Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 002c77a48b479b094b834b02ef78be47ceac76fd

Authored by Jarod Wilson
Committed by Herbert Xu
1 parent 8f312d64b5
Exists in ti-lsk-linux-4.1.y and in 10 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-02.00.01, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04

crypto: fips - only panic on bad/missing crypto mod signatures 

Per further discussion with NIST, the requirements for FIPS state that
we only need to panic the system on failed kernel module signature checks
for crypto subsystem modules. This moves the fips-mode-only module
signature check out of the generic module loading code, into the crypto
subsystem, at points where we can catch both algorithm module loads and
mode module loads. At the same time, make CONFIG_CRYPTO_FIPS dependent on
CONFIG_MODULE_SIG, as this is entirely necessary for FIPS mode.

v2: remove extraneous blank line, perform checks in static inline
function, drop no longer necessary fips.h include.

CC: "David S. Miller" <davem@davemloft.net>
CC: Rusty Russell <rusty@rustcorp.com.au>
CC: Stephan Mueller <stephan.mueller@atsec.com>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Showing 3 changed files with 15 additions and 4 deletions Side-by-side Diff

... ... @@ -24,6 +24,7 @@
24 24 config CRYPTO_FIPS
25 25 bool "FIPS 200 compliance"
26 26 depends on (CRYPTO_ANSI_CPRNG || CRYTPO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
  27 + depends on MODULE_SIG
27 28 help
28 29 This options enables the fips boot option which is
29 30 required if you want to system to operate in a FIPS 200
... ... @@ -41,8 +41,20 @@
41 41 return 0;
42 42 }
43 43  
  44 +static inline void crypto_check_module_sig(struct module *mod)
  45 +{
  46 +#ifdef CONFIG_CRYPTO_FIPS
  47 + if (fips_enabled && mod && !mod->sig_ok)
  48 + panic("Module %s signature verification failed in FIPS mode\n",
  49 + mod->name);
  50 +#endif
  51 + return;
  52 +}
  53 +
44 54 static int crypto_check_alg(struct crypto_alg *alg)
45 55 {
  56 + crypto_check_module_sig(alg->cra_module);
  57 +
46 58 if (alg->cra_alignmask & (alg->cra_alignmask + 1))
47 59 return -EINVAL;
48 60  
... ... @@ -429,6 +441,8 @@
429 441 int err = -EEXIST;
430 442  
431 443 down_write(&crypto_alg_sem);
  444 +
  445 + crypto_check_module_sig(tmpl->module);
432 446  
433 447 list_for_each_entry(q, &crypto_template_list, list) {
434 448 if (q == tmpl)
... ... @@ -60,7 +60,6 @@
60 60 #include <linux/jump_label.h>
61 61 #include <linux/pfn.h>
62 62 #include <linux/bsearch.h>
63   -#include <linux/fips.h>
64 63 #include <uapi/linux/module.h>
65 64 #include "module-internal.h"
66 65  
... ... @@ -2448,9 +2447,6 @@
2448 2447 }
2449 2448  
2450 2449 /* Not having a signature is only an error if we're strict. */
2451   - if (err < 0 && fips_enabled)
2452   - panic("Module verification failed with error %d in FIPS mode\n",
2453   - err);
2454 2450 if (err == -ENOKEY && !sig_enforce)
2455 2451 err = 0;
2456 2452