On 16/06/14 14:43, Mimi Zohar wrote: > On Thu, 2014-06-12 at 23:17 +0300, Dmitry Kasatkin wrote: >> Instead of allowing public keys, with certificates signed by any >> key on the system trusted keyring, to be added to a trusted keyring, >> this patch further restricts the certificates to those signed by a >> particular key on the system keyring. >> >> This patch defines a new kernel parameter 'keys_ownerid' to specify >> owner's key id which must be used for trust validation of certificates. >> >> Idea belongs to Mimi Zohar. >> >> Signed-off-by: Dmitry Kasatkin <[email protected]> >> --- >> Documentation/kernel-parameters.txt | 5 +++++ >> crypto/asymmetric_keys/x509_public_key.c | 23 +++++++++++++++++++++++ >> 2 files changed, 28 insertions(+) >> >> diff --git a/Documentation/kernel-parameters.txt >> b/Documentation/kernel-parameters.txt >> index 7116fda..7a810d3 100644 >> --- a/Documentation/kernel-parameters.txt >> +++ b/Documentation/kernel-parameters.txt >> @@ -1434,6 +1434,11 @@ bytes respectively. Such letter suffixes can also be >> entirely omitted. >> use the HighMem zone if it exists, and the Normal >> zone if it does not. >> >> + keys_ownerid=[KEYS] This parameter identifies a specific key(s) on >> + the system trusted keyring to be used for certificate >> + trust validation. >> + format: id:<keyid> >> + >> kgdbdbgp= [KGDB,HW] kgdb over EHCI usb debug port. >> Format: <Controller#>[,poll interval] >> The controller # is the number of the ehci usb debug >> diff --git a/crypto/asymmetric_keys/x509_public_key.c >> b/crypto/asymmetric_keys/x509_public_key.c >> index 7a9b386..d46b790 100644 >> --- a/crypto/asymmetric_keys/x509_public_key.c >> +++ b/crypto/asymmetric_keys/x509_public_key.c >> @@ -24,6 +24,19 @@ >> #include "public_key.h" >> #include "x509_parser.h" >> >> +static char *owner_keyid; >> +static int __init default_owner_keyid_set(char *str) >> +{ >> + if (!str) /* default system keyring */ >> + return 1; >> + >> + if (strncmp(str, "id:", 3) == 0) >> + owner_keyid = str; /* owner local key 'id:xxxxxx' */ >> + >> + return 1; >> +} >> +__setup("keys_ownerid=", default_owner_keyid_set); >> + >> /* >> * Find a key in the given keyring by issuer and authority. >> */ >> @@ -169,6 +182,16 @@ static int x509_validate_trust(struct x509_certificate >> *cert, >> if (!trust_keyring) >> return -EOPNOTSUPP; >> >> + if (owner_keyid) { >> + /* validate trust only with the owner_keyid if specified */ >> + /* partial match of keyid according to the asymmetric_type.c */ >> + int idlen = strlen(owner_keyid) - 3; /* - id: */ >> + int authlen = strlen(cert->authority); >> + char *auth = cert->authority + authlen - idlen; >> + if (idlen > authlen || strcasecmp(owner_keyid + 3, auth)) >> + return -EPERM; >> + } >> + > We shouldn't hard code the test here, but use the key type's match > function. For example, the "KEYS: define an owner trusted keyring" (v4) > patch defined a key_match() function. > > thanks,
Right. I addressed this in the following patchset. Thanks. > > Mimi > >> key = x509_request_asymmetric_key(trust_keyring, >> cert->issuer, strlen(cert->issuer), >> cert->authority, > > > > -- > To unsubscribe from this list: send the line "unsubscribe > linux-security-module" in > the body of a message to [email protected] > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
