keys: add new trusted key-type

Define a new kernel key-type called 'trusted'.  Trusted keys are random
number symmetric keys, generated and RSA-sealed by the TPM.  The TPM
only unseals the keys, if the boot PCRs and other criteria match.
Userspace can only ever see encrypted blobs.

Based on suggestions by Jason Gunthorpe, several new options have been
added to support additional usages.

The new options are:
migratable=  designates that the key may/may not ever be updated
             (resealed under a new key, new pcrinfo or new auth.)

pcrlock=n    extends the designated PCR 'n' with a random value,
             so that a key sealed to that PCR may not be unsealed
             again until after a reboot.

keyhandle=   specifies the sealing/unsealing key handle.

keyauth=     specifies the sealing/unsealing key auth.

blobauth=    specifies the sealed data auth.

Implementation of a kernel reserved locality for trusted keys will be
investigated for a possible future extension.

Changelog:
- Updated and added examples to Documentation/keys-trusted-encrypted.txt
- Moved generic TPM constants to include/linux/tpm_command.h
  (David Howell's suggestion.)
- trusted_defined.c: replaced kzalloc with kmalloc, added pcrlock failure
  error handling, added const qualifiers where appropriate.
- moved to late_initcall
- updated from hash to shash (suggestion by David Howells)
- reduced worst stack usage (tpm_seal) from 530 to 312 bytes
- moved documentation to Documentation directory (suggestion by David Howells)
- all the other code cleanups suggested by David Howells
- Add pcrlock CAP_SYS_ADMIN dependency (based on comment by Jason Gunthorpe)
- New options: migratable, pcrlock, keyhandle, keyauth, blobauth (based on
  discussions with Jason Gunthorpe)
- Free payload on failure to create key(reported/fixed by Roberto Sassu)
- Updated Kconfig and other descriptions (based on Serge Hallyn's suggestion)
- Replaced kzalloc() with kmalloc() (reported by Serge Hallyn)

Signed-off-by: David Safford <safford@watson.ibm.com>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>

3 files changed, 1286 insertions, 0 deletions

diff --git a/security/keys/Makefile b/security/keys/Makefile
index 74d5447d7df7..fcb107020b4a 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -13,6 +13,7 @@ obj-y := \
         request_key_auth.o \
         user_defined.o
 
