Merge branch 'fixes-v4.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

+1

crypto/asymmetric_keys/pkcs7_trust.c

··· 106 106 pr_devel("sinfo %u: Direct signer is key %x\n", 107 107 sinfo->index, key_serial(key)); 108 108 x509 = NULL; 109 + sig = sinfo->sig; 109 110 goto matched; 110 111 } 111 112 if (PTR_ERR(key) != -ENOKEY)

+7 -5

crypto/asymmetric_keys/pkcs7_verify.c

··· 270 270 sinfo->index); 271 271 return 0; 272 272 } 273 - ret = public_key_verify_signature(p->pub, p->sig); 273 + ret = public_key_verify_signature(p->pub, x509->sig); 274 274 if (ret < 0) 275 275 return ret; 276 276 x509->signer = p; ··· 366 366 * 367 367 * (*) -EBADMSG if some part of the message was invalid, or: 368 368 * 369 - * (*) 0 if no signature chains were found to be blacklisted or to contain 370 - * unsupported crypto, or: 369 + * (*) 0 if a signature chain passed verification, or: 371 370 * 372 371 * (*) -EKEYREJECTED if a blacklisted key was encountered, or: 373 372 * ··· 422 423 423 424 for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { 424 425 ret = pkcs7_verify_one(pkcs7, sinfo); 425 - if (sinfo->blacklisted && actual_ret == -ENOPKG) 426 - actual_ret = -EKEYREJECTED; 426 + if (sinfo->blacklisted) { 427 + if (actual_ret == -ENOPKG) 428 + actual_ret = -EKEYREJECTED; 429 + continue; 430 + } 427 431 if (ret < 0) { 428 432 if (ret == -ENOPKG) { 429 433 sinfo->unsupported_crypto = true;

+3 -1

crypto/asymmetric_keys/public_key.c

··· 79 79 80 80 BUG_ON(!pkey); 81 81 BUG_ON(!sig); 82 - BUG_ON(!sig->digest); 83 82 BUG_ON(!sig->s); 83 + 84 + if (!sig->digest) 85 + return -ENOPKG; 84 86 85 87 alg_name = sig->pkey_algo; 86 88 if (strcmp(sig->pkey_algo, "rsa") == 0) {

+13 -8

crypto/asymmetric_keys/restrict.c

··· 67 67 * 68 68 * Returns 0 if the new certificate was accepted, -ENOKEY if we couldn't find a 69 69 * matching parent certificate in the trusted list, -EKEYREJECTED if the 70 - * signature check fails or the key is blacklisted and some other error if 71 - * there is a matching certificate but the signature check cannot be performed. 70 + * signature check fails or the key is blacklisted, -ENOPKG if the signature 71 + * uses unsupported crypto, or some other error if there is a matching 72 + * certificate but the signature check cannot be performed. 72 73 */ 73 74 int restrict_link_by_signature(struct key *dest_keyring, 74 75 const struct key_type *type, ··· 89 88 return -EOPNOTSUPP; 90 89 91 90 sig = payload->data[asym_auth]; 91 + if (!sig) 92 + return -ENOPKG; 92 93 if (!sig->auth_ids[0] && !sig->auth_ids[1]) 93 94 return -ENOKEY; 94 95 ··· 142 139 return -EOPNOTSUPP; 143 140 144 141 sig = payload->data[asym_auth]; 142 + if (!sig) 143 + return -ENOPKG; 145 144 if (!sig->auth_ids[0] && !sig->auth_ids[1]) 146 145 return -ENOKEY; 147 146 ··· 227 222 * 228 223 * Returns 0 if the new certificate was accepted, -ENOKEY if we 229 224 * couldn't find a matching parent certificate in the trusted list, 230 - * -EKEYREJECTED if the signature check fails, and some other error if 231 - * there is a matching certificate but the signature check cannot be 232 - * performed. 225 + * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses 226 + * unsupported crypto, or some other error if there is a matching certificate 227 + * but the signature check cannot be performed. 233 228 */ 234 229 int restrict_link_by_key_or_keyring(struct key *dest_keyring, 235 230 const struct key_type *type, ··· 254 249 * 255 250 * Returns 0 if the new certificate was accepted, -ENOKEY if we 256 251 * couldn't find a matching parent certificate in the trusted list, 257 - * -EKEYREJECTED if the signature check fails, and some other error if 258 - * there is a matching certificate but the signature check cannot be 259 - * performed. 252 + * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses 253 + * unsupported crypto, or some other error if there is a matching certificate 254 + * but the signature check cannot be performed. 260 255 */ 261 256 int restrict_link_by_key_or_keyring_chain(struct key *dest_keyring, 262 257 const struct key_type *type,

