tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature verify

Browse Source 
This patch completes commit 278311e417 ("kexec, KEYS: Make use of
platform keyring for signature verify") which, while adding the
platform keyring for bzImage verification, neglected to also add
this keyring for module verification.

As such, kernel modules signed with keys from the MokList variable
were not successfully verified.

Signed-off-by: Robert Holmes <robeholmes@gmail.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
(cherry picked from commit b697ff5e26974fee8fcd31a1e221e9dd41515efc
from https://gitlab.com/cki-project/kernel-ark)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
This commit is contained in:
Robert Holmes
2019-04-23 07:39:29 +00:00
committed by Paolo Pisati
parent 8020185fb6
commit dd811724d2
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/module/signing.c
+8 -1
View File
@@ -61,10 +61,17 @@ int mod_verify_sig(const void *mod, struct load_info *info)
modlen -= sig_len + sizeof(ms);
info->len = modlen;
return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
VERIFY_USE_SECONDARY_KEYRING,
VERIFYING_MODULE_SIGNATURE,
NULL, NULL);
if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
VERIFY_USE_PLATFORM_KEYRING,
VERIFYING_MODULE_SIGNATURE,
NULL, NULL);
}
return ret;
}
int module_sig_check(struct load_info *info, int flags)