Merge tag 'keys-fixes-20150925' of git://git.kernel.org/pub/scm/linux/kernel/git...

Keyrings fixes from David Howells, for current Linus.

diff --git a/Documentation/Changes b/Documentation/Changes
index 6d886300485827846541744075f7919be3d16200..f447f0516f074c700b0c78ca87fcfcf4595ea49f 100644 (file)
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -43,7 +43,7 @@ o  udev                   081                     # udevd --version
 o  grub                   0.93                    # grub --version || grub-install --version
 o  mcelog                 0.6                     # mcelog --version
 o  iptables               1.4.2                   # iptables -V
-o  openssl & libcrypto    1.0.1k                  # openssl version
+o  openssl & libcrypto    1.0.0                   # openssl version
 
 
 Kernel compilation

diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 6d88dd15c98da8cada935c0dc937eb5c8db158cd..19709663241223968ee73f3d1847be9e253969f7 100644 (file)
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -332,10 +332,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
                srlen = cert->raw_serial_size;
                q = cert->raw_serial;
        }
-       if (srlen > 1 && *q == 0) {
-               srlen--;
-               q++;
-       }
 
        ret = -ENOMEM;
        desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);

diff --git a/scripts/extract-cert.c b/scripts/extract-cert.c
index 6ce5945a0b892e79f2e98e645615cbc37b79f4d1..b071bf476fea7ede6aab95730f5844ac1bf5caa5 100644 (file)
--- a/scripts/extract-cert.c
+++ b/scripts/extract-cert.c
@@ -17,13 +17,9 @@
 #include <stdint.h>
 #include <stdbool.h>
 #include <string.h>
-#include <getopt.h>
 #include <err.h>
-#include <arpa/inet.h>
 #include <openssl/bio.h>
-#include <openssl/evp.h>
 #include <openssl/pem.h>
-#include <openssl/pkcs7.h>
 #include <openssl/err.h>
 #include <openssl/engine.h>
 

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index c3899ca4811cc2e0add94f8f31e31b93be432fff..250a7a6450331ae0805aaf3100da46af66dd4827 100755 (executable)
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -20,13 +20,34 @@
 #include <getopt.h>
 #include <err.h>
 #include <arpa/inet.h>
+#include <openssl/opensslv.h>
 #include <openssl/bio.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
-#include <openssl/cms.h>
 #include <openssl/err.h>
 #include <openssl/engine.h>
 
+/*
+ * Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to
+ * assume that it's not available and its header file is missing and that we
+ * should use PKCS#7 instead.  Switching to the older PKCS#7 format restricts
+ * the options we have on specifying the X.509 certificate we want.
+ *
+ * Further, older versions of OpenSSL don't support manually adding signers to
+ * the PKCS#7 message so have to accept that we get a certificate included in
+ * the signature message.  Nor do such older versions of OpenSSL support
+ * signing with anything other than SHA1 - so we're stuck with that if such is
+ * the case.
+ */
+#if OPENSSL_VERSION_NUMBER < 0x10000000L
+#define USE_PKCS7
+#endif
+#ifndef USE_PKCS7
+#include <openssl/cms.h>
+#else
+#include <openssl/pkcs7.h>
+#endif
+
 struct module_signature {
        uint8_t         algo;           /* Public-key crypto algorithm [0] */
        uint8_t         hash;           /* Digest algorithm [0] */
@@ -110,30 +131,42 @@ int main(int argc, char **argv)
        struct module_signature sig_info = { .id_type = PKEY_ID_PKCS7 };
        char *hash_algo = NULL;
        char *private_key_name, *x509_name, *module_name, *dest_name;
-       bool save_cms = false, replace_orig;
+       bool save_sig = false, replace_orig;
        bool sign_only = false;
        unsigned char buf[4096];
-       unsigned long module_size, cms_size;
-       unsigned int use_keyid = 0, use_signed_attrs = CMS_NOATTR;
+       unsigned long module_size, sig_size;
+       unsigned int use_signed_attrs;
        const EVP_MD *digest_algo;
        EVP_PKEY *private_key;
+#ifndef USE_PKCS7
        CMS_ContentInfo *cms;
+       unsigned int use_keyid = 0;
+#else
+       PKCS7 *pkcs7;
+#endif
        X509 *x509;
        BIO *b, *bd = NULL, *bm;
        int opt, n;
-
        OpenSSL_add_all_algorithms();
        ERR_load_crypto_strings();
        ERR_clear_error();
 
        key_pass = getenv("KBUILD_SIGN_PIN");
 