+obj-$(CONFIG_TRUSTED_KEYS) += trusted_defined.o
 obj-$(CONFIG_KEYS_COMPAT) += compat.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/security/keys/trusted_defined.c b/security/keys/trusted_defined.c
new file mode 100644
index 000000000000..1bec72e7596d
--- /dev/null
+++ b/security/keys/trusted_defined.c
@@ -0,0 +1,1151 @@
+/*
+ * Copyright (C) 2010 IBM Corporation
+ *
+ * Author:
+ * David Safford <safford@us.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ *
+ * See Documentation/keys-trusted-encrypted.txt
+ */
+
+#include <linux/uaccess.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/parser.h>
+#include <linux/string.h>
+#include <keys/user-type.h>
+#include <keys/trusted-type.h>
+#include <linux/key-type.h>
+#include <linux/rcupdate.h>
+#include <linux/crypto.h>
+#include <crypto/hash.h>
+#include <crypto/sha.h>
+#include <linux/capability.h>
+#include <linux/tpm.h>
+#include <linux/tpm_command.h>
+
+#include "trusted_defined.h"
+
+static const char hmac_alg[] = "hmac(sha1)";
+static const char hash_alg[] = "sha1";
+
+struct sdesc {
+        struct shash_desc shash;
+        char ctx[];
+};
+
+static struct crypto_shash *hashalg;
+static struct crypto_shash *hmacalg;
+
+static struct sdesc *init_sdesc(struct crypto_shash *alg)
+{
+        struct sdesc *sdesc;
+        int size;
+
+        size = sizeof(struct shash_desc) + crypto_shash_descsize(alg);
+        sdesc = kmalloc(size, GFP_KERNEL);
+        if (!sdesc)
+                return ERR_PTR(-ENOMEM);
+        sdesc->shash.tfm = alg;
+        sdesc->shash.flags = 0x0;
+        return sdesc;
+}
+
+static int TSS_sha1(const unsigned char *data, const unsigned int datalen,
+                    unsigned char *digest)
+{
+        struct sdesc *sdesc;
+        int ret;
+
+        sdesc = init_sdesc(hashalg);
+        if (IS_ERR(sdesc)) {
+                pr_info("trusted_key: can't alloc %s\n", hash_alg);
+                return PTR_ERR(sdesc);
+        }
+
+        ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
+        kfree(sdesc);
+        return ret;
+}
+
+static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
+                       const unsigned int keylen, ...)
+{
+        struct sdesc *sdesc;
+        va_list argp;
+        unsigned int dlen;
+        unsigned char *data;
+        int ret;
+
+        sdesc = init_sdesc(hmacalg);
+        if (IS_ERR(sdesc)) {
+                pr_info("trusted_key: can't alloc %s\n", hmac_alg);
+                return PTR_ERR(sdesc);
+        }
+
+        ret = crypto_shash_setkey(hmacalg, key, keylen);
+        if (ret < 0)
+                goto out;
+        ret = crypto_shash_init(&sdesc->shash);
+        if (ret < 0)
+                goto out;
+
+        va_start(argp, keylen);
+        for (;;) {
+                dlen = va_arg(argp, unsigned int);
+                if (dlen == 0)
+                        break;
+                data = va_arg(argp, unsigned char *);
+                if (data == NULL)
+                        return -EINVAL;
+                ret = crypto_shash_update(&sdesc->shash, data, dlen);
+                if (ret < 0)
+                        goto out;
+        }
+        va_end(argp);
+        ret = crypto_shash_final(&sdesc->shash, digest);
+out:
+        kfree(sdesc);
+        return ret;
+}
+
+/*
+ * calculate authorization info fields to send to TPM
+ */
+static uint32_t TSS_authhmac(unsigned char *digest, const unsigned char *key,
+                             const unsigned int keylen, unsigned char *h1,
+                             unsigned char *h2, unsigned char h3, ...)
+{
+        unsigned char paramdigest[SHA1_DIGEST_SIZE];
+        struct sdesc *sdesc;
+        unsigned int dlen;
+        unsigned char *data;
+        unsigned char c;
+        int ret;
+        va_list argp;
+
+        sdesc = init_sdesc(hashalg);
+        if (IS_ERR(sdesc)) {
+                pr_info("trusted_key: can't alloc %s\n", hash_alg);
+                return PTR_ERR(sdesc);
+        }
+
+        c = h3;
+        ret = crypto_shash_init(&sdesc->shash);
+        if (ret < 0)
+                goto out;
+        va_start(argp, h3);
+        for (;;) {
+                dlen = va_arg(argp, unsigned int);
+                if (dlen == 0)
+                        break;
+                data = va_arg(argp, unsigned char *);
+                ret = crypto_shash_update(&sdesc->shash, data, dlen);
+                if (ret < 0)
+                        goto out;
+        }
+        va_end(argp);
+        ret = crypto_shash_final(&sdesc->shash, paramdigest);
+        if (!ret)
+                TSS_rawhmac(digest, key, keylen, SHA1_DIGEST_SIZE,
+                            paramdigest, TPM_NONCE_SIZE, h1,
+                            TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
+out:
+        kfree(sdesc);
+        return ret;
+}
+
+/*
+ * verify the AUTH1_COMMAND (Seal) result from TPM
+ */
+static uint32_t TSS_checkhmac1(unsigned char *buffer,
+                               const uint32_t command,
+                               const unsigned char *ononce,
+                               const unsigned char *key,
+                               const unsigned int keylen, ...)
+{
+        uint32_t bufsize;
+        uint16_t tag;
+        uin