change system file

hc

2024-10-09 244b2c5ca8b14627e4a17755e5922221e121c771

 kernel/kernel/module_signing.c
..
..
@@ -1,46 +1,18 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
1
2
 /* Module signature checker
2
3
  *
3
4
  * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
4
5
  * Written by David Howells (dhowells@redhat.com)
5
- *
6
- * This program is free software; you can redistribute it and/or
7
- * modify it under the terms of the GNU General Public Licence
8
- * as published by the Free Software Foundation; either version
9
- * 2 of the Licence, or (at your option) any later version.
10
6
  */
11
7
 
12
8
 #include <linux/kernel.h>
13
9
 #include <linux/errno.h>
10
+#include <linux/module.h>
11
+#include <linux/module_signature.h>
14
12
 #include <linux/string.h>
15
13
 #include <linux/verification.h>
16
14
 #include <crypto/public_key.h>
17
15
 #include "module-internal.h"
18
-
19
-enum pkey_id_type {
20
-	PKEY_ID_PGP,		/* OpenPGP generated key ID */
21
-	PKEY_ID_X509,		/* X.509 arbitrary subjectKeyIdentifier */
22
-	PKEY_ID_PKCS7,		/* Signature in PKCS#7 message */
23
-};
24
-
25
-/*
26
- * Module signature information block.
27
- *
28
- * The constituents of the signature section are, in order:
29
- *
30
- *	- Signer's name
31
- *	- Key identifier
32
- *	- Signature data
33
- *	- Information block
34
- */
35
-struct module_signature {
36
-	u8	algo;		/* Public-key crypto algorithm [0] */
37
-	u8	hash;		/* Digest algorithm [0] */
38
-	u8	id_type;	/* Key identifier type [PKEY_ID_PKCS7] */
39
-	u8	signer_len;	/* Length of signer's name [0] */
40
-	u8	key_id_len;	/* Length of key identifier [0] */
41
-	u8	__pad[3];
42
-	__be32	sig_len;	/* Length of signature data */
43
-};
44
16
 
45
17
 /*
46
18
  * Verify the signature on a module.
..
..
@@ -49,6 +21,7 @@
49
21
 {
50
22
 	struct module_signature ms;
51
23
 	size_t sig_len, modlen = info->len;
24
+	int ret;
52
25
 
53
26
 	pr_devel("==>%s(,%zu)\n", __func__, modlen);
54
27
 
..
..
@@ -56,33 +29,17 @@
56
29
 		return -EBADMSG;
57
30
 
58
31
 	memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
59
-	modlen -= sizeof(ms);
32
+
33
+	ret = mod_check_sig(&ms, modlen, "module");
34
+	if (ret)
35
+		return ret;
60
36
 
61
37
 	sig_len = be32_to_cpu(ms.sig_len);
62
-	if (sig_len >= modlen)
63
-		return -EBADMSG;
64
-	modlen -= sig_len;
38
+	modlen -= sig_len + sizeof(ms);
65
39
 	info->len = modlen;
66
40
 
67
-	if (ms.id_type != PKEY_ID_PKCS7) {
68
-		pr_err("%s: Module is not signed with expected PKCS#7 message\n",
69
-		       info->name);
70
-		return -ENOPKG;
71
-	}
72
-
73
-	if (ms.algo != 0 ||
74
-	    ms.hash != 0 ||
75
-	    ms.signer_len != 0 ||
76
-	    ms.key_id_len != 0 ||
77
-	    ms.__pad[0] != 0 ||
78
-	    ms.__pad[1] != 0 ||
79
-	    ms.__pad[2] != 0) {
80
-		pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n",
81
-		       info->name);
82
-		return -EBADMSG;
83
-	}
84
-
85
41
 	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
86
-				      NULL, VERIFYING_MODULE_SIGNATURE,
42
+				      VERIFY_USE_SECONDARY_KEYRING,
43
+				      VERIFYING_MODULE_SIGNATURE,
87
44
 				      NULL, NULL);
88
45
 }