+#ifndef USE_PKCS7
+       use_signed_attrs = CMS_NOATTR;
+#else
+       use_signed_attrs = PKCS7_NOATTR;
+#endif
+
        do {
                opt = getopt(argc, argv, "dpk");
                switch (opt) {
-               case 'p': save_cms = true; break;
-               case 'd': sign_only = true; save_cms = true; break;
+               case 'p': save_sig = true; break;
+               case 'd': sign_only = true; save_sig = true; break;
+#ifndef USE_PKCS7
                case 'k': use_keyid = CMS_USE_KEYID; break;
+#endif
                case -1: break;
                default: format();
                }
@@ -157,6 +190,14 @@ int main(int argc, char **argv)
                replace_orig = true;
        }
 
+#ifdef USE_PKCS7
+       if (strcmp(hash_algo, "sha1") != 0) {
+               fprintf(stderr, "sign-file: %s only supports SHA1 signing\n",
+                       OPENSSL_VERSION_TEXT);
+               exit(3);
+       }
+#endif
+
        /* Read the private key and the X.509 cert the PKCS#7 message
         * will point to.
         */
@@ -213,7 +254,8 @@ int main(int argc, char **argv)
        bm = BIO_new_file(module_name, "rb");
        ERR(!bm, "%s", module_name);
 
-       /* Load the CMS message from the digest buffer. */
+#ifndef USE_PKCS7
+       /* Load the signature message from the digest buffer. */
        cms = CMS_sign(NULL, NULL, NULL, NULL,
                       CMS_NOCERTS | CMS_PARTIAL | CMS_BINARY | CMS_DETACHED | CMS_STREAM);
        ERR(!cms, "CMS_sign");
@@ -221,17 +263,31 @@ int main(int argc, char **argv)
        ERR(!CMS_add1_signer(cms, x509, private_key, digest_algo,
                             CMS_NOCERTS | CMS_BINARY | CMS_NOSMIMECAP |
                             use_keyid | use_signed_attrs),
-           "CMS_sign_add_signer");
+           "CMS_add1_signer");
        ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) < 0,
            "CMS_final");
 
-       if (save_cms) {
-               char *cms_name;
+#else
+       pkcs7 = PKCS7_sign(x509, private_key, NULL, bm,
+                          PKCS7_NOCERTS | PKCS7_BINARY |
+                          PKCS7_DETACHED | use_signed_attrs);
+       ERR(!pkcs7, "PKCS7_sign");
+#endif
 
-               ERR(asprintf(&cms_name, "%s.p7s", module_name) < 0, "asprintf");
-               b = BIO_new_file(cms_name, "wb");
-               ERR(!b, "%s", cms_name);
-               ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0, "%s", cms_name);
+       if (save_sig) {
+               char *sig_file_name;
+
+               ERR(asprintf(&sig_file_name, "%s.p7s", module_name) < 0,
+                   "asprintf");
+               b = BIO_new_file(sig_file_name, "wb");
+               ERR(!b, "%s", sig_file_name);
+#ifndef USE_PKCS7
+               ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0,
+                   "%s", sig_file_name);
+#else
+               ERR(i2d_PKCS7_bio(b, pkcs7) < 0,
+                       "%s", sig_file_name);
+#endif
                BIO_free(b);
        }
 
@@ -247,9 +303,13 @@ int main(int argc, char **argv)
        ERR(n < 0, "%s", module_name);
        module_size = BIO_number_written(bd);
 
+#ifndef USE_PKCS7
        ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name);
-       cms_size = BIO_number_written(bd) - module_size;
-       sig_info.sig_len = htonl(cms_size);
+#else
+       ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name);
+#endif
+       sig_size = BIO_number_written(bd) - module_size;
+       sig_info.sig_len = htonl(sig_size);
        ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name);
        ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name);
 

diff --git a/security/keys/gc.c b/security/keys/gc.c
index c7952375ac5325cfb4c403fa1020671b5f31a150..39eac1fd5706c6370df8b18fe5ac42e85e1b2ed3 100644 (file)
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -134,6 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                kdebug("- %u", key->serial);
                key_check(key);
 
+               /* Throw away the key data */
+               if (key->type->destroy)
+                       key->type->destroy(key);
+
                security_key_free(key);
 
                /* deal with the user's key tracking and quota */
@@ -148,10 +152,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
                        atomic_dec(&key->user->nikeys);
 
-               /* now throw away the key memory */
-               if (key->type->destroy)
-                       key->type->destroy(key);
-
                key_user_put(key->user);
 
                kfree(key->description);