Commit 099f26f2 authored by Eric Snowberg's avatar Eric Snowberg Committed by Jarkko Sakkinen
Browse files

integrity: machine keyring CA configuration 



Add machine keyring CA restriction options to control the type of
keys that may be added to it. The motivation is separation of
certificate signing from code signing keys. Subsquent work will
limit certificates being loaded into the IMA keyring to code
signing keys used for signature verification.

When no restrictions are selected, all Machine Owner Keys (MOK) are added
to the machine keyring.  When CONFIG_INTEGRITY_CA_MACHINE_KEYRING is
selected, the CA bit must be true.  Also the key usage must contain
keyCertSign, any other usage field may be set as well.

When CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX is selected, the CA bit must
be true. Also the key usage must contain keyCertSign and the
digitialSignature usage may not be set.

Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Tested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent 76adb2fb

crypto/asymmetric_keys/restrict.c

+2 −0
Original line number Diff line number Diff line
@@ -140,6 +140,8 @@ int restrict_link_by_ca(struct key *dest_keyring, 
		return -ENOKEY;

	if (!test_bit(KEY_EFLAG_KEYCERTSIGN, &pkey->key_eflags))

		return -ENOKEY;

	if (!IS_ENABLED(CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX))

		return 0;

	if (test_bit(KEY_EFLAG_DIGITALSIG, &pkey->key_eflags))

		return -ENOKEY;

security/integrity/Kconfig

+22 −1
Original line number Diff line number Diff line
@@ -68,13 +68,34 @@ config INTEGRITY_MACHINE_KEYRING 
	depends on INTEGRITY_ASYMMETRIC_KEYS

	depends on SYSTEM_BLACKLIST_KEYRING

	depends on LOAD_UEFI_KEYS

	depends on !IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY

	help

	 If set, provide a keyring to which Machine Owner Keys (MOK) may

	 be added. This keyring shall contain just MOK keys.  Unlike keys

	 in the platform keyring, keys contained in the .machine keyring will

	 be trusted within the kernel.



config INTEGRITY_CA_MACHINE_KEYRING

	bool "Enforce Machine Keyring CA Restrictions"

	depends on INTEGRITY_MACHINE_KEYRING

	default n

	help

	  The .machine keyring can be configured to enforce CA restriction

	  on any key added to it.  By default no restrictions are in place

	  and all Machine Owner Keys (MOK) are added to the machine keyring.

	  If enabled only CA keys are added to the machine keyring, all

	  other MOK keys load into the platform keyring.



config INTEGRITY_CA_MACHINE_KEYRING_MAX

	bool "Only CA keys without DigitialSignature usage set"

	depends on INTEGRITY_CA_MACHINE_KEYRING

	default n

	help

	  When selected, only load CA keys are loaded into the machine

	  keyring that contain the CA bit set along with the keyCertSign

	  Usage field.  Keys containing the digitialSignature Usage field

	  will not be loaded. The remaining MOK keys are loaded into the

	  .platform keyring.



config LOAD_UEFI_KEYS

       depends on INTEGRITY_PLATFORM_KEYRING

       depends on EFI

security/integrity/digsig.c

+6 −2
Original line number Diff line number Diff line
@@ -132,7 +132,8 @@ int __init integrity_init_keyring(const unsigned int id) 
		| KEY_USR_READ | KEY_USR_SEARCH;



	if (id == INTEGRITY_KEYRING_PLATFORM ||

	    id == INTEGRITY_KEYRING_MACHINE) {

	    (id == INTEGRITY_KEYRING_MACHINE &&

	    !IS_ENABLED(CONFIG_INTEGRITY_CA_MACHINE_KEYRING))) {

		restriction = NULL;

		goto out;

	}
@@ -144,6 +145,9 @@ int __init integrity_init_keyring(const unsigned int id) 
	if (!restriction)

		return -ENOMEM;



	if (id == INTEGRITY_KEYRING_MACHINE)

		restriction->check = restrict_link_by_ca;

	else

		restriction->check = restrict_link_to_ima;



	/*