KEYS: CA link restriction

Add a new link restriction.  Restrict the addition of keys in a keyring
based on the key to be added being a CA.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
index 6b1ac5f5896a7f830d61f97cd645d15c9d105331..48457c6f33f95cb701d8ff2afe56e8fa2114be12 100644 (file)
--- a/crypto/asymmetric_keys/restrict.c
+++ b/crypto/asymmetric_keys/restrict.c
@@ -108,6 +108,44 @@ int restrict_link_by_signature(struct key *dest_keyring,
        return ret;
 }
 
+/**
+ * restrict_link_by_ca - Restrict additions to a ring of CA keys
+ * @dest_keyring: Keyring being linked to.
+ * @type: The type of key being added.
+ * @payload: The payload of the new key.
+ * @trust_keyring: Unused.
+ *
+ * Check if the new certificate is a CA. If it is a CA, then mark the new
+ * certificate as being ok to link.
+ *
+ * Returns 0 if the new certificate was accepted, -ENOKEY if the
+ * certificate is not a CA. -ENOPKG if the signature uses unsupported
+ * crypto, or some other error if there is a matching certificate but
+ * the signature check cannot be performed.
+ */
+int restrict_link_by_ca(struct key *dest_keyring,
+                       const struct key_type *type,
+                       const union key_payload *payload,
+                       struct key *trust_keyring)
+{
+       const struct public_key *pkey;
+
+       if (type != &key_type_asymmetric)
+               return -EOPNOTSUPP;
+
+       pkey = payload->data[asym_crypto];
+       if (!pkey)
+               return -ENOPKG;
+       if (!test_bit(KEY_EFLAG_CA, &pkey->key_eflags))
+               return -ENOKEY;
+       if (!test_bit(KEY_EFLAG_KEYCERTSIGN, &pkey->key_eflags))
+               return -ENOKEY;
+       if (test_bit(KEY_EFLAG_DIGITALSIG, &pkey->key_eflags))
+               return -ENOKEY;
+
+       return 0;
+}
+
 static bool match_either_id(const struct asymmetric_key_id **pair,
                            const struct asymmetric_key_id *single)
 {

diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 03c3fb990d59ce55597a3833cdede2ca0164d6fb..653992a6e9410464f73a5d75a3393c80324835a0 100644 (file)
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -75,6 +75,21 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring,
                                                 const union key_payload *payload,
                                                 struct key *trusted);
 
+#if IS_REACHABLE(CONFIG_ASYMMETRIC_KEY_TYPE)
+extern int restrict_link_by_ca(struct key *dest_keyring,
+                              const struct key_type *type,
+                              const union key_payload *payload,
+                              struct key *trust_keyring);
+#else
+static inline int restrict_link_by_ca(struct key *dest_keyring,
+                                     const struct key_type *type,
+                                     const union key_payload *payload,
+                                     struct key *trust_keyring)
+{
+       return 0;
+}
+#endif
+
 extern int query_asymmetric_key(const struct kernel_pkey_params *,
                                struct kernel_pkey_query *);