Commit | Line | Data |
---|---|---|
b4d0d230 | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
106a4ee2 RR |
2 | /* Module signature checker |
3 | * | |
4 | * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. | |
5 | * Written by David Howells (dhowells@redhat.com) | |
106a4ee2 RR |
6 | */ |
7 | ||
8 | #include <linux/kernel.h> | |
146aa8b1 | 9 | #include <linux/errno.h> |
c8424e77 TJB |
10 | #include <linux/module.h> |
11 | #include <linux/module_signature.h> | |
89053aa9 | 12 | #include <linux/string.h> |
a511e1af | 13 | #include <linux/verification.h> |
0c1e4280 | 14 | #include <linux/security.h> |
3f1e1bea | 15 | #include <crypto/public_key.h> |
0c1e4280 | 16 | #include <uapi/linux/module.h> |
cfc1d277 | 17 | #include "internal.h" |
106a4ee2 | 18 | |
73503963 SK |
19 | #undef MODULE_PARAM_PREFIX |
20 | #define MODULE_PARAM_PREFIX "module." | |
21 | ||
0c1e4280 AT |
22 | static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE); |
23 | module_param(sig_enforce, bool_enable_only, 0644); | |
24 | ||
25 | /* | |
26 | * Export sig_enforce kernel cmdline parameter to allow other subsystems rely | |
27 | * on that instead of directly to CONFIG_MODULE_SIG_FORCE config. | |
28 | */ | |
29 | bool is_module_sig_enforced(void) | |
30 | { | |
31 | return sig_enforce; | |
32 | } | |
33 | EXPORT_SYMBOL(is_module_sig_enforced); | |
34 | ||
35 | void set_module_sig_enforced(void) | |
36 | { | |
37 | sig_enforce = true; | |
38 | } | |
39 | ||
106a4ee2 RR |
40 | /* |
41 | * Verify the signature on a module. | |
42 | */ | |
f314dfea | 43 | int mod_verify_sig(const void *mod, struct load_info *info) |
106a4ee2 | 44 | { |
48ba2462 | 45 | struct module_signature ms; |
f314dfea | 46 | size_t sig_len, modlen = info->len; |
c8424e77 | 47 | int ret; |
48ba2462 | 48 | |
0390c883 | 49 | pr_devel("==>%s(,%zu)\n", __func__, modlen); |
48ba2462 | 50 | |
caabe240 | 51 | if (modlen <= sizeof(ms)) |
48ba2462 DH |
52 | return -EBADMSG; |
53 | ||
caabe240 | 54 | memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms)); |
c8424e77 | 55 | |
ec2a2959 | 56 | ret = mod_check_sig(&ms, modlen, "module"); |
c8424e77 TJB |
57 | if (ret) |
58 | return ret; | |
48ba2462 DH |
59 | |
60 | sig_len = be32_to_cpu(ms.sig_len); | |
c8424e77 | 61 | modlen -= sig_len + sizeof(ms); |
f314dfea | 62 | info->len = modlen; |
48ba2462 | 63 | |
e68503bd | 64 | return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len, |
e84cd7ee KW |
65 | VERIFY_USE_SECONDARY_KEYRING, |
66 | VERIFYING_MODULE_SIGNATURE, | |
e68503bd | 67 | NULL, NULL); |
106a4ee2 | 68 | } |
0c1e4280 AT |
69 | |
70 | int module_sig_check(struct load_info *info, int flags) | |
71 | { | |
72 | int err = -ENODATA; | |
73 | const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1; | |
74 | const char *reason; | |
75 | const void *mod = info->hdr; | |
76 | bool mangled_module = flags & (MODULE_INIT_IGNORE_MODVERSIONS | | |
77 | MODULE_INIT_IGNORE_VERMAGIC); | |
78 | /* | |
79 | * Do not allow mangled modules as a module with version information | |
80 | * removed is no longer the module that was signed. | |
81 | */ | |
82 | if (!mangled_module && | |
83 | info->len > markerlen && | |
84 | memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) { | |
85 | /* We truncate the module to discard the signature */ | |
86 | info->len -= markerlen; | |
87 | err = mod_verify_sig(mod, info); | |
88 | if (!err) { | |
89 | info->sig_ok = true; | |
90 | return 0; | |
91 | } | |
92 | } | |
93 | ||
94 | /* | |
95 | * We don't permit modules to be loaded into the trusted kernels | |
96 | * without a valid signature on them, but if we're not enforcing, | |
97 | * certain errors are non-fatal. | |
98 | */ | |
99 | switch (err) { | |
100 | case -ENODATA: | |
101 | reason = "unsigned module"; | |
102 | break; | |
103 | case -ENOPKG: | |
104 | reason = "module with unsupported crypto"; | |
105 | break; | |
106 | case -ENOKEY: | |
107 | reason = "module with unavailable key"; | |
108 | break; | |
109 | ||
110 | default: | |
111 | /* | |
112 | * All other errors are fatal, including lack of memory, | |
113 | * unparseable signatures, and signature check failures -- | |
114 | * even if signatures aren't required. | |
115 | */ | |
116 | return err; | |
117 | } | |
118 | ||
119 | if (is_module_sig_enforced()) { | |
120 | pr_notice("Loading of %s is rejected\n", reason); | |
121 | return -EKEYREJECTED; | |
122 | } | |
123 | ||
124 | return security_locked_down(LOCKDOWN_MODULE_SIGNATURE); | |
125 | } |