kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Cross check APQNs when generating secure keys

Browse Source 
Perform a cross check of the APQNs when a new secure AES key is
generated. When a set of APQNs are associated to a new secure key,
these APQNs are cross checked. If a new secure key is generated
outside of the key repository, or no APQNs are associated to a secure
key generated inside the key repository, then all currently available
APQNs are cross checked. If a master key mismatch is detected, then
the key generation is rejected.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-06-14 10:19:09 +02:00
committed by Jan Höppner
parent c2244a5795
commit a5b58038a0
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
zkey/keystore.c
View File

@@ -1685,6 +1685,14 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
if (rc != 0)
goto out_free_key_filenames;
rc = cross_check_apqns(apqns, 0, true, keystore->verbose);
if (rc == -EINVAL)
goto out_free_key_filenames;
if (rc != 0 && rc != -ENOTSUP && noapqncheck == 0) {
warnx("Your master key setup is improper");
goto out_free_key_filenames;
}
rc = _keystore_get_card_domain(apqns, &card, &domain);
if (rc != 0)
goto out_free_key_filenames;

11
zkey/zkey.c
View File

@@ -31,6 +31,7 @@
#include "keystore.h"
#include "misc.h"
#include "pkey.h"
#include "utils.h"
/*
* Program configuration
@@ -1060,6 +1061,8 @@ static int command_generate_repository(void)
*/
static int command_generate(void)
{
int rc;
if (g.pos_arg != NULL && g.name != NULL) {
warnx(" Option '--name|-N' is not valid for generating a key "
"outside of the repository");
@@ -1100,6 +1103,14 @@ static int command_generate(void)
return EXIT_FAILURE;
}
rc = cross_check_apqns(NULL, 0, true, g.verbose);
if (rc == -EINVAL)
return EXIT_FAILURE;
if (rc != 0 && rc != -ENOTSUP) {
warnx("Your master key setup is improper");
return EXIT_FAILURE;
}
return g.clearkeyfile ? command_generate_clear()
: command_generate_random();
}