Check module signatures with the platform keyring (if enabled)

Upstream has made a keyring to the platform keys. The "KEYS: Allow
unrestricted boot-time addition of keys to secondary keyring" is
available upstream for the platform keyring.

The only issue is that module signatures aren't checked with the
platform keyring, so this introduces a patch to add that which has been
sent upstream. At least our carried-patch count hasn't gone up.

1 files changed, 0 insertions, 96 deletions

diff --git a/KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch b/KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
deleted file mode 100644
index 1da06a1dd..000000000
--- a/KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 7ec379c439ea60507804f96910d25196ab838ec4 Mon Sep 17 00:00:00 2001
-From: David Howells <dhowells@redhat.com>
-Date: Fri, 5 May 2017 08:21:56 +0100
-Subject: [PATCH] KEYS: Allow unrestricted boot-time addition of keys to
- secondary keyring
-
-Allow keys to be added to the system secondary certificates keyring during
-kernel initialisation in an unrestricted fashion.  Such keys are implicitly
-trusted and don't have their trust chains checked on link.
-
-This allows keys in the UEFI database to be added in secure boot mode for
-the purposes of module signing.
-
-Signed-off-by: David Howells <dhowells@redhat.com>
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- certs/internal.h       | 18 ++++++++++++++++++
- certs/system_keyring.c | 33 +++++++++++++++++++++++++++++++++
- 2 files changed, 51 insertions(+)
- create mode 100644 certs/internal.h
-
-diff --git a/certs/internal.h b/certs/internal.h
-new file mode 100644
-index 000000000000..5dcbefb0c23a
---- /dev/null
-+++ b/certs/internal.h
-@@ -0,0 +1,18 @@
-+/* Internal definitions
-+ *
-+ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
-+ * Written by David Howells (dhowells@redhat.com)
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public Licence
-+ * as published by the Free Software Foundation; either version
-+ * 2 of the Licence, or (at your option) any later version.
-+ */
-+
-+/*
-+ * system_keyring.c
-+ */
-+#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
-+extern void __init add_trusted_secondary_key(const char *source,
-+					     const void *data, size_t len);
-+#endif
-diff --git a/certs/system_keyring.c b/certs/system_keyring.c
-index c05c29ae4d5d..183e73cc81f7 100644
---- a/certs/system_keyring.c
-+++ b/certs/system_keyring.c
-@@ -19,6 +19,7 @@
- #include <keys/asymmetric-type.h>
- #include <keys/system_keyring.h>
- #include <crypto/pkcs7.h>
-+#include "internal.h"
- 
- static struct key *builtin_trusted_keys;
- #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
-@@ -287,3 +288,35 @@ void __init set_platform_trusted_keys(struct key *keyring)
- 	platform_trusted_keys = keyring;
- }
- #endif
-+
-+#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
-+/**
-+ * add_trusted_secondary_key - Add to secondary keyring with no validation
-+ * @source: Source of key
-+ * @data: The blob holding the key
-+ * @len: The length of the data blob
-+ *
-+ * Add a key to the secondary keyring without checking its trust chain.  This
-+ * is available only during kernel initialisation.
-+ */
-+void __init add_trusted_secondary_key(const char *source,
-+				      const void *data, size_t len)
-+{
-+	key_ref_t key;
-+
-+	key = key_create_or_update(make_key_ref(secondary_trusted_keys, 1),
-+				   "asymmetric",
-+				   NULL, data, len,
-+				   (KEY_POS_ALL & ~KEY_POS_SETATTR) |
-+				   KEY_USR_VIEW,
-+				   KEY_ALLOC_NOT_IN_QUOTA |
-+				   KEY_ALLOC_BYPASS_RESTRICTION);
-+
-+	if (IS_ERR(key))
-+		pr_err("Problem loading %s X.509 certificate (%ld)\n",
-+		       source, PTR_ERR(key));
-+	else
-+		pr_notice("Loaded %s cert '%s' linked to secondary sys keyring\n",
-+			  source, key_ref_to_ptr(key)->description);
-+}
-+#endif /* CONFIG_SECONDARY_TRUSTED_KEYRING */
--- 
-2.20.1
-