Commit | Line | Data |
---|---|---|
106a4ee2 RR |
1 | /* Module signature checker |
2 | * | |
3 | * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. | |
4 | * Written by David Howells (dhowells@redhat.com) | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public Licence | |
8 | * as published by the Free Software Foundation; either version | |
9 | * 2 of the Licence, or (at your option) any later version. | |
10 | */ | |
11 | ||
12 | #include <linux/kernel.h> | |
b56e5a17 | 13 | #include <keys/system_keyring.h> |
3f1e1bea | 14 | #include <crypto/public_key.h> |
106a4ee2 RR |
15 | #include "module-internal.h" |
16 | ||
48ba2462 DH |
17 | /* |
18 | * Module signature information block. | |
19 | * | |
20 | * The constituents of the signature section are, in order: | |
21 | * | |
22 | * - Signer's name | |
23 | * - Key identifier | |
24 | * - Signature data | |
25 | * - Information block | |
26 | */ | |
27 | struct module_signature { | |
3f1e1bea DH |
28 | u8 algo; /* Public-key crypto algorithm [0] */ |
29 | u8 hash; /* Digest algorithm [0] */ | |
30 | u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */ | |
31 | u8 signer_len; /* Length of signer's name [0] */ | |
32 | u8 key_id_len; /* Length of key identifier [0] */ | |
12e130b0 DH |
33 | u8 __pad[3]; |
34 | __be32 sig_len; /* Length of signature data */ | |
48ba2462 DH |
35 | }; |
36 | ||
106a4ee2 RR |
37 | /* |
38 | * Verify the signature on a module. | |
39 | */ | |
caabe240 | 40 | int mod_verify_sig(const void *mod, unsigned long *_modlen) |
106a4ee2 | 41 | { |
48ba2462 | 42 | struct module_signature ms; |
caabe240 | 43 | size_t modlen = *_modlen, sig_len; |
48ba2462 | 44 | |
0390c883 | 45 | pr_devel("==>%s(,%zu)\n", __func__, modlen); |
48ba2462 | 46 | |
caabe240 | 47 | if (modlen <= sizeof(ms)) |
48ba2462 DH |
48 | return -EBADMSG; |
49 | ||
caabe240 DH |
50 | memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms)); |
51 | modlen -= sizeof(ms); | |
48ba2462 DH |
52 | |
53 | sig_len = be32_to_cpu(ms.sig_len); | |
caabe240 | 54 | if (sig_len >= modlen) |
48ba2462 | 55 | return -EBADMSG; |
caabe240 | 56 | modlen -= sig_len; |
caabe240 | 57 | *_modlen = modlen; |
48ba2462 | 58 | |
3f1e1bea DH |
59 | if (ms.id_type != PKEY_ID_PKCS7) { |
60 | pr_err("Module is not signed with expected PKCS#7 message\n"); | |
48ba2462 | 61 | return -ENOPKG; |
48ba2462 DH |
62 | } |
63 | ||
3f1e1bea DH |
64 | if (ms.algo != 0 || |
65 | ms.hash != 0 || | |
66 | ms.signer_len != 0 || | |
67 | ms.key_id_len != 0 || | |
68 | ms.__pad[0] != 0 || | |
69 | ms.__pad[1] != 0 || | |
70 | ms.__pad[2] != 0) { | |
71 | pr_err("PKCS#7 signature info has unexpected non-zero params\n"); | |
72 | return -EBADMSG; | |
73 | } | |
48ba2462 | 74 | |
091f6e26 | 75 | return system_verify_data(mod, modlen, mod + modlen, sig_len); |
106a4ee2 | 76 | } |