1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Module signature checker
4 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
8 #include <linux/kernel.h>
9 #include <linux/errno.h>
10 #include <linux/string.h>
11 #include <linux/verification.h>
12 #include <crypto/public_key.h>
13 #include "module-internal.h"
16 PKEY_ID_PGP
, /* OpenPGP generated key ID */
17 PKEY_ID_X509
, /* X.509 arbitrary subjectKeyIdentifier */
18 PKEY_ID_PKCS7
, /* Signature in PKCS#7 message */
22 * Module signature information block.
24 * The constituents of the signature section are, in order:
31 struct module_signature
{
32 u8 algo
; /* Public-key crypto algorithm [0] */
33 u8 hash
; /* Digest algorithm [0] */
34 u8 id_type
; /* Key identifier type [PKEY_ID_PKCS7] */
35 u8 signer_len
; /* Length of signer's name [0] */
36 u8 key_id_len
; /* Length of key identifier [0] */
38 __be32 sig_len
; /* Length of signature data */
42 * Verify the signature on a module.
44 int mod_verify_sig(const void *mod
, struct load_info
*info
)
46 struct module_signature ms
;
47 size_t sig_len
, modlen
= info
->len
;
49 pr_devel("==>%s(,%zu)\n", __func__
, modlen
);
51 if (modlen
<= sizeof(ms
))
54 memcpy(&ms
, mod
+ (modlen
- sizeof(ms
)), sizeof(ms
));
57 sig_len
= be32_to_cpu(ms
.sig_len
);
58 if (sig_len
>= modlen
)
63 if (ms
.id_type
!= PKEY_ID_PKCS7
) {
64 pr_err("%s: Module is not signed with expected PKCS#7 message\n",
76 pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n",
81 return verify_pkcs7_signature(mod
, modlen
, mod
+ modlen
, sig_len
,
82 VERIFY_USE_SECONDARY_KEYRING
,
83 VERIFYING_MODULE_SIGNATURE
,