1. 05 May, 2016 1 commit
  2. 04 May, 2016 3 commits
    • Sasha Levin's avatar
      Yama: use atomic allocations when reporting · 74f430cd
      Sasha Levin authored
      Access reporting often happens from atomic contexes. Avoid
      lockups when allocating memory for command lines.
      
      Fixes: 8a56038c ("Yama: consolidate error reporting")
      Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
      74f430cd
    • Mickaël Salaün's avatar
      seccomp: Fix comment typo · 470bf1f2
      Mickaël Salaün authored
      Drop accidentally repeated word in comment.
      Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Will Drewry <wad@chromium.org>
      470bf1f2
    • David Howells's avatar
      Merge branch 'keys-trust' into keys-next · d55201ce
      David Howells authored
      Here's a set of patches that changes how certificates/keys are determined
      to be trusted.  That's currently a two-step process:
      
       (1) Up until recently, when an X.509 certificate was parsed - no matter
           the source - it was judged against the keys in .system_keyring,
           assuming those keys to be trusted if they have KEY_FLAG_TRUSTED set
           upon them.
      
           This has just been changed such that any key in the .ima_mok keyring,
           if configured, may also be used to judge the trustworthiness of a new
           certificate, whether or not the .ima_mok keyring is meant to be
           consulted for whatever process is being undertaken.
      
           If a certificate is determined to be trustworthy, KEY_FLAG_TRUSTED
           will be set upon a key it is loaded into (if it is loaded into one),
           no matter what the key is going to be loaded for.
      
       (2) If an X.509 certificate is loaded into a key, then that key - if
           KEY_FLAG_TRUSTED gets set upon it - can be linked into any keyring
           with KEY_FLAG_TRUSTED_ONLY set upon it.  This was meant to be the
           system keyring only, but has been extended to various IMA keyrings.
           A user can at will link any key marked KEY_FLAG_TRUSTED into any
           keyring marked KEY_FLAG_TRUSTED_ONLY if the relevant permissions masks
           permit it.
      
      These patches change that:
      
       (1) Trust becomes a matter of consulting the ring of trusted keys supplied
           when the trust is evaluated only.
      
       (2) Every keyring can be supplied with its own manager function to
           restrict what may be added to that keyring.  This is called whenever a
           key is to be linked into the keyring to guard against a key being
           created in one keyring and then linked across.
      
           This function is supplied with the keyring and the key type and
           payload[*] of the key being linked in for use in its evaluation.  It
           is permitted to use other data also, such as the contents of other
           keyrings such as the system keyrings.
      
           [*] The type and payload are supplied instead of a key because as an
               optimisation this function may be called whilst creating a key and
               so may reject the proposed key between preparse and allocation.
      
       (3) A default manager function is provided that permits keys to be
           restricted to only asymmetric keys that are vouched for by the
           contents of the system keyring.
      
           A second manager function is provided that just rejects with EPERM.
      
       (4) A key allocation flag, KEY_ALLOC_BYPASS_RESTRICTION, is made available
           so that the kernel can initialise keyrings with keys that form the
           root of the trust relationship.
      
       (5) KEY_FLAG_TRUSTED and KEY_FLAG_TRUSTED_ONLY are removed, along with
           key_preparsed_payload::trusted.
      
      This change also makes it possible in future for userspace to create a private
      set of trusted keys and then to have it sealed by setting a manager function
      where the private set is wholly independent of the kernel's trust
      relationships.
      
      Further changes in the set involve extracting certain IMA special keyrings
      and making them generally global:
      
       (*) .system_keyring is renamed to .builtin_trusted_keys and remains read
           only.  It carries only keys built in to the kernel.  It may be where
           UEFI keys should be loaded - though that could better be the new
           secondary keyring (see below) or a separate UEFI keyring.
      
       (*) An optional secondary system keyring (called .secondary_trusted_keys)
           is added to replace the IMA MOK keyring.
      
           (*) Keys can be added to the secondary keyring by root if the keys can
               be vouched for by either ring of system keys.
      
       (*) Module signing and kexec only use .builtin_trusted_keys and do not use
           the new secondary keyring.
      
