Commit d1996776 authored by Eric Snowberg's avatar Eric Snowberg Committed by Jarkko Sakkinen
Browse files

integrity: Introduce a Linux keyring called machine 



Many UEFI Linux distributions boot using shim.  The UEFI shim provides
what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure
Boot DB and MOK keys to validate the next step in the boot chain.  The
MOK facility can be used to import user generated keys.  These keys can
be used to sign an end-users development kernel build.  When Linux
boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux
.platform keyring.

Define a new Linux keyring called machine.  This keyring shall contain just
MOK keys and not the remaining keys in the platform keyring. This new
machine keyring will be used in follow on patches.  Unlike keys in the
platform keyring, keys contained in the machine keyring will be trusted
within the kernel if the end-user has chosen to do so.

Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Tested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent e561752c

security/integrity/Kconfig

+13 −0
Original line number Diff line number Diff line
@@ -62,6 +62,19 @@ config INTEGRITY_PLATFORM_KEYRING 
         provided by the platform for verifying the kexec'ed kerned image

         and, possibly, the initramfs signature.



config INTEGRITY_MACHINE_KEYRING

	bool "Provide a keyring to which Machine Owner Keys may be added"

	depends on SECONDARY_TRUSTED_KEYRING

	depends on INTEGRITY_ASYMMETRIC_KEYS

	depends on SYSTEM_BLACKLIST_KEYRING

	depends on LOAD_UEFI_KEYS

	depends on !IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY

	help

	 If set, provide a keyring to which Machine Owner Keys (MOK) may

	 be added. This keyring shall contain just MOK keys.  Unlike keys

	 in the platform keyring, keys contained in the .machine keyring will

	 be trusted within the kernel.



config LOAD_UEFI_KEYS

       depends on INTEGRITY_PLATFORM_KEYRING

       depends on EFI

security/integrity/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o 
integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o

integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o

integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o

integrity-$(CONFIG_INTEGRITY_MACHINE_KEYRING) += platform_certs/machine_keyring.o

integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \

				      platform_certs/load_uefi.o \

				      platform_certs/keyring_handler.o

security/integrity/digsig.c

+11 −2
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { 
	".ima",

#endif

	".platform",

	".machine",

};



#ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
@@ -126,7 +127,8 @@ int __init integrity_init_keyring(const unsigned int id) 
	perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW

		| KEY_USR_READ | KEY_USR_SEARCH;



	if (id == INTEGRITY_KEYRING_PLATFORM) {

	if (id == INTEGRITY_KEYRING_PLATFORM ||

	    id == INTEGRITY_KEYRING_MACHINE) {

		restriction = NULL;

		goto out;

	}
@@ -139,6 +141,13 @@ int __init integrity_init_keyring(const unsigned int id) 
		return -ENOMEM;



	restriction->check = restrict_link_to_ima;



	/*

	 * MOK keys can only be added through a read-only runtime services

	 * UEFI variable during boot. No additional keys shall be allowed to

	 * load into the machine keyring following init from userspace.

	 */

	if (id != INTEGRITY_KEYRING_MACHINE)

		perm |= KEY_USR_WRITE;



out:

security/integrity/integrity.h

+11 −1
Original line number Diff line number Diff line
@@ -151,7 +151,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, 
#define INTEGRITY_KEYRING_EVM		0

#define INTEGRITY_KEYRING_IMA		1

#define INTEGRITY_KEYRING_PLATFORM	2

#define INTEGRITY_KEYRING_MAX		3

#define INTEGRITY_KEYRING_MACHINE	3

#define INTEGRITY_KEYRING_MAX		4



extern struct dentry *integrity_dir;
@@ -283,3 +284,12 @@ static inline void __init add_to_platform_keyring(const char *source, 
{

}

#endif



#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING

void __init add_to_machine_keyring(const char *source, const void *data, size_t len);

#else

static inline void __init add_to_machine_keyring(const char *source,

						  const void *data, size_t len)

{

}

#endif

security/integrity/platform_certs/machine_keyring.c

0 → 100644
+42 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Machine keyring routines.

 *

 * Copyright (c) 2021, Oracle and/or its affiliates.

 */



#include "../integrity.h"



static __init int machine_keyring_init(void)

{

	int rc;



	rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE);

	if (rc)

		return rc;



	pr_notice("Machine keyring initialized\n");

	return 0;

}

device_initcall(machine_keyring_init);



void __init add_to_machine_keyring(const char *source, const void *data, size_t len)

{

	key_perm_t perm;

	int rc;



	perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW;

	rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm);



	/*

	 * Some MOKList keys may not pass the machine keyring restrictions.

	 * If the restriction check does not pass and the platform keyring

	 * is configured, try to add it into that keyring instead.

	 */

	if (rc && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))

		rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source,

					 data, len, perm);



	if (rc)

		pr_info("Error adding keys to machine keyring %s\n", source);

}