From 0b4cbf00412f27456d28ff7f86ec5335a39e3416 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 17 Jun 2019 10:31:15 +0200 Subject: [PATCH] zkey: Cross check APQNs when changing APQN associations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Perform a cross check of the APQNs when the APQN association of a secure AES key in the key repository is changed. When adding new APQNs, or associating a new set of APQNs to a secure key, then the APQNs are cross checked. If all associated APQNs are removed, then all currently available APQNs are cross checked. If a master key mismatch is detected, then the change is rejected. Signed-off-by: Ingo Franzki Reviewed-by: Harald Freudenberger Signed-off-by: Jan Höppner --- zkey/keystore.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/zkey/keystore.c b/zkey/keystore.c index 832cb1c1..9a29bf2b 100644 --- a/zkey/keystore.c +++ b/zkey/keystore.c @@ -1886,7 +1886,11 @@ int keystore_change_key(struct keystore *keystore, const char *name, .nomsg = 0 }; struct key_filenames file_names = { NULL, NULL, NULL }; struct properties *key_props = NULL; + size_t secure_key_size; + char *apqns_prop; + u8 *secure_key; char temp[30]; + u64 mkvp; int rc; util_assert(keystore != NULL, "Internal error: keystore is NULL"); @@ -1932,6 +1936,33 @@ int keystore_change_key(struct keystore *keystore, const char *name, &apqn_check); if (rc != 0) goto out; + + secure_key = read_secure_key(file_names.skey_filename, + &secure_key_size, + keystore->verbose); + if (secure_key == NULL) { + rc = -ENOENT; + goto out; + } + + rc = get_master_key_verification_pattern(secure_key, + secure_key_size, + &mkvp, + keystore->verbose); + free(secure_key); + if (rc) + goto out; + + apqns_prop = properties_get(key_props, PROP_NAME_APQNS); + rc = cross_check_apqns(apqns_prop, mkvp, true, + keystore->verbose); + free(apqns_prop); + if (rc == -ENOTSUP) + rc = 0; + if (rc != 0 && noapqncheck == 0) { + warnx("Your master key setup is improper"); + goto out; + } } if (sector_size >= 0) {