From patchwork Sun Aug 13 02:15:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nayna Jain X-Patchwork-Id: 135020 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b824:0:b0:3f2:4152:657d with SMTP id z4csp2106034vqi; Sun, 13 Aug 2023 02:08:42 -0700 (PDT) X-Google-Smtp-Source: AGHT+IF3adb6mNRGKCY6sbgwPBLCKStUdQz8xTMEIOljSPUtZSgGOCSLgOGlvyx8bQ5TPhVIWPwA X-Received: by 2002:aa7:88cd:0:b0:687:6184:deed with SMTP id k13-20020aa788cd000000b006876184deedmr6866319pff.22.1691917721778; Sun, 13 Aug 2023 02:08:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1691917721; cv=none; d=google.com; s=arc-20160816; b=kJLSIjSxMJi31DH3CZtRK6dEm2gbDd6FD1BOaxX1OHmjZqPRHVE9aLShupWvwphDir Z93ch5lT2B6jZl7kTuz4M8+vjCbDig3m+3ofmoseURLZuHIx1xUfnrOj4aR5Z6BqSEEK bojQQk/SWj3LP+Dg5TdmZG8eTgINT5qgmxUoVlxohGzQsWahlT91AjtqQAOevBncKJEZ UgvmKvCnfIkAk8m8xRygHivP8QOcxUn91Q1V9D+YsOACga6unoDVJ8KBk+yy6thxz5FF l+gavympPzq63SlZ3qljI0EduLlMTB2QeU52+Vw9e7PXDBvoejuE+9Mb1Ltci3CHaSHu em7Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=Qz4Dew3cRnzz1YOHjjbIpeIDKp5w8Os4Y5mnSWoXiMg=; fh=0HZxfkAJyx3Soo8VtDkZ0DPjkqS1NGJP1dkSl6x0XCg=; b=gW+O6cvbI1L6EHVSnUotrwPyr5gbgtXvE/9LjGdC1oerV3Zr+j2cCqgZpIkCQ2092x iO9lNO4/apfCLupQJKHcTFRWXhc9Kd4bi2Naypdh7r0K6ZkKN9jR4bqOHWIhYu0dRjte g3CNabguczRNOhrNID51c1Kx+skzBWskxtZknstv3sEGvOGvJ0LvmMCFGWP6N0Nw3Q8V cqYsuoK9HqkLr9mtyIxn/PFNJztMlQc1XFei4hDcbVUUSYaOQHoRec4fIKDNROs+xoNx 1pE9VK1zkSOOp0mbjsvqsL2jyjGOXblrpcp8PT355ZY3hO/vGbc2ooJTD54P/OR5E8uj Trog== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=sdlSQYCN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=ibm.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id fi41-20020a056a0039a900b00687501ac7dasi6251940pfb.363.2023.08.13.02.08.28; Sun, 13 Aug 2023 02:08:41 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=sdlSQYCN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230140AbjHMCQA (ORCPT + 99 others); Sat, 12 Aug 2023 22:16:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60864 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229441AbjHMCP6 (ORCPT ); Sat, 12 Aug 2023 22:15:58 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3CCD4D7; Sat, 12 Aug 2023 19:16:01 -0700 (PDT) Received: from pps.filterd (m0353722.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 37D28ODV004202; Sun, 13 Aug 2023 02:15:46 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=Qz4Dew3cRnzz1YOHjjbIpeIDKp5w8Os4Y5mnSWoXiMg=; b=sdlSQYCNCAeUWQLgZT+rSMDjXazRRHmcM2iYTPt4vqenubsR9QZ/QzJEMDOsPBXweOGU ae801xn7y1dCEZIHTEzvyXrwMW2ZylLuM5kossHmizLsw6kryakhQwd74g/iXpoizlET /A3YOM5XmC2UCNKSA8QqkffYK0oyNm1N78i2viY2aI3+m3mkyNOEMwEYuuON95aY0dOB puu2hwFT2bqkurfso9oMoOUZiA+tglG+kDEIkCe/EDozqGfyoyL0TGSxqy94a4toVU+N qUculUl8vAoHrlb/qiwT4NWG7YO0VnkLDnSOHwOYoO0SyMpDYHHGWmuNe7BKy81sn66i 6g== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3senyng7a6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 13 Aug 2023 02:15:46 +0000 Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 37D10Aqk023203; Sun, 13 Aug 2023 02:15:45 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 3se2wpffd6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 13 Aug 2023 02:15:45 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 37D2Fg8m62783904 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 13 Aug 2023 02:15:42 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6698320040; Sun, 13 Aug 2023 02:15:42 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 28E0A2004B; Sun, 13 Aug 2023 02:15:40 +0000 (GMT) Received: from li-4b5937cc-25c4-11b2-a85c-cea3a66903e4.ibm.com (unknown [9.61.3.84]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTP; Sun, 13 Aug 2023 02:15:39 +0000 (GMT) From: Nayna Jain To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Jarkko Sakkinen , Eric Snowberg , Paul Moore , linux-security-module@vger.kernel.org, linuxppc-dev , linux-kernel@vger.kernel.org, Nayna Jain Subject: [PATCH v3 1/6] integrity: PowerVM support for loading CA keys on machine keyring Date: Sat, 12 Aug 2023 22:15:26 -0400 Message-Id: <20230813021531.1382815-2-nayna@linux.ibm.