       (*) Config option SYSTEM_TRUSTED_KEYS now depends on ASYMMETRIC_KEY_TYPE as
           that's the only type currently permitted on the system keyrings.
      
       (*) A new config option, IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY,
           is provided to allow keys to be added to IMA keyrings, subject to the
           restriction that such keys are validly signed by a key already in the
           system keyrings.
      
           If this option is enabled, but secondary keyrings aren't, additions to
           the IMA keyrings will be restricted to signatures verifiable by keys in
           the builtin system keyring only.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      d55201ce
  3. 01 May, 2016 3 commits
    • Mimi Zohar's avatar
      ima: add support for creating files using the mknodat syscall · 05d1a717
      Mimi Zohar authored
      Commit 3034a146 "ima: pass 'opened' flag to identify newly created files"
      stopped identifying empty files as new files.  However new empty files
      can be created using the mknodat syscall.  On systems with IMA-appraisal
      enabled, these empty files are not labeled with security.ima extended
      attributes properly, preventing them from subsequently being opened in
      order to write the file data contents.  This patch defines a new hook
      named ima_post_path_mknod() to mark these empty files, created using
      mknodat, as new in order to allow the file data contents to be written.
      
      In addition, files with security.ima xattrs containing a file signature
      are considered "immutable" and can not be modified.  The file contents
      need to be written, before signing the file.  This patch relaxes this
      requirement for new files, allowing the file signature to be written
      before the file contents.
      
      Changelog:
      - defer identifying files with signatures stored as security.ima
        (based on Dmitry Rozhkov's comments)
      - removing tests (eg. dentry, dentry->d_inode, inode->i_size == 0)
        (based on Al's review)
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      Cc: Al Viro <<viro@zeniv.linux.org.uk>
      Tested-by: default avatarDmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
      05d1a717
    • Mimi Zohar's avatar
      ima: fix ima_inode_post_setattr · 42a4c603
      Mimi Zohar authored
      Changing file metadata (eg. uid, guid) could result in having to
      re-appraise a file's integrity, but does not change the "new file"
      status nor the security.ima xattr.  The IMA_PERMIT_DIRECTIO and
      IMA_DIGSIG_REQUIRED flags are policy rule specific.  This patch
      only resets these flags, not the IMA_NEW_FILE or IMA_DIGSIG flags.
      
      With this patch, changing the file timestamp will not remove the
      file signature on new files.
      Reported-by: default avatarDmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      Tested-by: default avatarDmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
      42a4c603
    • Dmitry Kasatkin's avatar
      vfs: forbid write access when reading a file into memory · 39d637af
      Dmitry Kasatkin authored
      This patch is based on top of the "vfs: support for a common kernel file
      loader" patch set.  In general when the kernel is reading a file into
      memory it does not want anything else writing to it.
      
      The kernel currently only forbids write access to a file being executed.
      This patch extends this locking to files being read by the kernel.
      
      Changelog:
      - moved function to kernel_read_file() - Mimi
      - updated patch description - Mimi
      Signed-off-by: default avatarDmitry Kasatkin <dmitry.kasatkin@huawei.com>
      Cc: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      Reviewed-by: default avatarLuis R. Rodriguez <mcgrof@kernel.org>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      39d637af
  4. 27 Apr, 2016 1 commit
  5. 21 Apr, 2016 6 commits
  6. 12 Apr, 2016 6 commits
  7. 11 Apr, 2016 11 commits
    • David Howells's avatar
      IMA: Use the the system trusted keyrings instead of .ima_mok · 56104cf2
      David Howells authored
      Add a config option (IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY)
      that, when enabled, allows keys to be added to the IMA keyrings by
      userspace - with the restriction that each must be signed by a key in the
      system trusted keyrings.
      
      EPERM will be returned if this option is disabled, ENOKEY will be returned if
      no authoritative key can be found and EKEYREJECTED will be returned if the
      signature doesn't match.  Other errors such as ENOPKG may also be returned.
      
      If this new option is enabled, the builtin system keyring is searched, as is
      the secondary system keyring if that is also enabled.  Intermediate keys
      between the builtin system keyring and the key being added can be added to
      the secondary keyring (which replaces .ima_mok) to form a trust chain -
      provided they are also validly signed by a key in one of the trusted keyrings.
      
