[Fedora 03/19] integrity: Add a function to determine digital signature length

[Vivek Goyal <vgoyal@xxxxxxxxxx>]

Currently if security.ima has digital signature, there is only one
structure in there. Either version 1 or version 2 of digital signature.
So all the functions assume that whole of the security.ima xattr contains
digital signautre and uses the length accordingly.

But, now I am planning to add more metadata in security.ima xattr. Apart
from signature, I am also planning to add additional info which tells
whether to memlock an executable file during execution or not. In that
case all functions need to know the size of digital signature as rest
of the data might be something else.

Signed-off-by: Vivek Goyal <vgoyal@xxxxxxxxxx>
---
 security/integrity/digsig.c            | 17 +++++++++++++++++
 security/integrity/digsig_asymmetric.c | 18 +++---------------
 security/integrity/ima/ima_appraise.c  |  6 +++---
 security/integrity/integrity.h         | 14 ++++++++++++++
 4 files changed, 37 insertions(+), 18 deletions(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 0b759e1..160fec7 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -27,6 +27,23 @@ static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {
 	"_ima",
 };
 
+/* Get size of digital signature */
+int integrity_get_digsig_size(char *sig)
+{
+	uint16_t sz;
+
+	if (sig[0] == 1) {
+		sz = *((uint16_t *)(sig + sizeof(struct signature_hdr)));
+		sz = __be16_to_cpu(sz);
+		return sizeof(struct signature_hdr) + 2 + (sz >> 3);
+	} else if (sig[0] == 2 ) {
+		sz = ((struct signature_v2_hdr *)sig)->sig_size;
+		return sizeof(struct signature_v2_hdr) + __be16_to_cpu(sz);
+	}
+
+	return -EBADMSG;
+}
+
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
 					const char *digest, int digestlen)
 {
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index 6b8be55..70331fe 100644
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -14,23 +14,13 @@
 
 #include <linux/err.h>
 #include <linux/key-type.h>
+#include <linux/digsig.h>
 #include <crypto/public_key.h>
 #include <keys/asymmetric-type.h>
 
 #include "integrity.h"
 
 /*
- * signature format v2 - for using with asymmetric keys
- */
-struct signature_v2_hdr {
-	uint8_t version;	/* signature format version */
-	uint8_t	hash_algo;	/* Digest algorithm [enum pkey_hash_algo] */
-	uint32_t keyid;		/* IMA key identifier - not X509/PGP specific*/
-	uint16_t sig_size;	/* signature size */
-	uint8_t sig[0];		/* signature payload */
-} __packed;
-
-/*
  * Request an asymmetric key.
  */
 static struct key *request_asymmetric_key(struct key *keyring, uint32_t keyid)
@@ -45,13 +35,11 @@ static struct key *request_asymmetric_key(struct key *keyring, uint32_t keyid)
 	if (keyring) {
 		/* search in specific keyring */
 		key_ref_t kref;
-		printk("calling keyring_search(). keyring=%p name=%s system_keyring=%p\n", keyring, name, system_trusted_keyring);
 		kref = keyring_search(make_key_ref(keyring, 1),
 				      &key_type_asymmetric, name);
-		if (IS_ERR(kref)) {
+		if (IS_ERR(kref))
 			key = ERR_CAST(kref);
-			printk("keyring search returned %d\n", PTR_ERR(kref));
-		} else
+		else
 			key = key_ref_to_ptr(kref);
 	} else {
 		key = request_key(&key_type_asymmetric, name, NULL);
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 2d4beca..a9206d1 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -171,9 +171,9 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
 	case EVM_IMA_XATTR_DIGSIG:
 		iint->flags |= IMA_DIGSIG;
 		rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
-					     xattr_value->digest, rc - 1,
-					     iint->ima_xattr.digest,
-					     IMA_DIGEST_SIZE);
+				xattr_value->digest,
+				integrity_get_digsig_size(xattr_value->digest),
+				iint->ima_xattr.digest, IMA_DIGEST_SIZE);
 		if (rc == -EOPNOTSUPP) {
 			status = INTEGRITY_UNKNOWN;
 		} else if (rc) {
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index c42fb7a..4246417 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -75,6 +75,17 @@ struct integrity_iint_cache {
 	enum integrity_status evm_status:4;
 };
 
+/*
+ * signature format v2 - for using with asymmetric keys
+ */
+struct signature_v2_hdr {
+	uint8_t version;	/* signature format version */
+	uint8_t	hash_algo;	/* Digest algorithm [enum pkey_hash_algo] */
+	uint32_t keyid;		/* IMA key identifier - not X509/PGP specific*/
+	uint16_t sig_size;	/* signature size */
+	uint8_t sig[0];		/* signature payload */
+} __packed;
+
 /* rbtree tree calls to lookup, insert, delete
  * integrity data associated with an inode.
  */
@@ -90,6 +101,7 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
 					const char *digest, int digestlen);
+extern int integrity_get_digsig_size(char *sig);
 
 #else
 
@@ -100,6 +112,8 @@ static inline int integrity_digsig_verify(const unsigned int id,
 	return -EOPNOTSUPP;
 }
 
+static inline int integrity_get_digsig_size(char *sig) { return -EOPNOTSUPP; }
+
 #endif /* CONFIG_INTEGRITY_SIGNATURE */
 
 #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
-- 
1.8.3.1

_______________________________________________
kernel mailing list
kernel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/kernel