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20230813021531.1382815-1-nayna@linux.ibm.com> References: <20230813021531.1382815-1-nayna@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: mFtw3MoagmJbvUfPmCngNQFkk2UEvBIt X-Proofpoint-GUID: mFtw3MoagmJbvUfPmCngNQFkk2UEvBIt X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.267,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26 definitions=2023-08-12_27,2023-08-10_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 spamscore=0 lowpriorityscore=0 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 suspectscore=0 mlxscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2306200000 definitions=main-2308130016 X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1774104317032656084 X-GMAIL-MSGID: 1774104317032656084 Keys that derive their trust from an entity such as a security officer, administrator, system owner, or machine owner are said to have "imputed trust". CA keys with imputed trust can be loaded onto the machine keyring. The mechanism for loading these keys onto the machine keyring is platform dependent. Load keys stored in the variable trustedcadb onto the .machine keyring on PowerVM platform. Signed-off-by: Nayna Jain Reviewed-and-tested-by: Mimi Zohar --- .../integrity/platform_certs/keyring_handler.c | 8 ++++++++ .../integrity/platform_certs/keyring_handler.h | 5 +++++ .../integrity/platform_certs/load_powerpc.c | 17 +++++++++++++++++ 3 files changed, 30 insertions(+) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 8a1124e4d769..1649d047e3b8 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -69,6 +69,14 @@ __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) return NULL; } +__init efi_element_handler_t get_handler_for_ca_keys(const efi_guid_t *sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) + return add_to_machine_keyring; + + return NULL; +} + /* * Return the appropriate handler for particular signature list types found in * the UEFI dbx and MokListXRT tables. diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h index 212d894a8c0c..6f15bb4cc8dc 100644 --- a/security/integrity/platform_certs/keyring_handler.h +++ b/security/integrity/platform_certs/keyring_handler.h @@ -29,6 +29,11 @@ efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type); */ efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type); +/* + * Return the handler for particular signature list types for CA keys. + */ +efi_element_handler_t get_handler_for_ca_keys(const efi_guid_t *sig_type); + /* * Return the handler for particular signature list types found in the dbx. */ diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/integrity/platform_certs/load_powerpc.c index 170789dc63d2..6263ce3b3f1e 100644 --- a/security/integrity/platform_certs/load_powerpc.c +++ b/security/integrity/platform_certs/load_powerpc.c @@ -59,6 +59,7 @@ static __init void *get_cert_list(u8 *key, unsigned long keylen, u64 *size) static int __init load_powerpc_certs(void) { void *db = NULL, *dbx = NULL, *data = NULL; + void *trustedca = NULL; u64 dsize = 0; u64 offset = 0; int rc = 0; @@ -120,6 +121,22 @@ static int __init load_powerpc_certs(void) kfree(data); } + data = get_cert_list("trustedcadb", 12, &dsize); + if (!data) { + pr_info("Couldn't get trustedcadb list from firmware\n"); + } else if (IS_ERR(data)) { + rc = PTR_ERR(data); + pr_err("Error reading trustedcadb from firmware: %d\n", rc); + } else { + extract_esl(trustedca, data, dsize, offset); + + rc = parse_efi_signature_list("powerpc:trustedca", trustedca, dsize, + get_handler_for_ca_keys); + if (rc) + pr_err("Couldn't parse trustedcadb signatures: %d\n", rc); + kfree(data); + } + return rc; } late_initcall(load_powerpc_certs);