Skip to content

Commit bda850c

Browse files
dhowellsdhowells
committed
PKCS#7: Make trust determination dependent on contents of trust keyring
Make the determination of the trustworthiness of a key dependent on whether a key that can verify it is present in the supplied ring of trusted keys rather than whether or not the verifying key has KEY_FLAG_TRUSTED set. verify_pkcs7_signature() will return -ENOKEY if the PKCS#7 message trust chain cannot be verified. Signed-off-by: David Howells <dhowells@redhat.com>
1 parent e68503b commit bda850c

File tree

9 files changed

+11
-32
lines changed

9 files changed

+11
-32
lines changed

‎certs/system_keyring.c

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -121,15 +121,13 @@ late_initcall(load_system_certificate_list);
121121
int verify_pkcs7_signature(const void *data, size_t len,
122122
const void *raw_pkcs7, size_t pkcs7_len,
123123
struct key *trusted_keys,
124-
int untrusted_error,
125124
enum key_being_used_for usage,
126125
int (*view_content)(void *ctx,
127126
const void *data, size_t len,
128127
size_t asn1hdrlen),
129128
void *ctx)
130129
{
131130
struct pkcs7_message *pkcs7;
132-
bool trusted;
133131
int ret;
134132

135133
pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len);
@@ -149,13 +147,10 @@ int verify_pkcs7_signature(const void *data, size_t len,
149147

150148
if (!trusted_keys)
151149
trusted_keys = system_trusted_keyring;
152-
ret = pkcs7_validate_trust(pkcs7, trusted_keys, &trusted);
153-
if (ret < 0)
154-
goto error;
155-
156-
if (!trusted && untrusted_error) {
157-
pr_err("PKCS#7 signature not signed with a trusted key\n");
158-
ret = untrusted_error;
150+
ret = pkcs7_validate_trust(pkcs7, trusted_keys);
151+
if (ret < 0) {
152+
if (ret == -ENOKEY)
153+
pr_err("PKCS#7 signature not signed with a trusted key\n");
159154
goto error;
160155
}
161156

‎crypto/asymmetric_keys/pkcs7_key_type.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ static int pkcs7_preparse(struct key_preparsed_payload *prep)
6262

6363
return verify_pkcs7_signature(NULL, 0,
6464
prep->data, prep->datalen,
65-
NULL, -ENOKEY, usage,
65+
NULL, usage,
6666
pkcs7_view_content, prep);
6767
}
6868

‎crypto/asymmetric_keys/pkcs7_parser.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ struct pkcs7_signed_info {
2222
struct pkcs7_signed_info *next;
2323
struct x509_certificate *signer; /* Signing certificate (in msg->certs) */
2424
unsigned index;
25-
bool trusted;
2625
bool unsupported_crypto; /* T if not usable due to missing crypto */
2726

2827
/* Message digest - the digest of the Content Data (or NULL) */

‎crypto/asymmetric_keys/pkcs7_trust.c

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
3030
struct public_key_signature *sig = sinfo->sig;
3131
struct x509_certificate *x509, *last = NULL, *p;
3232
struct key *key;
33-
bool trusted;
3433
int ret;
3534

3635
kenter(",%u,", sinfo->index);
@@ -42,10 +41,8 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
4241

4342
for (x509 = sinfo->signer; x509; x509 = x509->signer) {
4443
if (x509->seen) {
45-
if (x509->verified) {
46-
trusted = x509->trusted;
44+
if (x509->verified)
4745
goto verified;
48-
}
4946
kleave(" = -ENOKEY [cached]");
5047
return -ENOKEY;
5148
}
@@ -122,7 +119,6 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
122119

123120
matched:
124121
ret = verify_signature(key, sig);
125-
trusted = test_bit(KEY_FLAG_TRUSTED, &key->flags);
126122
key_put(key);
127123
if (ret < 0) {
128124
if (ret == -ENOMEM)
@@ -134,12 +130,9 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
134130
verified:
135131
if (x509) {
136132
x509->verified = true;
137-
for (p = sinfo->signer; p != x509; p = p->signer) {
133+
for (p = sinfo->signer; p != x509; p = p->signer)
138134
p->verified = true;
139-
p->trusted = trusted;
140-
}
141135
}
142-
sinfo->trusted = trusted;
143136
kleave(" = 0");
144137
return 0;
145138
}
@@ -148,7 +141,6 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
148141
* pkcs7_validate_trust - Validate PKCS#7 trust chain
149142
* @pkcs7: The PKCS#7 certificate to validate
150143
* @trust_keyring: Signing certificates to use as starting points
151-
* @_trusted: Set to true if trustworth, false otherwise
152144
*
153145
* Validate that the certificate chain inside the PKCS#7 message intersects
154146
* keys we already know and trust.
@@ -170,16 +162,13 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
170162
* May also return -ENOMEM.
171163
*/
172164
int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
173-
struct key *trust_keyring,
174-
bool *_trusted)
165+
struct key *trust_keyring)
175166
{
176167
struct pkcs7_signed_info *sinfo;
177168
struct x509_certificate *p;
178169
int cached_ret = -ENOKEY;
179170
int ret;
180171

181-
*_trusted = false;
182-
183172
for (p = pkcs7->certs; p; p = p->next)
184173
p->seen = false;
185174

@@ -193,7 +182,6 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
193182
cached_ret = -ENOPKG;
194183
continue;
195184
case 0:
196-
*_trusted |= sinfo->trusted;
197185
cached_ret = 0;
198186
continue;
199187
default:

‎crypto/asymmetric_keys/verify_pefile.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -436,7 +436,7 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen,
436436

437437
ret = verify_pkcs7_signature(NULL, 0,
438438
pebuf + ctx.sig_offset, ctx.sig_len,
439-
trusted_keys, -EKEYREJECTED, usage,
439+
trusted_keys, usage,
440440
mscode_parse, &ctx);
441441
if (ret < 0)
442442
goto error;

‎crypto/asymmetric_keys/x509_parser.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ struct x509_certificate {
3939
unsigned index;
4040
bool seen; /* Infinite recursion prevention */
4141
bool verified;
42-
bool trusted;
4342
bool self_signed; /* T if self-signed (check unsupported_sig too) */
4443
bool unsupported_key; /* T if key uses unsupported crypto */
4544
bool unsupported_sig; /* T if signature uses unsupported crypto */

‎include/crypto/pkcs7.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@ extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
3333
* pkcs7_trust.c
3434
*/
3535
extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
36-
struct key *trust_keyring,
37-
bool *_trusted);
36+
struct key *trust_keyring);
3837

3938
/*
4039
* pkcs7_verify.c

‎include/linux/verification.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ struct key;
3333
extern int verify_pkcs7_signature(const void *data, size_t len,
3434
const void *raw_pkcs7, size_t pkcs7_len,
3535
struct key *trusted_keys,
36-
int untrusted_error,
3736
enum key_being_used_for usage,
3837
int (*view_content)(void *ctx,
3938
const void *data, size_t len,

‎kernel/module_signing.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,6 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
8181
}
8282

8383
return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
84-
NULL, -ENOKEY, VERIFYING_MODULE_SIGNATURE,
84+
NULL, VERIFYING_MODULE_SIGNATURE,
8585
NULL, NULL);
8686
}

0 commit comments

Comments
 (0)