diff options
| -rw-r--r-- | KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch | 95 | ||||
| -rw-r--r-- | kernel.spec | 2 |
2 files changed, 97 insertions, 0 deletions
diff --git a/KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch b/KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch new file mode 100644 index 000000000..1cc1e5370 --- /dev/null +++ b/KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch @@ -0,0 +1,95 @@ +From fb2ac204a70da565de9ef9a9d6d69a40c2d59727 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Fri, 5 May 2017 08:21:56 +0100 +Subject: [PATCH] KEYS: Allow unrestricted boot-time addition of keys to + secondary keyring + +Allow keys to be added to the system secondary certificates keyring during +kernel initialisation in an unrestricted fashion. Such keys are implicitly +trusted and don't have their trust chains checked on link. + +This allows keys in the UEFI database to be added in secure boot mode for +the purposes of module signing. + +Signed-off-by: David Howells <dhowells@redhat.com> +--- + certs/internal.h | 18 ++++++++++++++++++ + certs/system_keyring.c | 33 +++++++++++++++++++++++++++++++++ + 2 files changed, 51 insertions(+) + create mode 100644 certs/internal.h + +diff --git a/certs/internal.h b/certs/internal.h +new file mode 100644 +index 0000000..5dcbefb +--- /dev/null ++++ b/certs/internal.h +@@ -0,0 +1,18 @@ ++/* Internal definitions ++ * ++ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++/* ++ * system_keyring.c ++ */ ++#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING ++extern void __init add_trusted_secondary_key(const char *source, ++ const void *data, size_t len); ++#endif +diff --git a/certs/system_keyring.c b/certs/system_keyring.c +index 6251d1b..5ac8ba6 100644 +--- a/certs/system_keyring.c ++++ b/certs/system_keyring.c +@@ -18,6 +18,7 @@ + #include <keys/asymmetric-type.h> + #include <keys/system_keyring.h> + #include <crypto/pkcs7.h> ++#include "internal.h" + + static struct key *builtin_trusted_keys; + #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING +@@ -265,3 +266,35 @@ int verify_pkcs7_signature(const void *data, size_t len, + EXPORT_SYMBOL_GPL(verify_pkcs7_signature); + + #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ ++ ++#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING ++/** ++ * add_trusted_secondary_key - Add to secondary keyring with no validation ++ * @source: Source of key ++ * @data: The blob holding the key ++ * @len: The length of the data blob ++ * ++ * Add a key to the secondary keyring without checking its trust chain. This ++ * is available only during kernel initialisation. ++ */ ++void __init add_trusted_secondary_key(const char *source, ++ const void *data, size_t len) ++{ ++ key_ref_t key; ++ ++ key = key_create_or_update(make_key_ref(secondary_trusted_keys, 1), ++ "asymmetric", ++ NULL, data, len, ++ (KEY_POS_ALL & ~KEY_POS_SETATTR) | ++ KEY_USR_VIEW, ++ KEY_ALLOC_NOT_IN_QUOTA | ++ KEY_ALLOC_BYPASS_RESTRICTION); ++ ++ if (IS_ERR(key)) ++ pr_err("Problem loading %s X.509 certificate (%ld)\n", ++ source, PTR_ERR(key)); ++ else ++ pr_notice("Loaded %s cert '%s' linked to secondary sys keyring\n", ++ source, key_ref_to_ptr(key)->description); ++} ++#endif /* CONFIG_SECONDARY_TRUSTED_KEYRING */ +-- +2.9.3 + diff --git a/kernel.spec b/kernel.spec index d3e2fb9f7..a9dbf2e61 100644 --- a/kernel.spec +++ b/kernel.spec @@ -567,6 +567,8 @@ Patch472: crash-driver.patch Patch473: efi-lockdown.patch +Patch486: KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch + Patch487: Add-EFI-signature-data-types.patch Patch488: Add-an-EFI-signature-blob-parser-and-key-loader.patch |