From 05e59e5fb0064c97a1c10921ecd549f2d4a58565 Mon Sep 17 00:00:00 2001
From: hc <hc@nodka.com>
Date: Wed, 09 Oct 2024 06:14:40 +0000
Subject: [PATCH] add REDIRECT
---
kernel/fs/verity/signature.c | 77 +++++++++++++++++++-------------------
1 files changed, 39 insertions(+), 38 deletions(-)
diff --git a/kernel/fs/verity/signature.c b/kernel/fs/verity/signature.c
index 6572784..f823fb3 100644
--- a/kernel/fs/verity/signature.c
+++ b/kernel/fs/verity/signature.c
@@ -27,6 +27,27 @@
static struct key *fsverity_keyring;
/**
+ * fsverity_verify_signature() - check a verity file's signature
+ * @vi: the file's fsverity_info
+ * @signature: the file's built-in signature
+ * @sig_size: size of signature in bytes, or 0 if no signature
+ *
+ * If the file includes a signature of its fs-verity file digest, verify it
+ * against the certificates in the fs-verity keyring.
+ *
+ * Return: 0 on success (signature valid or not required); -errno on failure
+ */
+int fsverity_verify_signature(const struct fsverity_info *vi,
+ const u8 *signature, size_t sig_size)
+{
+ unsigned int digest_algorithm =
+ vi->tree_params.hash_alg - fsverity_hash_algs;
+
+ return __fsverity_verify_signature(vi->inode, signature, sig_size,
+ vi->file_digest, digest_algorithm);
+}
+
+/**
* __fsverity_verify_signature() - check a verity file's signature
* @inode: the file's inode
* @signature: the file's signature
@@ -40,7 +61,7 @@
* Return: 0 on success (signature valid or not required); -errno on failure
*/
int __fsverity_verify_signature(const struct inode *inode, const u8 *signature,
- u32 sig_size, const u8 *file_digest,
+ size_t sig_size, const u8 *file_digest,
unsigned int digest_algorithm)
{
struct fsverity_formatted_digest *d;
@@ -60,6 +81,22 @@
return 0;
}
+ if (fsverity_keyring->keys.nr_leaves_on_tree == 0) {
+ /*
+ * The ".fs-verity" keyring is empty, due to builtin signatures
+ * being supported by the kernel but not actually being used.
+ * In this case, verify_pkcs7_signature() would always return an
+ * error, usually ENOKEY. It could also be EBADMSG if the
+ * PKCS#7 is malformed, but that isn't very important to
+ * distinguish. So, just skip to ENOKEY to avoid the attack
+ * surface of the PKCS#7 parser, which would otherwise be
+ * reachable by any task able to execute FS_IOC_ENABLE_VERITY.
+ */
+ fsverity_err(inode,
+ "fs-verity keyring is empty, rejecting signed file!");
+ return -ENOKEY;
+ }
+
d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL);
if (!d)
return -ENOMEM;
@@ -69,8 +106,7 @@
memcpy(d->digest, file_digest, hash_alg->digest_size);
err = verify_pkcs7_signature(d, sizeof(*d) + hash_alg->digest_size,
- signature, sig_size,
- fsverity_keyring,
+ signature, sig_size, fsverity_keyring,
VERIFYING_UNSPECIFIED_SIGNATURE,
NULL, NULL);
kfree(d);
@@ -95,34 +131,6 @@
}
EXPORT_SYMBOL_GPL(__fsverity_verify_signature);
-/**
- * fsverity_verify_signature() - check a verity file's signature
- * @vi: the file's fsverity_info
- * @desc: the file's fsverity_descriptor
- * @desc_size: size of @desc
- *
- * If the file's fs-verity descriptor includes a signature of the file digest,
- * verify it against the certificates in the fs-verity keyring.
- *
- * Return: 0 on success (signature valid or not required); -errno on failure
- */
-int fsverity_verify_signature(const struct fsverity_info *vi,
- const struct fsverity_descriptor *desc,
- size_t desc_size)
-{
- const struct inode *inode = vi->inode;
- const struct fsverity_hash_alg *hash_alg = vi->tree_params.hash_alg;
- const u32 sig_size = le32_to_cpu(desc->sig_size);
-
- if (sig_size > desc_size - sizeof(*desc)) {
- fsverity_err(inode, "Signature overflows verity descriptor");
- return -EBADMSG;
- }
-
- return __fsverity_verify_signature(inode, desc->signature, sig_size,
- vi->file_digest, hash_alg - fsverity_hash_algs);
-}
-
#ifdef CONFIG_SYSCTL
static struct ctl_table_header *fsverity_sysctl_header;
@@ -131,13 +139,6 @@
{ .procname = "verity", },
{ }
};
-
-/* shared constants to be used in various sysctls */
-static int sysctl_vals[] = { 0, 1, INT_MAX };
-
-#define SYSCTL_ZERO ((void *)&sysctl_vals[0])
-#define SYSCTL_ONE ((void *)&sysctl_vals[1])
-#define SYSCTL_INT_MAX ((void *)&sysctl_vals[2])
static struct ctl_table fsverity_sysctl_table[] = {
{
--
Gitblit v1.6.2