[PATCH v2 06/13] security/keys: implement wipe op for user-type keys
Jan Sebastian Götte <[email protected]>
| Newsgroups | org.kernel.vger.keyrings,dev.linux.lists.dm-devel,org.infradead.lists.kexec,org.kernel.vger.linux-crypto,org.kernel.vger.linux-doc,org.kernel.vger.linux-fscrypt,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-integrity,org.kernel.vger.linux-kernel,org.kernel.vger.linux-nfs,org.kernel.vger.linux-security-module,org.kernel.vger.netdev,org.kvack.linux-mm |
|---|---|
| Message-ID | <[email protected]> |
Wipe the payload of "user" and "logon" keys, and of the key types reusing the user-type ops: s390 cert_store, NVMe TLS PSK, NFS idmap and PKCS#7. Used by CONFIG_CRASH_WIPE_SECRETS. Signed-off-by: Jan Sebastian Götte <[email protected]> --- crypto/asymmetric_keys/pkcs7_key_type.c | 1 + drivers/nvme/common/keyring.c | 1 + fs/nfs/nfs4idmap.c | 2 ++ include/keys/user-type.h | 1 + security/keys/user_defined.c | 15 +++++++++++++++ 5 files changed, 20 insertions(+) diff --git a/crypto/asymmetric_keys/pkcs7_key_type.c b/crypto/asymmetric_keys/pkcs7_key_type.c index b930d3bbf1af..663a246742f7 100644 --- a/crypto/asymmetric_keys/pkcs7_key_type.c +++ b/crypto/asymmetric_keys/pkcs7_key_type.c @@ -74,6 +74,7 @@ static struct key_type key_type_pkcs7 = { .instantiate = generic_key_instantiate, .revoke = user_revoke, .destroy = user_destroy, + .wipe = user_wipe, .describe = user_describe, .read = user_read, }; diff --git a/drivers/nvme/common/keyring.c b/drivers/nvme/common/keyring.c index 32d16c53133b..33303f035fb1 100644 --- a/drivers/nvme/common/keyring.c +++ b/drivers/nvme/common/keyring.c @@ -84,6 +84,7 @@ static struct key_type nvme_tls_psk_key_type = { .instantiate = generic_key_instantiate, .revoke = user_revoke, .destroy = user_destroy, + .wipe = user_wipe, .describe = nvme_tls_psk_describe, .read = user_read, }; diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c index bc397110d977..26f579ae2c73 100644 --- a/fs/nfs/nfs4idmap.c +++ b/fs/nfs/nfs4idmap.c @@ -190,6 +190,7 @@ static struct key_type key_type_id_resolver = { .instantiate = generic_key_instantiate, .revoke = user_revoke, .destroy = user_destroy, + .wipe = user_wipe, .describe = user_describe, .read = user_read, }; @@ -412,6 +413,7 @@ static struct key_type key_type_id_resolver_legacy = { .instantiate = generic_key_instantiate, .revoke = user_revoke, .destroy = user_destroy, + .wipe = user_wipe, .describe = user_describe, .read = user_read, .request_key = nfs_idmap_legacy_upcall, diff --git a/include/keys/user-type.h b/include/keys/user-type.h index 386c31432789..685fa054b0ac 100644 --- a/include/keys/user-type.h +++ b/include/keys/user-type.h @@ -40,6 +40,7 @@ extern void user_free_preparse(struct key_preparsed_payload *prep); extern int user_update(struct key *key, struct key_preparsed_payload *prep); extern void user_revoke(struct key *key); extern void user_destroy(struct key *key); +extern void user_wipe(struct key *key); extern void user_describe(const struct key *user, struct seq_file *m); extern long user_read(const struct key *key, char *buffer, size_t buflen); diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c index 6f88b507f927..f4897c19c2dd 100644 --- a/security/keys/user_defined.c +++ b/security/keys/user_defined.c @@ -6,6 +6,7 @@ */ #include <linux/export.h> +#include <linux/crash_core.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/seq_file.h> @@ -28,6 +29,7 @@ struct key_type key_type_user = { .update = user_update, .revoke = user_revoke, .destroy = user_destroy, + .wipe = user_wipe, .describe = user_describe, .read = user_read, }; @@ -48,6 +50,7 @@ struct key_type key_type_logon = { .update = user_update, .revoke = user_revoke, .destroy = user_destroy, + .wipe = user_wipe, .describe = user_describe, .vet_description = logon_vet_description, }; @@ -152,6 +155,18 @@ void user_destroy(struct key *key) EXPORT_SYMBOL_GPL(user_destroy); +void user_wipe(struct key *key) +{ + struct user_key_payload *upayload = key->payload.data[0]; + + if (upayload) + crash_wipe_memzero(upayload->data, upayload->datalen); + key->payload.data[1] = NULL; + key->payload.data[2] = NULL; + key->payload.data[3] = NULL; +} +EXPORT_SYMBOL_GPL(user_wipe); + /* * describe the user key */ -- 2.53.0