From 4f5ce526c396aeed1c5ae21a03e74a34be3dc2af Mon Sep 17 00:00:00 2001 From: Robert Holmes Date: Tue, 23 Apr 2019 07:39:29 +0000 Subject: [PATCH] KEYS: Make use of platform keyring for module signature verify This patch completes commit 278311e417be ("kexec, KEYS: Make use of platform keyring for signature verify") which, while adding the platform keyring for bzImage verification, neglected to also add this keyring for module verification. As such, kernel modules signed with keys from the MokList variable were not successfully verified. Signed-off-by: Robert Holmes Signed-off-by: Jeremy Cline Gbp-Pq: Topic features/all/db-mok-keyring Gbp-Pq: Name KEYS-Make-use-of-platform-keyring-for-module-signature.patch --- kernel/module_signing.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/module_signing.c b/kernel/module_signing.c index 3afff3718d7..7c51c0559e5 100644 --- a/kernel/module_signing.c +++ b/kernel/module_signing.c @@ -135,6 +135,13 @@ int mod_verify_sig(const void *mod, struct load_info *info) VERIFYING_MODULE_SIGNATURE, NULL, NULL); pr_devel("verify_pkcs7_signature() = %d\n", ret); + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) { + ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len, + VERIFY_USE_PLATFORM_KEYRING, + VERIFYING_MODULE_SIGNATURE, + NULL, NULL); + pr_devel("verify_pkcs7_signature() = %d\n", ret); + } /* checking hash of module is in blacklist */ if (!ret) -- 2.30.2