From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753285AbcASLdu (ORCPT ); Tue, 19 Jan 2016 06:33:50 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50308 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753592AbcASLcn (ORCPT ); Tue, 19 Jan 2016 06:32:43 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 Subject: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] From: David Howells To: zohar@linux.vnet.ibm.com Cc: dhowells@redhat.com, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, petkan@mip-labs.com, linux-kernel@vger.kernel.org Date: Tue, 19 Jan 2016 11:32:40 +0000 Message-ID: <20160119113240.23238.31018.stgit@warthog.procyon.org.uk> In-Reply-To: <20160119113026.23238.4498.stgit@warthog.procyon.org.uk> References: <20160119113026.23238.4498.stgit@warthog.procyon.org.uk> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Use the system blacklist keyring instead of having an IMA-specific keyring. This requires that the system blacklist be made writable. To control what goes into it, additions to the system blacklist is restricted to certificates that can be validated by CA certificates in the system keyring. Signed-off-by: David Howells --- certs/blacklist.c | 26 +++++++++++++++++++++++--- include/keys/system_keyring.h | 14 +++++--------- security/integrity/digsig_asymmetric.c | 13 +++---------- security/integrity/ima/ima_mok.c | 15 ++------------- 4 files changed, 33 insertions(+), 35 deletions(-) diff --git a/certs/blacklist.c b/certs/blacklist.c index 7f769479c17b..5648504768b2 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -18,6 +18,7 @@ #include #include #include +#include #include "blacklist.h" static struct key *blacklist_keyring; @@ -80,7 +81,8 @@ int mark_hash_blacklisted(const char *hash) ((KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW), KEY_ALLOC_NOT_IN_QUOTA | - KEY_ALLOC_BUILT_IN); + KEY_ALLOC_BUILT_IN | + KEY_ALLOC_BYPASS_RESTRICTION); if (IS_ERR(key)) { pr_err("Problem blacklisting hash (%ld)\n", PTR_ERR(key)); @@ -129,6 +131,24 @@ int is_bin_hash_blacklisted(const u8 *hash, size_t hash_len) } EXPORT_SYMBOL_GPL(is_bin_hash_blacklisted); +/** + * is_key_blacklisted - Determine if a key is blacklisted + * @name: The name or ID of the key to check. + */ +int is_key_blacklisted(const char *name) +{ + key_ref_t kref; + + kref = keyring_search(make_key_ref(blacklist_keyring, true), + &key_type_asymmetric, name); + if (!IS_ERR(kref)) { + key_ref_put(kref); + return -EKEYREJECTED; + } + + return 0; +} + /* * Intialise the blacklist */ @@ -145,10 +165,10 @@ static int __init blacklist_init(void) current_cred(), (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ | - KEY_USR_SEARCH, + KEY_USR_SEARCH | KEY_USR_WRITE, KEY_ALLOC_NOT_IN_QUOTA | KEY_FLAG_KEEP, - NULL, NULL); + restrict_link_by_system_trusted, NULL); if (IS_ERR(blacklist_keyring)) panic("Can't allocate system blacklist keyring\n"); diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 615244b1e276..15107dcc2ec4 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -25,6 +25,7 @@ extern int restrict_link_by_system_trusted(struct key *keyring, extern int mark_hash_blacklisted(const char *hash); extern int is_hash_blacklisted(const char *hash); extern int is_bin_hash_blacklisted(const u8 *hash, size_t hash_len); +extern int is_key_blacklisted(const char *name); #else static inline int is_hash_blacklisted(const char *hash) { @@ -34,29 +35,24 @@ static inline int is_bin_hash_blacklisted(const u8 *hash, size_t hash_len) { return 0; } +static inline int is_key_blacklisted(const char *name) +{ + return 0; +} #endif #ifdef CONFIG_IMA_MOK_KEYRING extern struct key *ima_mok_keyring; -extern struct key *ima_blacklist_keyring; static inline struct key *get_ima_mok_keyring(void) { return ima_mok_keyring; } -static inline struct key *get_ima_blacklist_keyring(void) -{ - return ima_blacklist_keyring; -} #else static inline struct key *get_ima_mok_keyring(void) { return NULL; } -static inline struct key *get_ima_blacklist_keyring(void) -{ - return NULL; -} #endif /* CONFIG_IMA_MOK_KEYRING */ diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c index be1af41b5c2a..bd854dff36e0 100644 --- a/security/integrity/digsig_asymmetric.c +++ b/security/integrity/digsig_asymmetric.c @@ -34,16 +34,9 @@ static struct key *ds_request_asymmetric_key(struct key *keyring, pr_debug("key search: \"%s\"\n", name); - key = get_ima_blacklist_keyring(); - if (key) { - key_ref_t kref; - - kref = keyring_search(make_key_ref(key, 1), - &key_type_asymmetric, name); - if (!IS_ERR(kref)) { - pr_err("Key '%s' is in ima_blacklist_keyring\n", name); - return ERR_PTR(-EKEYREJECTED); - } + if (is_key_blacklisted(name) == -EKEYREJECTED) { + pr_err("Key '%s' is blacklisted\n", name); + return ERR_PTR(-EKEYREJECTED); } if (keyring) { diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c index be0da013622c..6b34770a6c9f 100644 --- a/security/integrity/ima/ima_mok.c +++ b/security/integrity/ima/ima_mok.c @@ -21,7 +21,6 @@ struct key *ima_mok_keyring; -struct key *ima_blacklist_keyring; /* * Allocate the IMA MOK and blacklist keyrings @@ -38,18 +37,8 @@ __init int ima_mok_init(void) KEY_ALLOC_NOT_IN_QUOTA, restrict_link_by_system_trusted, NULL); - ima_blacklist_keyring = keyring_alloc(".ima_blacklist", - KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), - (KEY_POS_ALL & ~KEY_POS_SETATTR) | - KEY_USR_VIEW | KEY_USR_READ | - KEY_USR_WRITE | KEY_USR_SEARCH, - KEY_ALLOC_NOT_IN_QUOTA, - restrict_link_by_system_trusted, NULL); - - if (IS_ERR(ima_mok_keyring) || IS_ERR(ima_blacklist_keyring)) - panic("Can't allocate IMA MOK or blacklist keyrings."); - - set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); + if (IS_ERR(ima_mok_keyring)) + panic("Can't allocate IMA MOK keyring."); return 0; } device_initcall(ima_mok_init);