avatarPhilipp Rudo <prudo@linux.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent b36f281f

arch/s390/Kconfig

+1 −1
Original line number Diff line number Diff line
@@ -538,7 +538,7 @@ config ARCH_HAS_KEXEC_PURGATORY 


config KEXEC_VERIFY_SIG

	bool "Verify kernel signature during kexec_file_load() syscall"

	depends on KEXEC_FILE && SYSTEM_DATA_VERIFICATION

	depends on KEXEC_FILE && MODULE_SIG_FORMAT

	help

	  This option makes kernel signature verification mandatory for

	  the kexec_file_load() syscall.

arch/s390/kernel/machine_kexec_file.c

+1 −23
Original line number Diff line number Diff line
@@ -10,7 +10,7 @@ 
#include <linux/elf.h>

#include <linux/errno.h>

#include <linux/kexec.h>

#include <linux/module.h>

#include <linux/module_signature.h>

#include <linux/verification.h>

#include <asm/boot_data.h>

#include <asm/ipl.h>
@@ -23,28 +23,6 @@ const struct kexec_file_ops * const kexec_file_loaders[] = { 
};



#ifdef CONFIG_KEXEC_VERIFY_SIG

/*

 * Module signature information block.

 *

 * The constituents of the signature section are, in order:

 *

 *	- Signer's name

 *	- Key identifier

 *	- Signature data

 *	- Information block

 */

struct module_signature {

	u8	algo;		/* Public-key crypto algorithm [0] */

	u8	hash;		/* Digest algorithm [0] */

	u8	id_type;	/* Key identifier type [PKEY_ID_PKCS7] */

	u8	signer_len;	/* Length of signer's name [0] */

	u8	key_id_len;	/* Length of key identifier [0] */

	u8	__pad[3];

	__be32	sig_len;	/* Length of signature data */

};



#define PKEY_ID_PKCS7 2



int s390_verify_sig(const char *kernel, unsigned long kernel_len)

{

	const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;

include/linux/module.h

+0 −3
Original line number Diff line number Diff line
@@ -26,9 +26,6 @@ 
#include <linux/percpu.h>

#include <asm/module.h>



/* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */

#define MODULE_SIG_STRING "~Module signature appended~\n"



/* Not Yet Implemented */

#define MODULE_SUPPORTED_DEVICE(name)

include/linux/module_signature.h

0 → 100644
+44 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0+ */

/*

 * Module signature handling.

 *

 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.

 * Written by David Howells (dhowells@redhat.com)

 */



#ifndef _LINUX_MODULE_SIGNATURE_H

#define _LINUX_MODULE_SIGNATURE_H



/* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */

#define MODULE_SIG_STRING "~Module signature appended~\n"



enum pkey_id_type {

	PKEY_ID_PGP,		/* OpenPGP generated key ID */

	PKEY_ID_X509,		/* X.509 arbitrary subjectKeyIdentifier */

	PKEY_ID_PKCS7,		/* Signature in PKCS#7 message */

};



/*

 * Module signature information block.

 *

 * The constituents of the signature section are, in order:

 *

 *	- Signer's name

 *	- Key identifier

 *	- Signature data

 *	- Information block

 */

struct module_signature {

	u8	algo;		/* Public-key crypto algorithm [0] */

	u8	hash;		/* Digest algorithm [0] */

	u8	id_type;	/* Key identifier type [PKEY_ID_PKCS7] */

	u8	signer_len;	/* Length of signer's name [0] */

	u8	key_id_len;	/* Length of key identifier [0] */

	u8	__pad[3];

	__be32	sig_len;	/* Length of signature data */

};



int mod_check_sig(const struct module_signature *ms, size_t file_len,

		  const char *name);



#endif /* _LINUX_MODULE_SIGNATURE_H */

init/Kconfig

+5 −1
Original line number Diff line number Diff line
@@ -1930,6 +1930,10 @@ config BASE_SMALL 
	default 0 if BASE_FULL

	default 1 if !BASE_FULL



config MODULE_SIG_FORMAT

	def_bool n

	select SYSTEM_DATA_VERIFICATION



menuconfig MODULES

	bool "Enable loadable module support"

	option modules
@@ -2007,7 +2011,7 @@ config MODULE_SRCVERSION_ALL 
config MODULE_SIG

	bool "Module signature verification"

	depends on MODULES

	select SYSTEM_DATA_VERIFICATION

	select MODULE_SIG_FORMAT

	help

	  Check modules for valid signatures upon load: the signature

	  is simply appended to the module. For more information see

CRA Git | Maintained and supported by SUSTech CRA and CCSE