      The .ima_mok keyring is then removed and the IMA blacklist keyring gets its
      own config option (IMA_BLACKLIST_KEYRING).
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      56104cf2
    • David Howells's avatar
      certs: Add a secondary system keyring that can be added to dynamically · d3bfe841
      David Howells authored
      Add a secondary system keyring that can be added to by root whilst the
      system is running - provided the key being added is vouched for by a key
      built into the kernel or already added to the secondary keyring.
      
      Rename .system_keyring to .builtin_trusted_keys to distinguish it more
      obviously from the new keyring (called .secondary_trusted_keys).
      
      The new keyring needs to be enabled with CONFIG_SECONDARY_TRUSTED_KEYRING.
      
      If the secondary keyring is enabled, a link is created from that to
      .builtin_trusted_keys so that the the latter will automatically be searched
      too if the secondary keyring is searched.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      d3bfe841
    • David Howells's avatar
      KEYS: Remove KEY_FLAG_TRUSTED and KEY_ALLOC_TRUSTED · 77f68bac
      David Howells authored
      Remove KEY_FLAG_TRUSTED and KEY_ALLOC_TRUSTED as they're no longer
      meaningful.  Also we can drop the trusted flag from the preparse structure.
      
      Given this, we no longer need to pass the key flags through to
      restrict_link().
      
      Further, we can now get rid of keyring_restrict_trusted_only() also.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      77f68bac
    • David Howells's avatar
      KEYS: Move the point of trust determination to __key_link() · a511e1af
      David Howells authored
      Move the point at which a key is determined to be trustworthy to
      __key_link() so that we use the contents of the keyring being linked in to
      to determine whether the key being linked in is trusted or not.
      
      What is 'trusted' then becomes a matter of what's in the keyring.
      
      Currently, the test is done when the key is parsed, but given that at that
      point we can only sensibly refer to the contents of the system trusted
      keyring, we can only use that as the basis for working out the
      trustworthiness of a new key.
      
      With this change, a trusted keyring is a set of keys that once the
      trusted-only flag is set cannot be added to except by verification through
      one of the contained keys.
      
      Further, adding a key into a trusted keyring, whilst it might grant
      trustworthiness in the context of that keyring, does not automatically
      grant trustworthiness in the context of a second keyring to which it could
      be secondarily linked.
      
      To accomplish this, the authentication data associated with the key source
      must now be retained.  For an X.509 cert, this means the contents of the
      AuthorityKeyIdentifier and the signature data.
      
      
      If system keyrings are disabled then restrict_link_by_builtin_trusted()
      resolves to restrict_link_reject().  The integrity digital signature code
      still works correctly with this as it was previously using
      KEY_FLAG_TRUSTED_ONLY, which doesn't permit anything to be added if there
      is no system keyring against which trust can be determined.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      a511e1af
    • David Howells's avatar
      KEYS: Make the system trusted keyring depend on the asymmetric key type · 99716b7c
      David Howells authored
      Make the system trusted keyring depend on the asymmetric key type as
      there's not a lot of point having it if you can't then load asymmetric keys
      onto it.
      
      This requires the ASYMMETRIC_KEY_TYPE to be made a bool, not a tristate, as
      the Kconfig language doesn't then correctly force ASYMMETRIC_KEY_TYPE to
      'y' rather than 'm' if SYSTEM_TRUSTED_KEYRING is 'y'.
      
