UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature...

This patch completes commit 278311e417be ("kexec, KEYS: Make use of
platform keyring for signature verify") which, while adding the
platform keyring for bzImage verification, neglected to also add
this keyring for module verification.

As such, kernel modules signed with keys from the MokList variable
were not successfully verified.

Signed-off-by: Robert Holmes <robeholmes@gmail.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
(cherry picked from commit 7985392b917f8da1a8f12b2ab1e3be027f280e10
 git://git.kernel.org/pub/scm/linux/kernel/git/jwboyer/fedora.git)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/kernel/module_signing.c b/kernel/module_signing.c
index 9d9fc678c91d6668103faced46bc2a5f47baab49..84ad75a53c839f305009a936fc36dc17f3e95dac 100644 (file)
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -38,8 +38,15 @@ int mod_verify_sig(const void *mod, struct load_info *info)
        modlen -= sig_len + sizeof(ms);
        info->len = modlen;
 
-       return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+       ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
                                      VERIFY_USE_SECONDARY_KEYRING,
                                      VERIFYING_MODULE_SIGNATURE,
                                      NULL, NULL);
+       if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+               ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+                               VERIFY_USE_PLATFORM_KEYRING,
+                               VERIFYING_MODULE_SIGNATURE,
+                               NULL, NULL);
+       }
+       return ret;
 }