Skip to contentSkip to conversation

modsign: use all trusted keys to verify module signature

PATCH Superseded Ke Wu 2 participants 8 messages Oct 22, 2018 – Nov 7, 2018

lore
Share & tools
lore

Ke Wu

author
#0 lore raw

PATCH 1/1 modsign: use all trusted keys to verify module signature

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>
---
 kernel/module_signing.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/module_signing.c +1 -1
index f2075ce8e4b3..a8b923ba1a39 100644
@@ -83,6 +83,6 @@ int mod_verify_sig(const void *mod, struct load_info *info)
 	}
 
 	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-				      NULL, VERIFYING_MODULE_SIGNATURE,
+				      (void *)1UL, VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
 }
Signature · 1 line
2.19.1.568.g152ad8e336-goog
author
#1 lore raw

Friendly ping.

Quoted 25 lines · Ke Wu

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>
---
 kernel/module_signing.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/module_signing.c +1 -2
index f2075ce8e4b3..a8b923ba1a39 100644
@@ -83,6 +83,6 @@ int mod_verify_sig(const void *mod, struct load_info *info)
        }
 
        return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-                                     NULL, VERIFYING_MODULE_SIGNATURE,
+                                     (void *)1UL, VERIFYING_MODULE_SIGNATURE,
                                      NULL, NULL);
 }
--

2.19.1.568.g152ad8e336-goog

Signature · 1 line
Ke Wu | Software Engineer | [email protected] | Google Inc.
#2 lore raw
In reply to Ke Wu

+++ Ke Wu [22/10/18 15:26 -0700]:

Quoted 5 lines

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>

Thanks for the ping, I had missed this patch.

David, could I get an ACK please?

Thanks!

Jessica

Quoted 19 lines

---
kernel/module_signing.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)
kernel/module_signing.c +1 -1
index f2075ce8e4b3..a8b923ba1a39 100644
@@ -83,6 +83,6 @@ int mod_verify_sig(const void *mod, struct load_info *info)
 	}
 
 	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-				      NULL, VERIFYING_MODULE_SIGNATURE,
+				      (void *)1UL, VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
 }
Signature · 1 line
2.19.1.568.g152ad8e336-goog
author
#3 lore raw

Hi, I'm wondering if there is any update for the patch.

Thanks!

Quoted 35 lines · Jessica Yu

+++ Ke Wu [22/10/18 15:26 -0700]:

Quoted 5 lines

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>

Thanks for the ping, I had missed this patch.

David, could I get an ACK please?

Thanks!

Jessica

Quoted 19 lines

---
kernel/module_signing.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)
kernel/module_signing.c +1 -2
index f2075ce8e4b3..a8b923ba1a39 100644
@@ -83,6 +83,6 @@ int mod_verify_sig(const void *mod, struct load_info *info)
      }
 
      return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-                                    NULL, VERIFYING_MODULE_SIGNATURE,
+                                    (void *)1UL, VERIFYING_MODULE_SIGNATURE,
                                    NULL, NULL);
 }
--

2.19.1.568.g152ad8e336-goog

Signature · 1 line
Ke Wu | Software Engineer | [email protected] | Google Inc.
#4 lore raw
In reply to Ke Wu

+++ Ke Wu [22/10/18 15:26 -0700]:

Quoted 14 lines

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>

---
kernel/module_signing.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)
kernel/module_signing.c +0 -0
index f2075ce8e4b3..a8b923ba1a39 100644

kernel/module_signing.c int mod_verify_sig(const void *mod, struct load_info *info) · line 88

Quoted 7 lines
kernel/module_signing.c +1 -1
@@ -83,6 +83,6 @@ int mod_verify_sig(const void *mod, struct load_info *info)
 	}
 
 	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-				      NULL, VERIFYING_MODULE_SIGNATURE,
+				      (void *)1UL, VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
 }

I've just stumbled on commit 817aef260037f ("Replace magic for trusting the secondary keyring with #define"), so we should probably use VERIFY_USE_SECONDARY_KEYRING in place of (void *)1UL.

Thanks,

Jessica

author
#5 lore raw

PATCH v2 1/1 modsign: use all trusted keys to verify module signature

In reply to Ke Wu

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>

---
Changelog since v1:
- Use VERIFY_USE_SECONDARY_KEYRING rather than (void *)1UL

 kernel/module_signing.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/module_signing.c +2 -1
index f2075ce8e4b3..6b9a926fd86b 100644
@@ -83,6 +83,7 @@ int mod_verify_sig(const void *mod, struct load_info *info)
 	}
 
 	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-				      NULL, VERIFYING_MODULE_SIGNATURE,
+				      VERIFY_USE_SECONDARY_KEYRING,
+				      VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
 }
Signature · 1 line
2.19.1.930.g4563a0d9d0-goog
author
#6 lore raw

Thanks for the comment! I switched to use
VERIFY_USE_SECONDARY_KEYRING, please take a look.

Quoted 29 lines · Ke Wu

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>

---
Changelog since v1:
- Use VERIFY_USE_SECONDARY_KEYRING rather than (void *)1UL

 kernel/module_signing.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/module_signing.c +2 -2
index f2075ce8e4b3..6b9a926fd86b 100644
@@ -83,6 +83,7 @@ int mod_verify_sig(const void *mod, struct load_info *info)
        }
 
        return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-                                     NULL, VERIFYING_MODULE_SIGNATURE,
+                                     VERIFY_USE_SECONDARY_KEYRING,
+                                     VERIFYING_MODULE_SIGNATURE,
                                      NULL, NULL);
 }
--

2.19.1.930.g4563a0d9d0-goog

Signature · 1 line
Ke Wu | Software Engineer | [email protected] | Google Inc.
#7 lore raw

+++ Ke Wu [06/11/18 15:23 -0800]:

Quoted 2 lines

Thanks for the comment! I switched to use
VERIFY_USE_SECONDARY_KEYRING, please take a look.

Patch has been queued on modules-next. Thanks!

Jessica

Quoted 34 lines · Ke Wu
Quoted 29 lines

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module.

Signed-off-by Ke Wu <[email protected]>

---
Changelog since v1:
- Use VERIFY_USE_SECONDARY_KEYRING rather than (void *)1UL

 kernel/module_signing.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/module_signing.c +2 -2
index f2075ce8e4b3..6b9a926fd86b 100644
@@ -83,6 +83,7 @@ int mod_verify_sig(const void *mod, struct load_info *info)
        }
 
        return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
-                                     NULL, VERIFYING_MODULE_SIGNATURE,
+                                     VERIFY_USE_SECONDARY_KEYRING,
+                                     VERIFYING_MODULE_SIGNATURE,
                                      NULL, NULL);
 }
--

2.19.1.930.g4563a0d9d0-goog

Signature · 1 line
Ke Wu | Software Engineer | [email protected] | Google Inc.