      Making SYSTEM_TRUSTED_KEYRING *select* ASYMMETRIC_KEY_TYPE instead doesn't
      work as the Kconfig interpreter then wrongly complains about dependency
      loops.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      99716b7c
    • David Howells's avatar
      X.509: Move the trust validation code out to its own file · cfb664ff
      David Howells authored
      Move the X.509 trust validation code out to its own file so that it can be
      generalised.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      cfb664ff
    • David Howells's avatar
      X.509: Use verify_signature() if we have a struct key * to use · 5f7f5c81
      David Howells authored
      We should call verify_signature() rather than directly calling
      public_key_verify_signature() if we have a struct key to use as we
      shouldn't be poking around in the private data of the key struct as that's
      subtype dependent.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      5f7f5c81
    • David Howells's avatar
      KEYS: Generalise x509_request_asymmetric_key() · 9eb02989
      David Howells authored
      Generalise x509_request_asymmetric_key().  It doesn't really have any
      dependencies on X.509 features as it uses generalised IDs and the
      public_key structs that contain data extracted from X.509.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      9eb02989
    • David Howells's avatar
      KEYS: Move x509_request_asymmetric_key() to asymmetric_type.c · 983023f2
      David Howells authored
      Move x509_request_asymmetric_key() to asymmetric_type.c so that it can be
      generalised.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      983023f2
    • David Howells's avatar
      KEYS: Add a facility to restrict new links into a keyring · 5ac7eace
      David Howells authored
      Add a facility whereby proposed new links to be added to a keyring can be
      vetted, permitting them to be rejected if necessary.  This can be used to
      block public keys from which the signature cannot be verified or for which
      the signature verification fails.  It could also be used to provide
      blacklisting.
      
      This affects operations like add_key(), KEYCTL_LINK and KEYCTL_INSTANTIATE.
      
      To this end:
      
       (1) A function pointer is added to the key struct that, if set, points to
           the vetting function.  This is called as:
      
      	int (*restrict_link)(struct key *keyring,
      			     const struct key_type *key_type,
      			     unsigned long key_flags,
      			     const union key_payload *key_payload),
      
           where 'keyring' will be the keyring being added to, key_type and
           key_payload will describe the key being added and key_flags[*] can be
           AND'ed with KEY_FLAG_TRUSTED.
      
           [*] This parameter will be removed in a later patch when
           	 KEY_FLAG_TRUSTED is removed.
      
           The function should return 0 to allow the link to take place or an
           error (typically -ENOKEY, -ENOPKG or -EKEYREJECTED) to reject the
           link.
      
           The pointer should not be set directly, but rather should be set
           through keyring_alloc().
      
           Note that if called during add_key(), preparse is called before this
           method, but a key isn't actually allocated until after this function
           is called.
      
       (2) KEY_ALLOC_BYPASS_RESTRICTION is added.  This can be passed to
           key_create_or_update() or key_instantiate_and_link() to bypass the
           restriction check.
      
       (3) KEY_FLAG_TRUSTED_ONLY is removed.  The entire contents of a keyring
           with this restriction emplaced can be considered 'trustworthy' by
           virtue of being in the keyring when that keyring is consulted.
      
       (4) key_alloc() and keyring_alloc() take an extra argument that will be
           used to set restrict_link in the new key.  This ensures that the
           pointer is set before the key is published, thus preventing a window
           of unrestrictedness.  Normally this argument will be NULL.
      
       (5) As a temporary affair, keyring_restrict_trusted_only() is added.  It
           should be passed to keyring_alloc() as the extra argument instead of
           setting KEY_FLAG_TRUSTED_ONLY on a keyring.  This will be replaced in
           a later patch with functions that look in the appropriate places for
           authoritative keys.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      5ac7eace
    • Paolo Abeni's avatar
      security: drop the unused hook skb_owned_by · 3c9d6296
      Paolo Abeni authored
      The skb_owned_by hook was added with the commit ca10b9e9
      ("selinux: add a skb_owned_by() hook") and later removed
      when said commit was reverted.
      
      Later on, when switching to list of hooks, a field named
      'skb_owned_by' was included into the security_hook_head struct,
      but without any users nor caller.
      
      This commit removes the said left-over field.
      
