fit_image_verify_required_sigs() passes each required key's node offset to
fit_image_verify_sig() as key_offset. That function never uses it: it calls
fit_image_check_sig() with required_keynode hardcoded to -1, which both
boot/image-fit-sig.c and include/image.h document as "any signature will
do". rsa_verify() then tries the key named by the FIT's own key-name-hint
and falls through to "try each of the keys in turn", so every required-key
iteration is satisfied by any signature that verifies under any key in the
control FDT.
With two or more keys marked required = "image", one signature from any one
of them satisfies the whole policy and the others contribute nothing.
doc/usage/fit/signature.rst says of "required": "this indicates that the
key must be verified for the image / configuration to be considered valid."
The configuration path is correct: fit_config_verify_key() passes
key_offset through to fit_config_check_sig().
On sandbox, with key-dev and key-prod both required = "image" and a FIT
carrying only a dev signature:
Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev+ OK
sandbox: continuing, as we cannot run Linux
The doubled "dev+" is one signature satisfying both iterations, including
the one for key-prod. The same case against the configuration gate refuses:
Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev- error!
Failed to verify required signature 'key-prod'
Nothing exercises this path: there is no required = "image" anywhere in the
tree, and test_required_key() builds only sign-configs-* fixtures.
Fixes: 56518e71041f ("image: Support signing of images")
Signed-off-by: anon87111 <[email protected]>
---
Changes in v2:
- add a Fixes tag (Yao Zi)
- move the relationship to the other in-flight FIT series below the line,
and trim the commit message generally (Yao Zi)
Separate from, and complementary to, the fail-open gate in "[PATCH 0/2]
image-fit-sig: close the image-signature fail-open gate" — that one is a
control FDT with no /signature node at all, this one is two required keys
and one signature satisfying both. Neither fix covers the other. Also
separate from "[PATCH v10 0/7] Improve FIT signature handling" [1], which
is the configuration gate.
A test needs a sign-images-*-prod.its fixture and an image variant of
test_required_key(); happy to send that once v10 settles, since it
refactors run_bootm().
[1]
https://lore.kernel.org/u-boot/[email protected]/
boot/image-fit-sig.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
index c0fbe81b4..d6c61e104 100644
--- a/boot/image-fit-sig.c
+++ b/boot/image-fit-sig.c
@@ -159,7 +159,8 @@ static int fit_image_verify_sig(const void *fit, int
image_noffset,
if (!strncmp(name, FIT_SIG_NODENAME,
strlen(FIT_SIG_NODENAME))) {
ret = fit_image_check_sig(fit, noffset, data, size,
- key_blob, -1, &err_msg);
+ key_blob, key_offset,
+ &err_msg);
if (ret) {
puts("- ");
} else {
--
2.43.0
