From patchwork Thu Nov 25 18:02:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Suchanek X-Patchwork-Id: 1559846 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=On15q/90; dkim=fail reason="signature verification failed" header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=FB0cBxjJ; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org (client-ip=2404:9400:2:0:216:3eff:fee1:b9f1; helo=lists.ozlabs.org; envelope-from=linuxppc-dev-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org; receiver=) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2404:9400:2:0:216:3eff:fee1:b9f1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4J0Qjc41VXz9sRR for ; Fri, 26 Nov 2021 05:03:48 +1100 (AEDT) Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4J0Qjc10cKz3c7Y for ; Fri, 26 Nov 2021 05:03:48 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=On15q/90; dkim=fail reason="signature verification failed" header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=FB0cBxjJ; dkim-atps=neutral X-Original-To: linuxppc-dev@lists.ozlabs.org Delivered-To: linuxppc-dev@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=suse.de (client-ip=195.135.220.28; helo=smtp-out1.suse.de; envelope-from=msuchanek@suse.de; receiver=) Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=On15q/90; dkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=FB0cBxjJ; dkim-atps=neutral Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4J0QjN6MdTz2yg4 for ; Fri, 26 Nov 2021 05:03:36 +1100 (AEDT) Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out1.suse.de (Postfix) with ESMTP id 9FBAC2193C; Thu, 25 Nov 2021 18:03:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1637863412; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=PK+Zc83ByJRm0GdafXCf4h8Ufy35eh7OxSjfkp0YrnM=; b=On15q/90t5q6ngo9oibHUk5cuUrtIKj5zDFosgbzJXlVOceZTDKJfsErLIEzHYK8+4Zc2e cRzs1dtDFfvcKgHNy65H366qh0ixIABXoALdzpohT/qsfymR/UQqpvMuPla/3w1F63BhI7 aMxgW0ojb48EH/bKZ2lLNm9ZRBpLx9o= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1637863412; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=PK+Zc83ByJRm0GdafXCf4h8Ufy35eh7OxSjfkp0YrnM=; b=FB0cBxjJNmMwuPYkcUDoiU/7Y4SjiDZ53QM2CYK1JiOCieeTSR0SvIeBiwtAX6gWj/69KW suy7eNPadG/YEaAA== Received: from kitsune.suse.cz (kitsune.suse.cz [10.100.12.127]) by relay2.suse.de (Postfix) with ESMTP id 3B800A3B81; Thu, 25 Nov 2021 18:03:29 +0000 (UTC) From: Michal Suchanek To: keyrings@vger.kernel.org Subject: [PATCH v2 0/6] KEXEC_SIG with appended signature Date: Thu, 25 Nov 2021 19:02:38 +0100 Message-Id: X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Nayna , Mimi Zohar , David Howells , Paul Mackerras , Alexander Gordeev , Rob Herring , Herbert Xu , Baoquan He , Christian Borntraeger , James Morris , Lakshmi Ramasubramanian , Michal Suchanek , "Serge E. Hallyn" , Vasily Gorbik , linux-s390@vger.kernel.org, Heiko Carstens , linux-crypto@vger.kernel.org, Dmitry Kasatkin , Hari Bathini , Daniel Axtens , Christian Borntraeger , Philipp Rudo , Frank van der Linden , kexec@lists.infradead.org, linux-kernel@vger.kernel.org, Luis Chamberlain , Sven Schnelle , linux-security-module@vger.kernel.org, Jessica Yu , linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, "David S. Miller" , Thiago Jung Bauermann , buendgen@de.ibm.com Errors-To: linuxppc-dev-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Linuxppc-dev" Hello, This is resend of the KEXEC_SIG patchset. The first patch is new because it'a a cleanup that does not require any change to the module verification code. The second patch is the only one that is intended to change any functionality. The rest only deduplicates code but I did not receive any review on that part so I don't know if it's desirable as implemented. The first two patches can be applied separately without the rest. Thanks Michal Michal Suchanek (6): s390/kexec_file: Don't opencode appended signature check. powerpc/kexec_file: Add KEXEC_SIG support. kexec_file: Don't opencode appended signature verification. module: strip the signature marker in the verification function. module: Use key_being_used_for for log messages in verify_appended_signature module: Move duplicate mod_check_sig users code to mod_parse_sig arch/powerpc/Kconfig | 11 +++++ arch/powerpc/kexec/elf_64.c | 14 ++++++ arch/s390/kernel/machine_kexec_file.c | 42 ++---------------- crypto/asymmetric_keys/asymmetric_type.c | 1 + include/linux/module_signature.h | 1 + include/linux/verification.h | 4 ++ kernel/module-internal.h | 2 - kernel/module.c | 12 +++-- kernel/module_signature.c | 56 +++++++++++++++++++++++- kernel/module_signing.c | 33 +++++++------- security/integrity/ima/ima_modsig.c | 22 ++-------- 11 files changed, 113 insertions(+), 85 deletions(-) Acked-by: Heiko Carstens