1
2
3
4
5
6
7
8
9
10
11
12#include <linux/export.h>
13#include <linux/kernel.h>
14#include <linux/sched.h>
15#include <linux/cred.h>
16#include <linux/err.h>
17#include <keys/asymmetric-type.h>
18#include <keys/system_keyring.h>
19#include "module-internal.h"
20
21struct key *system_trusted_keyring;
22EXPORT_SYMBOL_GPL(system_trusted_keyring);
23#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
24struct key *system_blacklist_keyring;
25#endif
26
27extern __initconst const u8 system_certificate_list[];
28extern __initconst const unsigned long system_certificate_list_size;
29
30
31
32
33static __init int system_trusted_keyring_init(void)
34{
35 pr_notice("Initialise system trusted keyring\n");
36
37 system_trusted_keyring =
38 keyring_alloc(".system_keyring",
39 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
40 ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
41 KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
42 KEY_ALLOC_NOT_IN_QUOTA, NULL);
43 if (IS_ERR(system_trusted_keyring))
44 panic("Can't allocate system trusted keyring\n");
45
46 set_bit(KEY_FLAG_TRUSTED_ONLY, &system_trusted_keyring->flags);
47
48#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
49 system_blacklist_keyring = keyring_alloc(".system_blacklist_keyring",
50 KUIDT_INIT(0), KGIDT_INIT(0),
51 current_cred(),
52 (KEY_POS_ALL & ~KEY_POS_SETATTR) |
53 KEY_USR_VIEW | KEY_USR_READ,
54 KEY_ALLOC_NOT_IN_QUOTA, NULL);
55 if (IS_ERR(system_blacklist_keyring))
56 panic("Can't allocate system blacklist keyring\n");
57
58 set_bit(KEY_FLAG_TRUSTED_ONLY, &system_blacklist_keyring->flags);
59#endif
60
61 return 0;
62}
63
64
65
66
67device_initcall(system_trusted_keyring_init);
68
69
70
71
72static __init int load_system_certificate_list(void)
73{
74 key_ref_t key;
75 const u8 *p, *end;
76 size_t plen;
77
78 pr_notice("Loading compiled-in X.509 certificates\n");
79
80 p = system_certificate_list;
81 end = p + system_certificate_list_size;
82 while (p < end) {
83
84
85
86 if (end - p < 4)
87 goto dodgy_cert;
88 if (p[0] != 0x30 &&
89 p[1] != 0x82)
90 goto dodgy_cert;
91 plen = (p[2] << 8) | p[3];
92 plen += 4;
93 if (plen > end - p)
94 goto dodgy_cert;
95
96 key = key_create_or_update(make_key_ref(system_trusted_keyring, 1),
97 "asymmetric",
98 NULL,
99 p,
100 plen,
101 ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
102 KEY_USR_VIEW | KEY_USR_READ),
103 KEY_ALLOC_NOT_IN_QUOTA |
104 KEY_ALLOC_TRUSTED);
105 if (IS_ERR(key)) {
106 pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
107 PTR_ERR(key));
108 } else {
109 set_bit(KEY_FLAG_BUILTIN, &key_ref_to_ptr(key)->flags);
110 pr_notice("Loaded X.509 cert '%s'\n",
111 key_ref_to_ptr(key)->description);
112 key_ref_put(key);
113 }
114 p += plen;
115 }
116
117 return 0;
118
119dodgy_cert:
120 pr_err("Problem parsing in-kernel X.509 certificate list\n");
121 return 0;
122}
123late_initcall(load_system_certificate_list);
124