openstlinux/linux-st
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

s390/ipl: read IPL report at early boot

Browse Source 
Read the IPL Report block provided by secure-boot, add the entries
of the certificate list to the system key ring and print the list
of components.

PR: Adjust to Vasilys bootdata_preserved patch set. Preserve ipl_cert_list
for later use in kexec_file.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Martin Schwidefsky
2019-02-21 14:23:04 +01:00
parent d29af5b7a8
commit 9641b8cc73
10 changed files with 301 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
security/integrity/Kconfig
View File

@ -55,13 +55,22 @@ config INTEGRITY_PLATFORM_KEYRING
bool "Provide keyring for platform/firmware trusted keys"
depends on INTEGRITY_ASYMMETRIC_KEYS
depends on SYSTEM_BLACKLIST_KEYRING
depends on EFI
help
Provide a separate, distinct keyring for platform trusted keys, which
the kernel automatically populates during initialization from values
provided by the platform for verifying the kexec'ed kerned image
and, possibly, the initramfs signature.
config LOAD_UEFI_KEYS
depends on INTEGRITY_PLATFORM_KEYRING
depends on EFI
def_bool y
config LOAD_IPL_KEYS
depends on INTEGRITY_PLATFORM_KEYRING
depends on S390
def_bool y
config INTEGRITY_AUDIT
bool "Enables integrity auditing support "
depends on AUDIT

8
security/integrity/Makefile
View File

@ -9,10 +9,10 @@ integrity-y := iint.o
integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o
integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o
integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o
integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o \
platform_certs/efi_parser.o \
platform_certs/load_uefi.o
obj-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/load_uefi.o
integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o
integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \
platform_certs/load_uefi.o
integrity-$(CONFIG_LOAD_IPL_KEYS) += platform_certs/load_ipl_s390.o
$(obj)/load_uefi.o: KBUILD_CFLAGS += -fshort-wchar
subdir-$(CONFIG_IMA) += ima

36
security/integrity/platform_certs/load_ipl_s390.c Normal file
View File

@ -0,0 +1,36 @@
// SPDX-License-Identifier: GPL-2.0
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/cred.h>
#include <linux/err.h>
#include <linux/efi.h>
#include <linux/slab.h>
#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
#include <asm/boot_data.h>
#include "../integrity.h"
/*
* Load the certs contained in the IPL report created by the machine loader
* into the platform trusted keyring.
*/
static int __init load_ipl_certs(void)
{
void *ptr, *end;
unsigned int len;
if (!ipl_cert_list_addr)
return 0;
/* Copy the certificates to the system keyring */
ptr = (void *) ipl_cert_list_addr;
end = ptr + ipl_cert_list_size;
while ((void *) ptr < end) {
len = *(unsigned int *) ptr;
ptr += sizeof(unsigned int);
add_to_platform_keyring("IPL:db", ptr, len);
ptr += len;
}
return 0;
}
late_initcall(load_ipl_certs);