kernel/module/signing.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /* Module signature checker
0003  *
0004  * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
0005  * Written by David Howells (dhowells@redhat.com)
0006  */
0007
0008 #include <linux/kernel.h>
0009 #include <linux/errno.h>
0010 #include <linux/module.h>
0011 #include <linux/module_signature.h>
0012 #include <linux/string.h>
0013 #include <linux/verification.h>
0014 #include <linux/security.h>
0015 #include <crypto/public_key.h>
0016 #include <uapi/linux/module.h>
0017 #include "internal.h"
0018
0019 #undef MODULE_PARAM_PREFIX
0020 #define MODULE_PARAM_PREFIX "module."
0021
0022 static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
0023 module_param(sig_enforce, bool_enable_only, 0644);
0024
0025 /*
0026  * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
0027  * on that instead of directly to CONFIG_MODULE_SIG_FORCE config.
0028  */
0029 bool is_module_sig_enforced(void)
0030 {
0031     return sig_enforce;
0032 }
0033 EXPORT_SYMBOL(is_module_sig_enforced);
0034
0035 void set_module_sig_enforced(void)
0036 {
0037     sig_enforce = true;
0038 }
0039
0040 /*
0041  * Verify the signature on a module.
0042  */
0043 int mod_verify_sig(const void *mod, struct load_info *info)
0044 {
0045     struct module_signature ms;
0046     size_t sig_len, modlen = info->len;
0047     int ret;
0048
0049     pr_devel("==>%s(,%zu)\n", __func__, modlen);
0050
0051     if (modlen <= sizeof(ms))
0052         return -EBADMSG;
0053
0054     memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
0055
0056     ret = mod_check_sig(&ms, modlen, "module");
0057     if (ret)
0058         return ret;
0059
0060     sig_len = be32_to_cpu(ms.sig_len);
0061     modlen -= sig_len + sizeof(ms);
0062     info->len = modlen;
0063
0064     return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
0065                       VERIFY_USE_SECONDARY_KEYRING,
0066                       VERIFYING_MODULE_SIGNATURE,
0067                       NULL, NULL);
0068 }
0069
0070 int module_sig_check(struct load_info *info, int flags)
0071 {
0072     int err = -ENODATA;
0073     const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
0074     const char *reason;
0075     const void *mod = info->hdr;
0076     bool mangled_module = flags & (MODULE_INIT_IGNORE_MODVERSIONS |
0077                        MODULE_INIT_IGNORE_VERMAGIC);
0078     /*
0079      * Do not allow mangled modules as a module with version information
0080      * removed is no longer the module that was signed.
0081      */
0082     if (!mangled_module &&
0083         info->len > markerlen &&
0084         memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
0085         /* We truncate the module to discard the signature */
0086         info->len -= markerlen;
0087         err = mod_verify_sig(mod, info);
0088         if (!err) {
0089             info->sig_ok = true;
0090             return 0;
0091         }
0092     }
0093
0094     /*
0095      * We don't permit modules to be loaded into the trusted kernels
0096      * without a valid signature on them, but if we're not enforcing,
0097      * certain errors are non-fatal.
0098      */
0099     switch (err) {
0100     case -ENODATA:
0101         reason = "unsigned module";
0102         break;
0103     case -ENOPKG:
0104         reason = "module with unsupported crypto";
0105         break;
0106     case -ENOKEY:
0107         reason = "module with unavailable key";
0108         break;
0109
0110     default:
0111         /*
0112          * All other errors are fatal, including lack of memory,
0113          * unparseable signatures, and signature check failures --
0114          * even if signatures aren't required.
0115          */
0116         return err;
0117     }
0118
0119     if (is_module_sig_enforced()) {
0120         pr_notice("Loading of %s is rejected\n", reason);
0121         return -EKEYREJECTED;
0122     }
0123
0124     return security_locked_down(LOCKDOWN_MODULE_SIGNATURE);
0125 }