fit_image_verify_required_sigs() passes each required key's node offset to
fit_image_verify_sig() as key_offset. That function never uses it: it calls
fit_image_check_sig() with required_keynode hardcoded to -1, which both
boot/image-fit-sig.c and include/image.h document as "any signature will
do". rsa_verify() then tries the key named by the FIT's own key-name-hint
and falls through to "try each of the keys in turn", so every required-key
iteration is satisfied by any signature that verifies under any key in the
control FDT.
With two or more keys marked required = "image", one signature from any one
of them satisfies the whole policy and the others contribute nothing.
doc/usage/fit/signature.rst says of "required": "this indicates that the
key must be verified for the image / configuration to be considered valid."
The configuration path is correct: fit_config_verify_key() passes
key_offset through to fit_config_check_sig().
On sandbox, with key-dev and key-prod both required = "image" and a FIT
carrying only a dev signature:
Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev+ OK
sandbox: continuing, as we cannot run Linux
The doubled "dev+" is one signature satisfying both iterations, including
the one for key-prod. The same case against the configuration gate refuses:
Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev- error!
Failed to verify required signature 'key-prod'
Nothing exercises this path: there is no required = "image" anywhere in the
tree, and test_required_key() builds only sign-configs-* fixtures.
Fixes: 56518e71041f ("image: Support signing of images")
Signed-off-by: anon87111 <[email protected]>
---
boot/image-fit-sig.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
index c0fbe81b4c..d6c61e1045 100644
--- a/boot/image-fit-sig.c
+++ b/boot/image-fit-sig.c
@@ -159,7 +159,8 @@ static int fit_image_verify_sig(const void *fit, int
image_noffset,
if (!strncmp(name, FIT_SIG_NODENAME,
strlen(FIT_SIG_NODENAME))) {
ret = fit_image_check_sig(fit, noffset, data, size,
- key_blob, -1, &err_msg);
+ key_blob, key_offset,
+ &err_msg);
if (ret) {
puts("- ");
} else {
--
2.53.0