+2 -2

include/uapi/linux/ptrace.h

··· 69 69 #define PTRACE_SECCOMP_GET_METADATA 0x420d 70 70 71 71 struct seccomp_metadata { 72 - unsigned long filter_off; /* Input: which filter */ 73 - unsigned int flags; /* Output: filter's flags */ 72 + __u64 filter_off; /* Input: which filter */ 73 + __u64 flags; /* Output: filter's flags */ 74 74 }; 75 75 76 76 /* Read signals from a shared (process wide) queue */

+4 -2

kernel/seccomp.c

··· 1076 1076 1077 1077 size = min_t(unsigned long, size, sizeof(kmd)); 1078 1078 1079 - if (copy_from_user(&kmd, data, size)) 1079 + if (size < sizeof(kmd.filter_off)) 1080 + return -EINVAL; 1081 + 1082 + if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 1080 1083 return -EFAULT; 1081 1084 1082 1085 filter = get_nth_filter(task, kmd.filter_off); 1083 1086 if (IS_ERR(filter)) 1084 1087 return PTR_ERR(filter); 1085 1088 1086 - memset(&kmd, 0, sizeof(kmd)); 1087 1089 if (filter->log) 1088 1090 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 1089 1091

+1

security/integrity/digsig.c

··· 18 18 #include <linux/cred.h> 19 19 #include <linux/key-type.h> 20 20 #include <linux/digsig.h> 21 + #include <linux/vmalloc.h> 21 22 #include <crypto/public_key.h> 22 23 #include <keys/system_keyring.h> 23 24

