diff options
| author | Kairui Song <[email protected]> | 2019-01-21 17:59:29 +0800 |
|---|---|---|
| committer | Mimi Zohar <[email protected]> | 2019-02-04 17:34:07 -0500 |
| commit | 278311e417be60f7caef6fcb12bda4da2711ceff (patch) | |
| tree | c322d3e96510244468ed35ea2f612dd71f7035ad /arch/x86/kernel/kexec-bzimage64.c | |
| parent | 219a3e8676f3132d27b530c7d2d6bcab89536b57 (diff) | |
kexec, KEYS: Make use of platform keyring for signature verify
This patch allows the kexec_file_load syscall to verify the PE signed
kernel image signature based on the preboot keys stored in the .platform
keyring, as fall back, if the signature verification failed due to not
finding the public key in the secondary or builtin keyrings.
This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous
VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature
should verify the signature using platform keyring. Also, decrease
the error message log level when verification failed with -ENOKEY,
so that if called tried multiple time with different keyring it
won't generate extra noises.
Signed-off-by: Kairui Song <[email protected]>
Cc: David Howells <[email protected]>
Acked-by: Dave Young <[email protected]> (for kexec_file_load part)
[[email protected]: tweaked the first paragraph of the patch description,
and fixed checkpatch warning.]
Signed-off-by: Mimi Zohar <[email protected]>
Diffstat (limited to 'arch/x86/kernel/kexec-bzimage64.c')
| -rw-r--r-- | arch/x86/kernel/kexec-bzimage64.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c index 278cd07228dd..e1215a600064 100644 --- a/arch/x86/kernel/kexec-bzimage64.c +++ b/arch/x86/kernel/kexec-bzimage64.c @@ -531,9 +531,17 @@ static int bzImage64_cleanup(void *loader_data) #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len) { - return verify_pefile_signature(kernel, kernel_len, - VERIFY_USE_SECONDARY_KEYRING, - VERIFYING_KEXEC_PE_SIGNATURE); + int ret; + + ret = verify_pefile_signature(kernel, kernel_len, + VERIFY_USE_SECONDARY_KEYRING, + VERIFYING_KEXEC_PE_SIGNATURE); + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) { + ret = verify_pefile_signature(kernel, kernel_len, + VERIFY_USE_PLATFORM_KEYRING, + VERIFYING_KEXEC_PE_SIGNATURE); + } + return ret; } #endif |