[prev in list] [next in list] [prev in thread] [next in thread]
List: linux-keyrings
Subject: Re: [PATCH v1 2/2] asymmetric_keys: log on fatal failures in PE/pkcs7
From: Jarkko Sakkinen <jarkko () kernel ! org>
Date: 2023-02-17 21:14:00
Message-ID: Y+/uGG1rsvf9kt4d () kernel ! org
[Download RAW message or body]
On Fri, Feb 17, 2023 at 03:14:35PM -0500, Robbie Harwood wrote:
> These particular errors can be encountered while trying to kexec when
> secureboot lockdown is in place. Without this change, even with a
> signed debug build, one still needs to reboot the machine to add the
> appropriate dyndbg parameters (since lockdown blocks debugfs).
>
> Accordingly, upgrade all pr_debug() before fatal error into pr_info().
>
> Signed-off-by: Robbie Harwood <rharwood@redhat.com>
Eessentially this changes configuration to hard coded implementation.
No gain IMHO. If you are ready to patch the kernel you could live with
boot time dyndbg parameters.
> ---
> crypto/asymmetric_keys/pkcs7_verify.c | 10 +++++-----
> crypto/asymmetric_keys/verify_pefile.c | 24 ++++++++++++------------
> 2 files changed, 17 insertions(+), 17 deletions(-)
>
> diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
> index f6321c785714..da425d142720 100644
> --- a/crypto/asymmetric_keys/pkcs7_verify.c
> +++ b/crypto/asymmetric_keys/pkcs7_verify.c
> @@ -79,16 +79,16 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7,
> }
>
> if (sinfo->msgdigest_len != sig->digest_size) {
> - pr_debug("Sig %u: Invalid digest size (%u)\n",
> - sinfo->index, sinfo->msgdigest_len);
> + pr_info("Sig %u: Invalid digest size (%u)\n",
> + sinfo->index, sinfo->msgdigest_len);
> ret = -EBADMSG;
> goto error;
> }
>
> if (memcmp(sig->digest, sinfo->msgdigest,
> sinfo->msgdigest_len) != 0) {
> - pr_debug("Sig %u: Message digest doesn't match\n",
> - sinfo->index);
> + pr_info("Sig %u: Message digest doesn't match\n",
> + sinfo->index);
> ret = -EKEYREJECTED;
> goto error;
> }
> @@ -478,7 +478,7 @@ int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
> const void *data, size_t datalen)
> {
> if (pkcs7->data) {
> - pr_debug("Data already supplied\n");
> + pr_info("Data already supplied\n");
> return -EINVAL;
> }
> pkcs7->data = data;
> diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
> index fe1bb374239d..c30e6610db26 100644
> --- a/crypto/asymmetric_keys/verify_pefile.c
> +++ b/crypto/asymmetric_keys/verify_pefile.c
> @@ -74,7 +74,7 @@ static int pefile_parse_binary(const void *pebuf, unsigned int pelen,
> break;
>
> default:
> - pr_debug("Unknown PEOPT magic = %04hx\n", pe32->magic);
> + pr_info("Unknown PEOPT magic = %04hx\n", pe32->magic);
> return -ELIBBAD;
> }
>
> @@ -95,7 +95,7 @@ static int pefile_parse_binary(const void *pebuf, unsigned int pelen,
> ctx->certs_size = ddir->certs.size;
>
> if (!ddir->certs.virtual_address || !ddir->certs.size) {
> - pr_debug("Unsigned PE binary\n");
> + pr_info("Unsigned PE binary\n");
> return -ENODATA;
> }
>
> @@ -127,7 +127,7 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
> unsigned len;
>
> if (ctx->sig_len < sizeof(wrapper)) {
> - pr_debug("Signature wrapper too short\n");
> + pr_info("Signature wrapper too short\n");
> return -ELIBBAD;
> }
>
> @@ -142,16 +142,16 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
> * rounded up since 0.110.
> */
> if (wrapper.length > ctx->sig_len) {
> - pr_debug("Signature wrapper bigger than sig len (%x > %x)\n",
> - ctx->sig_len, wrapper.length);
> + pr_info("Signature wrapper bigger than sig len (%x > %x)\n",
> + ctx->sig_len, wrapper.length);
> return -ELIBBAD;
> }
> if (wrapper.revision != WIN_CERT_REVISION_2_0) {
> - pr_debug("Signature is not revision 2.0\n");
> + pr_info("Signature is not revision 2.0\n");
> return -ENOTSUPP;
> }
> if (wrapper.cert_type != WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
> - pr_debug("Signature certificate type is not PKCS\n");
> + pr_info("Signature certificate type is not PKCS\n");
> return -ENOTSUPP;
> }
>
> @@ -164,7 +164,7 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
> ctx->sig_offset += sizeof(wrapper);
> ctx->sig_len -= sizeof(wrapper);
> if (ctx->sig_len < 4) {
> - pr_debug("Signature data missing\n");
> + pr_info("Signature data missing\n");
> return -EKEYREJECTED;
> }
>
> @@ -198,7 +198,7 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
> return 0;
> }
> not_pkcs7:
> - pr_debug("Signature data not PKCS#7\n");
> + pr_info("Signature data not PKCS#7\n");
> return -ELIBBAD;
> }
>
> @@ -341,8 +341,8 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
> digest_size = crypto_shash_digestsize(tfm);
>
> if (digest_size != ctx->digest_len) {
> - pr_debug("Digest size mismatch (%zx != %x)\n",
> - digest_size, ctx->digest_len);
> + pr_info("Digest size mismatch (%zx != %x)\n",
> + digest_size, ctx->digest_len);
> ret = -EBADMSG;
> goto error_no_desc;
> }
> @@ -373,7 +373,7 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
> * PKCS#7 certificate.
> */
> if (memcmp(digest, ctx->digest, ctx->digest_len) != 0) {
> - pr_debug("Digest mismatch\n");
> + pr_info("Digest mismatch\n");
> ret = -EKEYREJECTED;
> } else {
> pr_debug("The digests match!\n");
> --
> 2.39.1
>
BR, Jarkko
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic