.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-or-later |
---|
1 | 2 | /* Module signature checker |
---|
2 | 3 | * |
---|
3 | 4 | * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. |
---|
4 | 5 | * Written by David Howells (dhowells@redhat.com) |
---|
5 | | - * |
---|
6 | | - * This program is free software; you can redistribute it and/or |
---|
7 | | - * modify it under the terms of the GNU General Public Licence |
---|
8 | | - * as published by the Free Software Foundation; either version |
---|
9 | | - * 2 of the Licence, or (at your option) any later version. |
---|
10 | 6 | */ |
---|
11 | 7 | |
---|
12 | 8 | #include <linux/kernel.h> |
---|
13 | 9 | #include <linux/errno.h> |
---|
| 10 | +#include <linux/module.h> |
---|
| 11 | +#include <linux/module_signature.h> |
---|
14 | 12 | #include <linux/string.h> |
---|
15 | 13 | #include <linux/verification.h> |
---|
16 | 14 | #include <crypto/public_key.h> |
---|
17 | 15 | #include "module-internal.h" |
---|
18 | | - |
---|
19 | | -enum pkey_id_type { |
---|
20 | | - PKEY_ID_PGP, /* OpenPGP generated key ID */ |
---|
21 | | - PKEY_ID_X509, /* X.509 arbitrary subjectKeyIdentifier */ |
---|
22 | | - PKEY_ID_PKCS7, /* Signature in PKCS#7 message */ |
---|
23 | | -}; |
---|
24 | | - |
---|
25 | | -/* |
---|
26 | | - * Module signature information block. |
---|
27 | | - * |
---|
28 | | - * The constituents of the signature section are, in order: |
---|
29 | | - * |
---|
30 | | - * - Signer's name |
---|
31 | | - * - Key identifier |
---|
32 | | - * - Signature data |
---|
33 | | - * - Information block |
---|
34 | | - */ |
---|
35 | | -struct module_signature { |
---|
36 | | - u8 algo; /* Public-key crypto algorithm [0] */ |
---|
37 | | - u8 hash; /* Digest algorithm [0] */ |
---|
38 | | - u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */ |
---|
39 | | - u8 signer_len; /* Length of signer's name [0] */ |
---|
40 | | - u8 key_id_len; /* Length of key identifier [0] */ |
---|
41 | | - u8 __pad[3]; |
---|
42 | | - __be32 sig_len; /* Length of signature data */ |
---|
43 | | -}; |
---|
44 | 16 | |
---|
45 | 17 | /* |
---|
46 | 18 | * Verify the signature on a module. |
---|
.. | .. |
---|
49 | 21 | { |
---|
50 | 22 | struct module_signature ms; |
---|
51 | 23 | size_t sig_len, modlen = info->len; |
---|
| 24 | + int ret; |
---|
52 | 25 | |
---|
53 | 26 | pr_devel("==>%s(,%zu)\n", __func__, modlen); |
---|
54 | 27 | |
---|
.. | .. |
---|
56 | 29 | return -EBADMSG; |
---|
57 | 30 | |
---|
58 | 31 | memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms)); |
---|
59 | | - modlen -= sizeof(ms); |
---|
| 32 | + |
---|
| 33 | + ret = mod_check_sig(&ms, modlen, "module"); |
---|
| 34 | + if (ret) |
---|
| 35 | + return ret; |
---|
60 | 36 | |
---|
61 | 37 | sig_len = be32_to_cpu(ms.sig_len); |
---|
62 | | - if (sig_len >= modlen) |
---|
63 | | - return -EBADMSG; |
---|
64 | | - modlen -= sig_len; |
---|
| 38 | + modlen -= sig_len + sizeof(ms); |
---|
65 | 39 | info->len = modlen; |
---|
66 | 40 | |
---|
67 | | - if (ms.id_type != PKEY_ID_PKCS7) { |
---|
68 | | - pr_err("%s: Module is not signed with expected PKCS#7 message\n", |
---|
69 | | - info->name); |
---|
70 | | - return -ENOPKG; |
---|
71 | | - } |
---|
72 | | - |
---|
73 | | - if (ms.algo != 0 || |
---|
74 | | - ms.hash != 0 || |
---|
75 | | - ms.signer_len != 0 || |
---|
76 | | - ms.key_id_len != 0 || |
---|
77 | | - ms.__pad[0] != 0 || |
---|
78 | | - ms.__pad[1] != 0 || |
---|
79 | | - ms.__pad[2] != 0) { |
---|
80 | | - pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n", |
---|
81 | | - info->name); |
---|
82 | | - return -EBADMSG; |
---|
83 | | - } |
---|
84 | | - |
---|
85 | 41 | return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len, |
---|
86 | | - NULL, VERIFYING_MODULE_SIGNATURE, |
---|
| 42 | + VERIFY_USE_SECONDARY_KEYRING, |
---|
| 43 | + VERIFYING_MODULE_SIGNATURE, |
---|
87 | 44 | NULL, NULL); |
---|
88 | 45 | } |
---|