xref: /openbmc/linux/fs/verity/signature.c (revision 69160dd0)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Verification of builtin signatures
4  *
5  * Copyright 2019 Google LLC
6  */
7 
8 #include "fsverity_private.h"
9 
10 #include <linux/cred.h>
11 #include <linux/key.h>
12 #include <linux/slab.h>
13 #include <linux/verification.h>
14 
15 /*
16  * /proc/sys/fs/verity/require_signatures
17  * If 1, all verity files must have a valid builtin signature.
18  */
19 static int fsverity_require_signatures;
20 
21 /*
22  * Keyring that contains the trusted X.509 certificates.
23  *
24  * Only root (kuid=0) can modify this.  Also, root may use
25  * keyctl_restrict_keyring() to prevent any more additions.
26  */
27 static struct key *fsverity_keyring;
28 
29 /**
30  * fsverity_verify_signature() - check a verity file's signature
31  * @vi: the file's fsverity_info
32  * @signature: the file's built-in signature
33  * @sig_size: size of signature in bytes, or 0 if no signature
34  *
35  * If the file includes a signature of its fs-verity file digest, verify it
36  * against the certificates in the fs-verity keyring.
37  *
38  * Return: 0 on success (signature valid or not required); -errno on failure
39  */
40 int fsverity_verify_signature(const struct fsverity_info *vi,
41 			      const u8 *signature, size_t sig_size)
42 {
43 	const struct inode *inode = vi->inode;
44 	const struct fsverity_hash_alg *hash_alg = vi->tree_params.hash_alg;
45 	struct fsverity_formatted_digest *d;
46 	int err;
47 
48 	if (sig_size == 0) {
49 		if (fsverity_require_signatures) {
50 			fsverity_err(inode,
51 				     "require_signatures=1, rejecting unsigned file!");
52 			return -EPERM;
53 		}
54 		return 0;
55 	}
56 
57 	d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL);
58 	if (!d)
59 		return -ENOMEM;
60 	memcpy(d->magic, "FSVerity", 8);
61 	d->digest_algorithm = cpu_to_le16(hash_alg - fsverity_hash_algs);
62 	d->digest_size = cpu_to_le16(hash_alg->digest_size);
63 	memcpy(d->digest, vi->file_digest, hash_alg->digest_size);
64 
65 	err = verify_pkcs7_signature(d, sizeof(*d) + hash_alg->digest_size,
66 				     signature, sig_size, fsverity_keyring,
67 				     VERIFYING_UNSPECIFIED_SIGNATURE,
68 				     NULL, NULL);
69 	kfree(d);
70 
71 	if (err) {
72 		if (err == -ENOKEY)
73 			fsverity_err(inode,
74 				     "File's signing cert isn't in the fs-verity keyring");
75 		else if (err == -EKEYREJECTED)
76 			fsverity_err(inode, "Incorrect file signature");
77 		else if (err == -EBADMSG)
78 			fsverity_err(inode, "Malformed file signature");
79 		else
80 			fsverity_err(inode, "Error %d verifying file signature",
81 				     err);
82 		return err;
83 	}
84 
85 	return 0;
86 }
87 
88 #ifdef CONFIG_SYSCTL
89 static struct ctl_table_header *fsverity_sysctl_header;
90 
91 static const struct ctl_path fsverity_sysctl_path[] = {
92 	{ .procname = "fs", },
93 	{ .procname = "verity", },
94 	{ }
95 };
96 
97 static struct ctl_table fsverity_sysctl_table[] = {
98 	{
99 		.procname       = "require_signatures",
100 		.data           = &fsverity_require_signatures,
101 		.maxlen         = sizeof(int),
102 		.mode           = 0644,
103 		.proc_handler   = proc_dointvec_minmax,
104 		.extra1         = SYSCTL_ZERO,
105 		.extra2         = SYSCTL_ONE,
106 	},
107 	{ }
108 };
109 
110 static int __init fsverity_sysctl_init(void)
111 {
112 	fsverity_sysctl_header = register_sysctl_paths(fsverity_sysctl_path,
113 						       fsverity_sysctl_table);
114 	if (!fsverity_sysctl_header) {
115 		pr_err("sysctl registration failed!\n");
116 		return -ENOMEM;
117 	}
118 	return 0;
119 }
120 #else /* !CONFIG_SYSCTL */
121 static inline int __init fsverity_sysctl_init(void)
122 {
123 	return 0;
124 }
125 #endif /* !CONFIG_SYSCTL */
126 
127 int __init fsverity_init_signature(void)
128 {
129 	struct key *ring;
130 	int err;
131 
132 	ring = keyring_alloc(".fs-verity", KUIDT_INIT(0), KGIDT_INIT(0),
133 			     current_cred(), KEY_POS_SEARCH |
134 				KEY_USR_VIEW | KEY_USR_READ | KEY_USR_WRITE |
135 				KEY_USR_SEARCH | KEY_USR_SETATTR,
136 			     KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
137 	if (IS_ERR(ring))
138 		return PTR_ERR(ring);
139 
140 	err = fsverity_sysctl_init();
141 	if (err)
142 		goto err_put_ring;
143 
144 	fsverity_keyring = ring;
145 	return 0;
146 
147 err_put_ring:
148 	key_put(ring);
149 	return err;
150 }
151