      Fixes: b1d9e6b0 ("LSM: Switch to lists of hooks")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
      Acked-by: default avatarPaul Moore <pmoore@paul-moore.com>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      3c9d6296
  8. 06 Apr, 2016 9 commits
    • David Howells's avatar
      PKCS#7: Make trust determination dependent on contents of trust keyring · bda850cd
      David Howells authored
      Make the determination of the trustworthiness of a key dependent on whether
      a key that can verify it is present in the supplied ring of trusted keys
      rather than whether or not the verifying key has KEY_FLAG_TRUSTED set.
      
      verify_pkcs7_signature() will return -ENOKEY if the PKCS#7 message trust
      chain cannot be verified.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      bda850cd
    • David Howells's avatar
      KEYS: Generalise system_verify_data() to provide access to internal content · e68503bd
      David Howells authored
      Generalise system_verify_data() to provide access to internal content
      through a callback.  This allows all the PKCS#7 stuff to be hidden inside
      this function and removed from the PE file parser and the PKCS#7 test key.
      
      If external content is not required, NULL should be passed as data to the
      function.  If the callback is not required, that can be set to NULL.
      
      The function is now called verify_pkcs7_signature() to contrast with
      verify_pefile_signature() and the definitions of both have been moved into
      linux/verification.h along with the key_being_used_for enum.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      e68503bd
    • David Howells's avatar
      X.509: Fix self-signed determination · ad3043fd
      David Howells authored
      There's a bug in the code determining whether a certificate is self-signed
      or not: if they have neither AKID nor SKID then we just assume that the
      cert is self-signed, which may not be true.
      
      Fix this by checking that the raw subject name matches the raw issuer name
      and that the public key algorithm for the key and signature are both the
      same in addition to requiring that the AKID bits match.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      ad3043fd
    • David Howells's avatar
      X.509: Extract signature digest and make self-signed cert checks earlier · 6c2dc5ae
      David Howells authored
      Extract the signature digest for an X.509 certificate earlier, at the end
      of x509_cert_parse() rather than leaving it to the callers thereof since it
      has to be called anyway.
      
      Further, immediately after that, check the signature on self-signed
      certificates, also rather in the callers of x509_cert_parse().
      
      We note in the x509_certificate struct the following bits of information:
      
       (1) Whether the signature is self-signed (even if we can't check the
           signature due to missing crypto).
      
       (2) Whether the key held in the certificate needs unsupported crypto to be
           used.  We may get a PKCS#7 message with X.509 certs that we can't make
           use of - we just ignore them and give ENOPKG at the end it we couldn't
           verify anything if at least one of these unusable certs are in the
           chain of trust.
      
       (3) Whether the signature held in the certificate needs unsupported crypto
           to be checked.  We can still use the key held in this certificate,
           even if we can't check the signature on it - if it is held in the
           system trusted keyring, for instance.  We just can't add it to a ring
           of trusted keys or follow it further up the chain of trust.
      
      Making these checks earlier allows x509_check_signature() to be removed and
      replaced with direct calls to public_key_verify_signature().
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      6c2dc5ae
    • David Howells's avatar
      PKCS#7: Make the signature a pointer rather than embedding it · 566a117a
      David Howells authored
      Point to the public_key_signature struct from the pkcs7_signed_info struct
      rather than embedding it.  This makes the code consistent with the X.509
      signature handling and makes it possible to have a common cleanup function.
      
      We also save a copy of the digest in the signature without sharing the
      memory with the crypto layer metadata.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      566a117a
    • David Howells's avatar
      X.509: Retain the key verification data · 77d0910d
      David Howells authored
      Retain the key verification data (ie. the struct public_key_signature)
      including the digest and the key identifiers.
      
      Note that this means that we need to take a separate copy of the digest in
      x509_get_sig_params() rather than lumping it in with the crypto layer data.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      77d0910d
    • David Howells's avatar
      KEYS: Add identifier pointers to public_key_signature struct · a022ec02
      David Howells authored
      Add key identifier pointers to public_key_signature struct so that they can
      be used to retain the identifier of the key to be used to verify the
      signature in both PKCS#7 and X.509.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      a022ec02
    • David Howells's avatar
      KEYS: Allow authentication data to be stored in an asymmetric key · 3b764563
      David Howells authored
      Allow authentication data to be stored in an asymmetric key in the 4th
      element of the key payload and provide a way for it to be destroyed.
      
      For the public key subtype, this will be a public_key_signature struct.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      3b764563
    • David Howells's avatar
      X.509: Whitespace cleanup · 864e7a81
      David Howells authored
      Clean up some whitespace.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      864e7a81