+87 -23

security/keys/big_key.c

··· 22 22 #include <keys/big_key-type.h> 23 23 #include <crypto/aead.h> 24 24 25 + struct big_key_buf { 26 + unsigned int nr_pages; 27 + void *virt; 28 + struct scatterlist *sg; 29 + struct page *pages[]; 30 + }; 31 + 25 32 /* 26 33 * Layout of key payload words. 27 34 */ ··· 98 91 /* 99 92 * Encrypt/decrypt big_key data 100 93 */ 101 - static int big_key_crypt(enum big_key_op op, u8 *data, size_t datalen, u8 *key) 94 + static int big_key_crypt(enum big_key_op op, struct big_key_buf *buf, size_t datalen, u8 *key) 102 95 { 103 96 int ret; 104 - struct scatterlist sgio; 105 97 struct aead_request *aead_req; 106 98 /* We always use a zero nonce. The reason we can get away with this is 107 99 * because we're using a different randomly generated key for every ··· 115 109 return -ENOMEM; 116 110 117 111 memset(zero_nonce, 0, sizeof(zero_nonce)); 118 - sg_init_one(&sgio, data, datalen + (op == BIG_KEY_ENC ? ENC_AUTHTAG_SIZE : 0)); 119 - aead_request_set_crypt(aead_req, &sgio, &sgio, datalen, zero_nonce); 112 + aead_request_set_crypt(aead_req, buf->sg, buf->sg, datalen, zero_nonce); 120 113 aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL); 121 114 aead_request_set_ad(aead_req, 0); 122 115 ··· 135 130 } 136 131 137 132 /* 133 + * Free up the buffer. 134 + */ 135 + static void big_key_free_buffer(struct big_key_buf *buf) 136 + { 137 + unsigned int i; 138 + 139 + if (buf->virt) { 140 + memset(buf->virt, 0, buf->nr_pages * PAGE_SIZE); 141 + vunmap(buf->virt); 142 + } 143 + 144 + for (i = 0; i < buf->nr_pages; i++) 145 + if (buf->pages[i]) 146 + __free_page(buf->pages[i]); 147 + 148 + kfree(buf); 149 + } 150 + 151 + /* 152 + * Allocate a buffer consisting of a set of pages with a virtual mapping 153 + * applied over them. 154 + */ 155 + static void *big_key_alloc_buffer(size_t len) 156 + { 157 + struct big_key_buf *buf; 158 + unsigned int npg = (len + PAGE_SIZE - 1) >> PAGE_SHIFT; 159 + unsigned int i, l; 160 + 161 + buf = kzalloc(sizeof(struct big_key_buf) + 162 + sizeof(struct page) * npg + 163 + sizeof(struct scatterlist) * npg, 164 + GFP_KERNEL); 165 + if (!buf) 166 + return NULL; 167 + 168 + buf->nr_pages = npg; 169 + buf->sg = (void *)(buf->pages + npg); 170 + sg_init_table(buf->sg, npg); 171 + 172 + for (i = 0; i < buf->nr_pages; i++) { 173 + buf->pages[i] = alloc_page(GFP_KERNEL); 174 + if (!buf->pages[i]) 175 + goto nomem; 176 + 177 + l = min_t(size_t, len, PAGE_SIZE); 178 + sg_set_page(&buf->sg[i], buf->pages[i], l, 0); 179 + len -= l; 180 + } 181 + 182 + buf->virt = vmap(buf->pages, buf->nr_pages, VM_MAP, PAGE_KERNEL); 183 + if (!buf->virt) 184 + goto nomem; 185 + 186 + return buf; 187 + 188 + nomem: 189 + big_key_free_buffer(buf); 190 + return NULL; 191 + } 192 + 193 + /* 138 194 * Preparse a big key 139 195 */ 140 196 int big_key_preparse(struct key_preparsed_payload *prep) 141 197 { 198 + struct big_key_buf *buf; 142 199 struct path *path = (struct path *)&prep->payload.data[big_key_path]; 143 200 struct file *file; 144 201 u8 *enckey; 145 - u8 *data = NULL; 146 202 ssize_t written; 147 - size_t datalen = prep->datalen; 203 + size_t datalen = prep->datalen, enclen = datalen + ENC_AUTHTAG_SIZE; 148 204 int ret; 149 205 150 - ret = -EINVAL; 151 206 if (datalen <= 0 || datalen > 1024 * 1024 || !prep->data) 152 - goto error; 207 + return -EINVAL; 153 208 154 209 /* Set an arbitrary quota */ 155 210 prep->quotalen = 16; ··· 222 157 * 223 158 * File content is stored encrypted with randomly generated key. 224 159 */ 225 - size_t enclen = datalen + ENC_AUTHTAG_SIZE; 226 160 loff_t pos = 0; 227 161 228 - data = kmalloc(enclen, GFP_KERNEL); 229 - if (!data) 162 + buf = big_key_alloc_buffer(enclen); 163 + if (!buf) 230 164 return -ENOMEM; 231 - memcpy(data, prep->data, datalen); 165 + memcpy(buf->virt, prep->data, datalen); 232 166 233 167 /* generate random key */ 234 168 enckey = kmalloc(ENC_KEY_SIZE, GFP_KERNEL); ··· 240 176 goto err_enckey; 241 177 242 178 /* encrypt aligned data */ 243 - ret = big_key_crypt(BIG_KEY_ENC, data, datalen, enckey); 179 + ret = big_key_crypt(BIG_KEY_ENC, buf, datalen, enckey); 244 180 if (ret) 245 181 goto err_enckey; 246 182 ··· 251 187 goto err_enckey; 252 188 } 253 189 254 - written = kernel_write(file, data, enclen, &pos); 190 + written = kernel_write(file, buf->virt, enclen, &pos); 255 191 if (written != enclen) { 256 192 ret = written; 257 193 if (written >= 0) ··· 266 202 *path = file->f_path; 267 203 path_get(path); 268 204 fput(file); 269 - kzfree(data); 205 + big_key_free_buffer(buf); 270 206 } else { 271 207 /* Just store the data in a buffer */ 272 208 void *data = kmalloc(datalen, GFP_KERNEL); ··· 284 220 err_enckey: 285 221 kzfree(enckey); 286 222 error: 287 - kzfree(data); 223 + big_key_free_buffer(buf); 288 224 return ret; 289 225 } 290 226 ··· 362 298 return datalen; 363 299 364 300 if (datalen > BIG_KEY_FILE_THRESHOLD) { 301 + struct big_key_buf *buf; 365 302 struct path *path = (struct path *)&key->payload.data[big_key_path]; 366 303 struct file *file; 367 - u8 *data; 368 304 u8 *enckey = (u8 *)key->payload.data[big_key_data]; 369 305 size_t enclen = datalen + ENC_AUTHTAG_SIZE; 370 306 loff_t pos = 0; 371 307 372 - data = kmalloc(enclen, GFP_KERNEL); 373 - if (!data) 308 + buf = big_key_alloc_buffer(enclen); 309 + if (!buf) 374 310 return -ENOMEM; 375 311 376 312 file = dentry_open(path, O_RDONLY, current_cred()); ··· 380 316 } 381 317 382 318 /* read file to kernel and decrypt */ 383 - ret = kernel_read(file, data, enclen, &pos); 319 + ret = kernel_read(file, buf->virt, enclen, &pos); 384 320 if (ret >= 0 && ret != enclen) { 385 321 ret = -EIO; 386 322 goto err_fput; 387 323 } 388 324 389 - ret = big_key_crypt(BIG_KEY_DEC, data, enclen, enckey); 325 + ret = big_key_crypt(BIG_KEY_DEC, buf, enclen, enckey); 390 326 if (ret) 391 327 goto err_fput; 392 328 393 329 ret = datalen; 394 330 395 331 /* copy decrypted data to user */ 396 - if (copy_to_user(buffer, data, datalen) != 0) 332 + if (copy_to_user(buffer, buf->virt, datalen) != 0) 397 333 ret = -EFAULT; 398 334 399 335 err_fput: 400 336 fput(file); 401 337 error: 402 - kzfree(data); 338 + big_key_free_buffer(buf); 403 339 } else { 404 340 ret = datalen; 405 341 if (copy_to_user(buffer, key->payload.data[big_key_data],

