linux-stable.git/security/integrity/digsig.c, branch linux-5.15.y

integrity: Fix memory leakage in keyring allocation error path

2022-12-31T12:14:10+00:00

[ Upstream commit 39419ef7af0916cc3620ecf1ed42d29659109bf3 ]

Key restriction is allocated in integrity_init_keyring(). However, if
keyring allocation failed, it is not freed, causing memory leaks.

Fixes: 2b6aa412ff23 ("KEYS: Use structure to capture key restriction function and data")
Signed-off-by: GUO Zihua 
Signed-off-by: Mimi Zohar 
Signed-off-by: Sasha Levin

ima: enable loading of build time generated key on .ima keyring

2021-04-09T14:40:20+00:00

The kernel currently only loads the kernel module signing key onto the
builtin trusted keyring. Load the module signing key onto the IMA keyring
as well.

Signed-off-by: Nayna Jain 
Acked-by: Stefan Berger 
Signed-off-by: Mimi Zohar

integrity: Make function integrity_add_key() static

2021-02-12T16:11:59+00:00

The sparse tool complains as follows:

security/integrity/digsig.c:146:12: warning:
 symbol 'integrity_add_key' was not declared. Should it be static?

This function is not used outside of digsig.c, so this
commit marks it static.

Reported-by: Hulk Robot 
Fixes: 60740accf784 ("integrity: Load certs to the platform keyring")
Signed-off-by: Wei Yongjun 
Reviewed-by: Kees Cook 
Reviewed-by: Nayna Jain 
Signed-off-by: Mimi Zohar

fs/kernel_file_read: Add "offset" arg for partial reads

2020-10-05T11:37:04+00:00

To perform partial reads, callers of kernel_read_file*() must have a
non-NULL file_size argument and a preallocated buffer. The new "offset"
argument can then be used to seek to specific locations in the file to
fill the buffer to, at most, "buf_size" per call.

Where possible, the LSM hooks can report whether a full file has been
read or not so that the contents can be reasoned about.

Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20201002173828.2099543-14-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman

fs/kernel_read_file: Add file_size output argument

2020-10-05T11:37:03+00:00

In preparation for adding partial read support, add an optional output
argument to kernel_read_file*() that reports the file size so callers
can reason more easily about their reading progress.

Signed-off-by: Kees Cook 
Reviewed-by: Mimi Zohar 
Reviewed-by: Luis Chamberlain 
Reviewed-by: James Morris 
Acked-by: Scott Branden 
Link: https://lore.kernel.org/r/20201002173828.2099543-8-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman

fs/kernel_read_file: Switch buffer size arg to size_t

2020-10-05T11:34:19+00:00

In preparation for further refactoring of kernel_read_file*(), rename
the "max_size" argument to the more accurate "buf_size", and correct
its type to size_t. Add kerndoc to explain the specifics of how the
arguments will be used. Note that with buf_size now size_t, it can no
longer be negative (and was never called with a negative value). Adjust
callers to use it as a "maximum size" when *buf is NULL.

Signed-off-by: Kees Cook 
Reviewed-by: Mimi Zohar 
Reviewed-by: Luis Chamberlain 
Reviewed-by: James Morris 
Acked-by: Scott Branden 
Link: https://lore.kernel.org/r/20201002173828.2099543-7-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman

fs/kernel_read_file: Remove redundant size argument

2020-10-05T11:34:18+00:00

In preparation for refactoring kernel_read_file*(), remove the redundant
"size" argument which is not needed: it can be included in the return
code, with callers adjusted. (VFS reads already cannot be larger than
INT_MAX.)

Signed-off-by: Kees Cook 
Reviewed-by: Mimi Zohar 
Reviewed-by: Luis Chamberlain 
Reviewed-by: James Morris 
Acked-by: Scott Branden 
Link: https://lore.kernel.org/r/20201002173828.2099543-6-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman

fs/kernel_read_file: Split into separate include file

2020-10-05T11:34:18+00:00

Move kernel_read_file* out of linux/fs.h to its own linux/kernel_read_file.h
include file. That header gets pulled in just about everywhere
and doesn't really need functions not related to the general fs interface.

Suggested-by: Christoph Hellwig 
Signed-off-by: Scott Branden 
Signed-off-by: Kees Cook 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Mimi Zohar 
Reviewed-by: Luis Chamberlain 
Acked-by: Greg Kroah-Hartman 
Acked-by: James Morris 
Link: https://lore.kernel.org/r/20200706232309.12010-2-scott.branden@broadcom.com
Link: https://lore.kernel.org/r/20201002173828.2099543-4-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman

fs/kernel_read_file: Remove FIRMWARE_PREALLOC_BUFFER enum

2020-10-05T11:34:18+00:00

FIRMWARE_PREALLOC_BUFFER is a "how", not a "what", and confuses the LSMs
that are interested in filtering between types of things. The "how"
should be an internal detail made uninteresting to the LSMs.

Fixes: a098ecd2fa7d ("firmware: support loading into a pre-allocated buffer")
Fixes: fd90bc559bfb ("ima: based on policy verify firmware signatures (pre-allocated buffer)")
Fixes: 4f0496d8ffa3 ("ima: based on policy warn about loading firmware (pre-allocated buffer)")
Signed-off-by: Kees Cook 
Reviewed-by: Mimi Zohar 
Reviewed-by: Luis Chamberlain 
Acked-by: Scott Branden 
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201002173828.2099543-2-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman

integrity: Remove duplicate pr_fmt definitions

2020-02-28T19:32:58+00:00

The #define for formatting log messages, pr_fmt, is duplicated in the
files under security/integrity.

This change moves the definition to security/integrity/integrity.h and
removes the duplicate definitions in the other files under
security/integrity.

With this change, the messages in the following files will be prefixed
with 'integrity'.

     security/integrity/platform_certs/platform_keyring.c
     security/integrity/platform_certs/load_powerpc.c
     security/integrity/platform_certs/load_uefi.c
     security/integrity/iint.c

     e.g. "integrity: Error adding keys to platform keyring %s\n"

And the messages in the following file will be prefixed with 'ima'.

     security/integrity/ima/ima_mok.c

     e.g. "ima: Allocating IMA blacklist keyring.\n"

For the rest of the files under security/integrity, there will be no
change in the message format.

Suggested-by: Shuah Khan 
Suggested-by: Joe Perches 
Signed-off-by: Tushar Sugandhi 
Reviewed-by: Lakshmi Ramasubramanian 
Signed-off-by: Mimi Zohar