kernel/module_signing.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /* Module signature checker
   3  *
   4  * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
   5  * Written by David Howells (dhowells@redhat.com)
   6  */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/errno.h>
  10 #include <linux/module.h>
  11 #include <linux/module_signature.h>
  12 #include <linux/string.h>
  13 #include <linux/verification.h>
  14 #include <crypto/public_key.h>
  15 #include "module-internal.h"
  16
  17 /*
  18  * Verify the signature on a module.
  19  */
  20 int mod_verify_sig(const void *mod, struct load_info *info)
  21 {
  22         struct module_signature ms;
  23         size_t sig_len, modlen = info->len;
  24         int ret;
  25
  26         pr_devel("==>%s(,%zu)\n", __func__, modlen);
  27
  28         if (modlen <= sizeof(ms))
  29                 return -EBADMSG;
  30
  31         memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
  32
  33         ret = mod_check_sig(&ms, modlen, "module");
  34         if (ret)
  35                 return ret;
  36
  37         sig_len = be32_to_cpu(ms.sig_len);
  38         modlen -= sig_len + sizeof(ms);
  39         info->len = modlen;
  40
  41         ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
  42                                       VERIFY_USE_SECONDARY_KEYRING,
  43                                       VERIFYING_MODULE_SIGNATURE,
  44                                       NULL, NULL);
  45         if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
  46                 ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
  47                                 VERIFY_USE_PLATFORM_KEYRING,
  48                                 VERIFYING_MODULE_SIGNATURE,
  49                                 NULL, NULL);
  50         }
  51         return ret;
  52 }