[RFC PATCH v2 7/8] clavis: Introduce a new key type called clavis_key_acl
Eric Snowberg
eric.snowberg at oracle.com
Fri May 31 00:39:44 UTC 2024
Introduce a new key type for keyring access control. The new key type
is called clavis_key_acl. The clavis_key_acl contains the subject key
identifier along with the allowed usage type for the key.
The format is as follows:
XX:YYYYYYYYYYY
XX - Single byte of the key type
VERIFYING_MODULE_SIGNATURE 00
VERIFYING_FIRMWARE_SIGNATURE 01
VERIFYING_KEXEC_PE_SIGNATURE 02
VERIFYING_KEY_SIGNATURE 03
VERIFYING_KEY_SELF_SIGNATURE 04
VERIFYING_UNSPECIFIED_SIGNATURE 05
: - ASCII colon
YY - Even number of hexadecimal characters representing the key id
This key type will be used in the clavis keyring for access control. To
be added to the clavis keyring, the clavis_key_acl must be S/MIME signed
by the sole asymmetric key contained within it.
Below is an example of how this could be used. Within the example, the
key (b360d113c848ace3f1e6a80060b43d1206f0487d) is already in the machine
keyring. The intended usage for this key is to validate a signed kernel
for kexec:
echo "02:b360d113c848ace3f1e6a80060b43d1206f0487d" > kernel-acl.txt
The next step is to sign it:
openssl smime -sign -signer clavis-lsm.x509 -inkey clavis-lsm.priv -in \
kernel-acl.txt -out kernel-acl.pkcs7 -binary -outform DER \
-nodetach -noattr
The final step is how to add the acl to the .clavis keyring:
keyctl padd clavis_key_acl "" %:.clavis < kernel-acl.pkcs7
Afterwards the new clavis_key_acl can be seen in the .clavis keyring:
keyctl show %:.clavis
Keyring
keyring: .clavis
\_ asymmetric: Clavis LSM key: 4a00ab9f35c9dc3aed7c225d22bafcbd9285e1e8
\_ clavis_key_acl: 02:b360d113c848ace3f1e6a80060b43d1206f0487d
Signed-off-by: Eric Snowberg <eric.snowberg at oracle.com>
---
.../admin-guide/kernel-parameters.txt | 2 +
security/clavis/clavis_keyring.c | 128 ++++++++++++++++++
2 files changed, 130 insertions(+)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 4d505535ea3b..c2d498eb2466 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -629,6 +629,8 @@
keyrings (builtin, secondary, or platform) to be used as
the Clavis root of trust.
Format: { <keyid> }
+ See Documentation/admin-guide/LSM/clavis.rst for
+ details.
clearcpuid=X[,X...] [X86]
Disable CPUID feature X for the kernel. See
diff --git a/security/clavis/clavis_keyring.c b/security/clavis/clavis_keyring.c
index 1225a8ee1e5a..9b3db299acef 100644
--- a/security/clavis/clavis_keyring.c
+++ b/security/clavis/clavis_keyring.c
@@ -2,13 +2,18 @@
#include <linux/security.h>
#include <linux/integrity.h>
+#include <linux/ctype.h>
#include <keys/asymmetric-type.h>
+#include <keys/asymmetric-subtype.h>
#include <keys/system_keyring.h>
+#include <keys/user-type.h>
+#include <crypto/pkcs7.h>
#include "clavis.h"
static struct key *clavis_keyring;
static struct asymmetric_key_id *setup_keyid;
+#define MAX_ASCII_KID 64
#define MAX_BIN_KID 32
static struct {
@@ -16,6 +21,123 @@ static struct {
unsigned char data[MAX_BIN_KID];
} setup_key;
+static int pkcs7_preparse_content(void *ctx, const void *data, size_t len,
+ size_t asn1hdrlen)
+{
+ struct key_preparsed_payload *prep = ctx;
+ const void *saved_prep_data;
+ size_t saved_prep_datalen;
+ const char *p;
+ char *desc;
+ int ret, i;
+
+ /* key_acl_free_preparse will free this */
