From: Roberto Sassu roberto.sassu@huawei.com
Introduce the bpf_verify_uasym_signature() kfunc, to verify user asymmetric key signatures. The parameters and usage are the same as for bpf_verify_pkcs7_signature().
Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- kernel/trace/bpf_trace.c | 68 +++++++++++++++++++++++++++++++--------- 1 file changed, 54 insertions(+), 14 deletions(-)
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 5f2dcabad20..476b6d526de 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -1281,7 +1281,7 @@ __bpf_kfunc struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags) * The key pointer is marked as invalid, to prevent bpf_key_put() from * attempting to decrement the key reference count on that pointer. The key * pointer set in such way is currently understood only by - * verify_pkcs7_signature(). + * verify_pkcs7_signature() and verify_uasym_signature(). * * Set *id* to one of the values defined in include/linux/verification.h: * 0 for the primary keyring (immutable keyring of system keys); @@ -1327,6 +1327,25 @@ __bpf_kfunc void bpf_key_put(struct bpf_key *bkey) }
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION +static int validate_key(struct bpf_key *trusted_keyring) +{ + int ret = 0; + + if (trusted_keyring->has_ref) { + /* + * Do the permission check deferred in bpf_lookup_user_key(). + * See bpf_lookup_user_key() for more details. + * + * A call to key_task_permission() here would be redundant, as + * it is already done by keyring_search() called by + * find_asymmetric_key(). + */ + ret = key_validate(trusted_keyring->key); + } + + return ret; +} + /** * bpf_verify_pkcs7_signature - verify a PKCS#7 signature * @data_ptr: data to verify @@ -1344,19 +1363,9 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, { int ret;
- if (trusted_keyring->has_ref) { - /* - * Do the permission check deferred in bpf_lookup_user_key(). - * See bpf_lookup_user_key() for more details. - * - * A call to key_task_permission() here would be redundant, as - * it is already done by keyring_search() called by - * find_asymmetric_key(). - */ - ret = key_validate(trusted_keyring->key); - if (ret < 0) - return ret; - } + ret = validate_key(trusted_keyring); + if (ret < 0) + return ret;
return verify_pkcs7_signature(data_ptr->data, __bpf_dynptr_size(data_ptr), @@ -1366,6 +1375,36 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr, VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL); } + +/** + * bpf_verify_uasym_signature - Verify a user asymmetric key signature + * @data_ptr: Data to verify + * @sig_ptr: Signature of the data + * @trusted_keyring: Keyring with keys trusted for signature verification + * + * Verify the user asymmetric key signature *sig_ptr* against the supplied + * *data_ptr* with keys in a keyring referenced by *trusted_keyring*. + * + * Return: 0 on success, a negative value on error. + */ +__bpf_kfunc int bpf_verify_uasym_signature(struct bpf_dynptr_kern *data_ptr, + struct bpf_dynptr_kern *sig_ptr, + struct bpf_key *trusted_keyring) +{ + int ret; + + ret = validate_key(trusted_keyring); + if (ret < 0) + return ret; + + return verify_uasym_signature(data_ptr->data, + __bpf_dynptr_size(data_ptr), + sig_ptr->data, + __bpf_dynptr_size(sig_ptr), + trusted_keyring->key, + VERIFYING_UNSPECIFIED_SIGNATURE, NULL, + NULL); +} #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
__diag_pop(); @@ -1376,6 +1415,7 @@ BTF_ID_FLAGS(func, bpf_lookup_system_key, KF_ACQUIRE | KF_RET_NULL) BTF_ID_FLAGS(func, bpf_key_put, KF_RELEASE) #ifdef CONFIG_SYSTEM_DATA_VERIFICATION BTF_ID_FLAGS(func, bpf_verify_pkcs7_signature, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_verify_uasym_signature, KF_SLEEPABLE) #endif BTF_SET8_END(key_sig_kfunc_set)