kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Cross check APQNs when changing APQN associations

Browse Source 
Perform a cross check of the APQNs when the APQN association of a
secure AES key in the key repository is changed. When adding new APQNs,
or associating a new set of APQNs to a secure key, then the APQNs are
cross checked. If all associated APQNs are removed, then all currently
available APQNs are cross checked. If a master key mismatch is detected,
then the change is rejected.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-06-17 10:31:15 +02:00
committed by Jan Höppner
parent d854aed4b8
commit 0b4cbf0041
1 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
zkey/keystore.c
View File

@@ -1886,7 +1886,11 @@ int keystore_change_key(struct keystore *keystore, const char *name,
.nomsg = 0 };
struct key_filenames file_names = { NULL, NULL, NULL };
struct properties *key_props = NULL;
size_t secure_key_size;
char *apqns_prop;
u8 *secure_key;
char temp[30];
u64 mkvp;
int rc;
util_assert(keystore != NULL, "Internal error: keystore is NULL");
@@ -1932,6 +1936,33 @@ int keystore_change_key(struct keystore *keystore, const char *name,
&apqn_check);
if (rc != 0)
goto out;
secure_key = read_secure_key(file_names.skey_filename,
&secure_key_size,
keystore->verbose);
if (secure_key == NULL) {
rc = -ENOENT;
goto out;
}
rc = get_master_key_verification_pattern(secure_key,
secure_key_size,
&mkvp,
keystore->verbose);
free(secure_key);
if (rc)
goto out;
apqns_prop = properties_get(key_props, PROP_NAME_APQNS);
rc = cross_check_apqns(apqns_prop, mkvp, true,
keystore->verbose);
free(apqns_prop);
if (rc == -ENOTSUP)
rc = 0;
if (rc != 0 && noapqncheck == 0) {
warnx("Your master key setup is improper");
goto out;
}
}
if (sector_size >= 0) {