~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/integrity/digsig.c

Version: ~ [ linux-5.6 ] ~ [ linux-5.5.13 ] ~ [ linux-5.4.28 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.113 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.174 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.217 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.217 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.82 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C) 2011 Intel Corporation
  3  *
  4  * Author:
  5  * Dmitry Kasatkin <dmitry.kasatkin@intel.com>
  6  *
  7  * This program is free software; you can redistribute it and/or modify
  8  * it under the terms of the GNU General Public License as published by
  9  * the Free Software Foundation, version 2 of the License.
 10  *
 11  */
 12 
 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 14 
 15 #include <linux/err.h>
 16 #include <linux/sched.h>
 17 #include <linux/slab.h>
 18 #include <linux/cred.h>
 19 #include <linux/key-type.h>
 20 #include <linux/digsig.h>
 21 
 22 #include "integrity.h"
 23 
 24 static struct key *keyring[INTEGRITY_KEYRING_MAX];
 25 
 26 static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {
 27 #ifndef CONFIG_INTEGRITY_TRUSTED_KEYRING
 28         "_evm",
 29         "_ima",
 30 #else
 31         ".evm",
 32         ".ima",
 33 #endif
 34         "_module",
 35 };
 36 
 37 #ifdef CONFIG_INTEGRITY_TRUSTED_KEYRING
 38 static bool init_keyring __initdata = true;
 39 #else
 40 static bool init_keyring __initdata;
 41 #endif
 42 
 43 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
 44                             const char *digest, int digestlen)
 45 {
 46         if (id >= INTEGRITY_KEYRING_MAX)
 47                 return -EINVAL;
 48 
 49         if (!keyring[id]) {
 50                 keyring[id] =
 51                         request_key(&key_type_keyring, keyring_name[id], NULL);
 52                 if (IS_ERR(keyring[id])) {
 53                         int err = PTR_ERR(keyring[id]);
 54                         pr_err("no %s keyring: %d\n", keyring_name[id], err);
 55                         keyring[id] = NULL;
 56                         return err;
 57                 }
 58         }
 59 
 60         switch (sig[1]) {
 61         case 1:
 62                 /* v1 API expect signature without xattr type */
 63                 return digsig_verify(keyring[id], sig + 1, siglen - 1,
 64                                      digest, digestlen);
 65         case 2:
 66                 return asymmetric_verify(keyring[id], sig, siglen,
 67                                          digest, digestlen);
 68         }
 69 
 70         return -EOPNOTSUPP;
 71 }
 72 
 73 int __init integrity_init_keyring(const unsigned int id)
 74 {
 75         const struct cred *cred = current_cred();
 76         int err = 0;
 77 
 78         if (!init_keyring)
 79                 return 0;
 80 
 81         keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),
 82                                     KGIDT_INIT(0), cred,
 83                                     ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
 84                                      KEY_USR_VIEW | KEY_USR_READ |
 85                                      KEY_USR_WRITE | KEY_USR_SEARCH),
 86                                     KEY_ALLOC_NOT_IN_QUOTA, NULL);
 87         if (!IS_ERR(keyring[id]))
 88                 set_bit(KEY_FLAG_TRUSTED_ONLY, &keyring[id]->flags);
 89         else {
 90                 err = PTR_ERR(keyring[id]);
 91                 pr_info("Can't allocate %s keyring (%d)\n",
 92                         keyring_name[id], err);
 93                 keyring[id] = NULL;
 94         }
 95         return err;
 96 }
 97 
 98 int __init integrity_load_x509(const unsigned int id, const char *path)
 99 {
100         key_ref_t key;
101         char *data;
102         int rc;
103 
104         if (!keyring[id])
105                 return -EINVAL;
106 
107         rc = integrity_read_file(path, &data);
108         if (rc < 0)
109                 return rc;
110 
111         key = key_create_or_update(make_key_ref(keyring[id], 1),
112                                    "asymmetric",
113                                    NULL,
114                                    data,
115                                    rc,
116                                    ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
117                                     KEY_USR_VIEW | KEY_USR_READ),
118                                    KEY_ALLOC_NOT_IN_QUOTA);
119         if (IS_ERR(key)) {
120                 rc = PTR_ERR(key);
121                 pr_err("Problem loading X.509 certificate (%d): %s\n",
122                        rc, path);
123         } else {
124                 pr_notice("Loaded X.509 cert '%s': %s\n",
125                           key_ref_to_ptr(key)->description, path);
126                 key_ref_put(key);
127         }
128         kfree(data);
129         return 0;
130 }
131 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp