From: Robert Holmes <robeholmes@gmail.com>
Date: Tue, 23 Apr 2019 07:39:29 +0000 (+0000)
Subject: [PATCH] KEYS: Make use of platform keyring for module signature verify
X-Git-Tag: archive/raspbian/5.16.7-2+rpi1^2~17
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=42314a9f5aa06c9dc002c2cc5229844d8c0cff97;p=linux.git

[PATCH] KEYS: Make use of platform keyring for module signature verify

Bug-Debian: https://bugs.debian.org/935945
Origin: https://src.fedoraproject.org/rpms/kernel/raw/master/f/KEYS-Make-use-of-platform-keyring-for-module-signature.patch

This patch completes commit 278311e417be ("kexec, KEYS: Make use of
platform keyring for signature verify") which, while adding the
platform keyring for bzImage verification, neglected to also add
this keyring for module verification.

As such, kernel modules signed with keys from the MokList variable
were not successfully verified.

Signed-off-by: Robert Holmes <robeholmes@gmail.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>

Gbp-Pq: Topic features/all/db-mok-keyring
Gbp-Pq: Name KEYS-Make-use-of-platform-keyring-for-module-signature.patch
---

diff --git a/kernel/module_signing.c b/kernel/module_signing.c
index 0eec5082b9f..30cd8033650 100644
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -93,6 +93,13 @@ int mod_verify_sig(const void *mod, struct load_info *info)
 				      VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
 	pr_devel("verify_pkcs7_signature() = %d\n", ret);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+		ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+				VERIFY_USE_PLATFORM_KEYRING,
+				VERIFYING_MODULE_SIGNATURE,
+				NULL, NULL);
+                pr_devel("verify_pkcs7_signature() = %d\n", ret);
+	}
 
 	/* checking hash of module is in blacklist */
 	if (!ret)