+61

tools/testing/selftests/seccomp/seccomp_bpf.c

··· 141 141 #define SECCOMP_FILTER_FLAG_LOG 2 142 142 #endif 143 143 144 + #ifndef PTRACE_SECCOMP_GET_METADATA 145 + #define PTRACE_SECCOMP_GET_METADATA 0x420d 146 + 147 + struct seccomp_metadata { 148 + __u64 filter_off; /* Input: which filter */ 149 + __u64 flags; /* Output: filter's flags */ 150 + }; 151 + #endif 152 + 144 153 #ifndef seccomp 145 154 int seccomp(unsigned int op, unsigned int flags, void *args) 146 155 { ··· 2852 2843 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action); 2853 2844 EXPECT_EQ(ret, -1); 2854 2845 EXPECT_EQ(errno, EOPNOTSUPP); 2846 + } 2847 + 2848 + TEST(get_metadata) 2849 + { 2850 + pid_t pid; 2851 + int pipefd[2]; 2852 + char buf; 2853 + struct seccomp_metadata md; 2854 + 2855 + ASSERT_EQ(0, pipe(pipefd)); 2856 + 2857 + pid = fork(); 2858 + ASSERT_GE(pid, 0); 2859 + if (pid == 0) { 2860 + struct sock_filter filter[] = { 2861 + BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2862 + }; 2863 + struct sock_fprog prog = { 2864 + .len = (unsigned short)ARRAY_SIZE(filter), 2865 + .filter = filter, 2866 + }; 2867 + 2868 + /* one with log, one without */ 2869 + ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 2870 + SECCOMP_FILTER_FLAG_LOG, &prog)); 2871 + ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog)); 2872 + 2873 + ASSERT_EQ(0, close(pipefd[0])); 2874 + ASSERT_EQ(1, write(pipefd[1], "1", 1)); 2875 + ASSERT_EQ(0, close(pipefd[1])); 2876 + 2877 + while (1) 2878 + sleep(100); 2879 + } 2880 + 2881 + ASSERT_EQ(0, close(pipefd[1])); 2882 + ASSERT_EQ(1, read(pipefd[0], &buf, 1)); 2883 + 2884 + ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid)); 2885 + ASSERT_EQ(pid, waitpid(pid, NULL, 0)); 2886 + 2887 + md.filter_off = 0; 2888 + ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md)); 2889 + EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG); 2890 + EXPECT_EQ(md.filter_off, 0); 2891 + 2892 + md.filter_off = 1; 2893 + ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md)); 2894 + EXPECT_EQ(md.flags, 0); 2895 + EXPECT_EQ(md.filter_off, 1); 2896 + 2897 + ASSERT_EQ(0, kill(pid, SIGKILL)); 2855 2898 } 2856 2899 2857 2900 /*

Configure Feed

Configure Feed