+ desc = kmalloc(len, GFP_KERNEL);
+
+ if (!desc)
+ return -ENOMEM;
+ memcpy(desc, data, len);
+
+ /* remove any white space */
+ for (i = 0, p = desc; i < len; i++, p++) {
+ if (isspace(*p))
+ desc[i] = 0;
+ }
+
+ prep->description = desc;
+ saved_prep_data = prep->data;
+ saved_prep_datalen = prep->datalen;
+ prep->data = desc;
+ prep->datalen = len;
+ ret = user_preparse(prep);
+ prep->data = saved_prep_data;
+ prep->datalen = saved_prep_datalen;
+ return ret;
+}
+
+static void key_acl_free_preparse(struct key_preparsed_payload *prep)
+{
+ kfree(prep->description);
+ user_free_preparse(prep);
+}
+
+static int key_acl_preparse(struct key_preparsed_payload *prep)
+{
+ /* Only allow the description to be set via the pkcs7 data contents */
+ if (prep->orig_description)
+ return -EINVAL;
+
+ return verify_pkcs7_signature(NULL, 0, prep->data, prep->datalen, clavis_keyring,
+ VERIFYING_CLAVIS_SIGNATURE, pkcs7_preparse_content,
+ prep);
+}
+
+static int key_acl_instantiate(struct key *key, struct key_preparsed_payload *prep)
+{
+ key->perm |= KEY_USR_READ;
+ key->perm |= KEY_USR_SEARCH;
+ set_bit(KEY_FLAG_KEEP, &key->flags);
+ return generic_key_instantiate(key, prep);
+}
+
+static void key_acl_destroy(struct key *key)
+{
+ /* It should not be possible to get here */
+ pr_info("destroy clavis_key_acl denied\n");
+}
+
+static void key_acl_revoke(struct key *key)
+{
+ /* It should not be possible to get here */
+ pr_info("revoke clavis_key_acl denied\n");
+}
+
+static int key_acl_update(struct key *key, struct key_preparsed_payload *prep)
+{
+ return -EPERM;
+}
+
+static int key_acl_vet_description(const char *desc)
+{
+ unsigned char data[MAX_BIN_KID];
+ int ascii_len, hex_len, error;
+
+ ascii_len = strlen(desc);
+
+ /*
+ * clavis_acl format:
+ * xx:yyyyyyyyy...
+ *
+ * xx - Single byte of the key type
+ * : - Ascii colon
+ * yyyy - Even number of hexadecimal characters representing the keyid
+ */
+ if (ascii_len < 5 || ascii_len > (MAX_ASCII_KID + 3) || desc[2] != ':')
+ return -EINVAL;
+
+ /* move past the colon */
+ ascii_len -= 3;
+ hex_len = ascii_len / 2;
+ error = hex2bin(data, desc + 3, hex_len);
+
+ if (error < 0)
+ pr_err("Unparsable clavis key id\n");
+
+ return error;
+}
+
+static struct key_type clavis_key_acl = {
+ .name = "clavis_key_acl",
+ .preparse = key_acl_preparse,
+ .free_preparse = key_acl_free_preparse,
+ .instantiate = key_acl_instantiate,
+ .update = key_acl_update,
+ .revoke = key_acl_revoke,
+ .destroy = key_acl_destroy,
+ .vet_description = key_acl_vet_description,
+ .read = user_read,
+};
+
static int restrict_link_for_clavis(struct key *dest_keyring, const struct key_type *type,
const union key_payload *payload, struct key *restrict_key)
{
@@ -30,6 +152,9 @@ static int restrict_link_for_clavis(struct key *dest_keyring, const struct key_t
return 0;
}
+ if (type == &clavis_key_acl)
+ return 0;
+
return -EOPNOTSUPP;
}
@@ -64,6 +189,9 @@ static int __init clavis_keyring_init(void)
{
struct key_restriction *restriction;
+ if (register_key_type(&clavis_key_acl) < 0)
+ panic("Can't allocate clavis key type\n");
+
restriction = kzalloc(sizeof(*restriction), GFP_KERNEL);
if (!restriction)
panic("Can't allocate clavis keyring restriction\n");
--
2.43.0
More information about the Linux-security-module-archive
mailing list