hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/kernel/module_signing.c
....@@ -1,46 +1,18 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
12 /* Module signature checker
23 *
34 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
45 * Written by David Howells (dhowells@redhat.com)
5
- *
6
- * This program is free software; you can redistribute it and/or
7
- * modify it under the terms of the GNU General Public Licence
8
- * as published by the Free Software Foundation; either version
9
- * 2 of the Licence, or (at your option) any later version.
106 */
117
128 #include <linux/kernel.h>
139 #include <linux/errno.h>
10
+#include <linux/module.h>
11
+#include <linux/module_signature.h>
1412 #include <linux/string.h>
1513 #include <linux/verification.h>
1614 #include <crypto/public_key.h>
1715 #include "module-internal.h"
18
-
19
-enum pkey_id_type {
20
- PKEY_ID_PGP, /* OpenPGP generated key ID */
21
- PKEY_ID_X509, /* X.509 arbitrary subjectKeyIdentifier */
22
- PKEY_ID_PKCS7, /* Signature in PKCS#7 message */
23
-};
24
-
25
-/*
26
- * Module signature information block.
27
- *
28
- * The constituents of the signature section are, in order:
29
- *
30
- * - Signer's name
31
- * - Key identifier
32
- * - Signature data
33
- * - Information block
34
- */
35
-struct module_signature {
36
- u8 algo; /* Public-key crypto algorithm [0] */
37
- u8 hash; /* Digest algorithm [0] */
38
- u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */
39
- u8 signer_len; /* Length of signer's name [0] */
40
- u8 key_id_len; /* Length of key identifier [0] */
41
- u8 __pad[3];
42
- __be32 sig_len; /* Length of signature data */
43
-};
4416
4517 /*
4618 * Verify the signature on a module.
....@@ -49,6 +21,7 @@
4921 {
5022 struct module_signature ms;
5123 size_t sig_len, modlen = info->len;
24
+ int ret;
5225
5326 pr_devel("==>%s(,%zu)\n", __func__, modlen);
5427
....@@ -56,33 +29,17 @@
5629 return -EBADMSG;
5730
5831 memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
59
- modlen -= sizeof(ms);
32
+
33
+ ret = mod_check_sig(&ms, modlen, "module");
34
+ if (ret)
35
+ return ret;
6036
6137 sig_len = be32_to_cpu(ms.sig_len);
62
- if (sig_len >= modlen)
63
- return -EBADMSG;
64
- modlen -= sig_len;
38
+ modlen -= sig_len + sizeof(ms);
6539 info->len = modlen;
6640
67
- if (ms.id_type != PKEY_ID_PKCS7) {
68
- pr_err("%s: Module is not signed with expected PKCS#7 message\n",
69
- info->name);
70
- return -ENOPKG;
71
- }
72
-
73
- if (ms.algo != 0 ||
74
- ms.hash != 0 ||
75
- ms.signer_len != 0 ||
76
- ms.key_id_len != 0 ||
77
- ms.__pad[0] != 0 ||
78
- ms.__pad[1] != 0 ||
79
- ms.__pad[2] != 0) {
80
- pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n",
81
- info->name);
82
- return -EBADMSG;
83
- }
84
-
8541 return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
86
- NULL, VERIFYING_MODULE_SIGNATURE,
42
+ VERIFY_USE_SECONDARY_KEYRING,
43
+ VERIFYING_MODULE_SIGNATURE,
8744 NULL, NULL);
8845 }