asymmetric keys: add interface and skeleton for implement signature generation

Add generate_signature interface on signature.c, asymmetric-subtype and
rsa.c for prepare to implement signature generation.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
asymmetric keys: implement EMSA_PKCS1-v1_5-ENCODE in rsa

Implement EMSA_PKCS1-v1_5-ENCODE [RFC3447 sec 9.2] in rsa.c. It's the
first step of signature generation operation (RSASSA-PKCS1-v1_5-SIGN).

This patch is temporary set emLen to pks->k, and temporary set EM to
pks->S for debugging. We will replace the above values to real signature
after implement RSASP1.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
asymmetric keys: separate the length checking of octet string from RSA_I2OSP

Due to RSA_I2OSP is not only used by signature verification path but also used
in signature generation path. So, separate the length checking of octet string
because it's not for generate 0x00 0x01 leading string when used in signature
generation.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
asymmetric keys: implement OS2IP in rsa

Implement Octet String to Integer conversion [RFC3447 sec 4.2] in rsa.c. It's
the second step of signature generation operation.

This patch is temporary set non-RSASP1 message to pks->S for debugging.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
asymmetric keys: implement RSASP1

Implement RSASP1 and fill-in the following data to public key signature
structure: signature length (pkcs->k), signature octet
strings (pks->S) and MPI of signature (pks->rsa.s).

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
asymmetric keys: support parsing PKCS #8 private key information

Add ASN.1 files and parser to support parsing PKCS #8 private key
information. It's better then direct parsing pure private key because
PKCS #8 has a privateKeyAlgorithm to indicate the algorithm of private
key, e.g. RSA from PKCS #1

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
asymmetric keys: explicitly add the leading zero byte to encoded message

Per PKCS1 spec, the EMSA-PKCS1-v1_5 encoded message is leading by 0x00 0x01 in
its first 2 bytes. The leading zero byte is suppressed by MPI so we pass a
pointer to the _preceding_ byte to RSA_verify() in original code, but it has
risk for the byte is not zero because it's not in EM buffer's scope, neither
RSA_verify() nor mpi_get_buffer() didn't take care the leading byte.

To avoid the risk, that's better we explicitly add the leading zero byte to EM
for pass to RSA_verify(). This patch allocate a _EM buffer to capture the
result from RSA_I2OSP(), then set the first byte to zero in EM and copy the
remaining bytes from _EM.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Secure boot: Add new capability

Secure boot adds certain policy requirements, including that root must not
be able to do anything that could cause the kernel to execute arbitrary code.
The simplest way to handle this would seem to be to add a new capability
and gate various functionality on that. We'll then strip it from the initial
capability set if required.

Signed-off-by: Matthew Garrett <mjg@redhat.com>
Acked-by: Lee, Chun-Yi <jlee@suse.com>
Secure boot: Add a dummy kernel parameter that will switch on Secure Boot mode

This forcibly drops CAP_COMPROMISE_KERNEL from both cap_permitted and cap_bset
in the init_cred struct, which everything else inherits from.  This works on
any machine and can be used to develop even if the box doesn't have UEFI.

Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Acked-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
efi: Enable secure boot lockdown automatically when enabled in firmware

The firmware has a set of flags that indicate whether secure boot is enabled
and enforcing. Use them to indicate whether the kernel should lock itself
down.  We also indicate the machine is in secure boot mode by adding the
EFI_SECURE_BOOT bit for use with efi_enabled.

Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Acked-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Hibernate: introduced RSA key-pair to verify signature of snapshot

Introduced a hibernate_key.c file to query the key pair from EFI variables
and maintain key pair for check signature of S4 snapshot image. We
loaded the private key when snapshot image stored success.

This patch introduced 2 EFI variables for store the key to sign S4 image and
verify signature when S4 wake up. The names and GUID are:
  S4SignKey-fe141863-c070-478e-b8a3-878a5dc9ef21
  S4WakeKey-fe141863-c070-478e-b8a3-878a5dc9ef21

S4SignKey is used by EFI bootloader to pass the RSA private key that packaged
by PKCS#8 format, kernel will read and parser it when system boot and reload
it when S4 resume. EFI bootloader need gnerate a new private key when every
time system boot.

S4WakeKey is used to pass the RSA public key that packaged by X.509
certificate, kernel will read and parser it for check the signature of
S4 snapshot image when S4 resume.

The follow-up patch will remove S4SignKey and S4WakeKey after load them
to kernel for avoid anyone can access it through efivarfs.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Hibernate: generate and verify signature of snapshot

This patch add the code for generate/verify signature of snapshot, it
put the signature to snapshot header. This approach can support both
on userspace hibernate and in-kernel hibernate.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Hibernate: Avoid S4 sign key data included in snapshot image

This patch add swsusp_page_is_sign_key() method to hibernate_key.c and
check the page is S4 sign key data when collect saveable page in
snapshot.c to avoid sign key data included in snapshot image.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Hibernate: fix the race condition of remove S4 sign key

This patch fix the race condition of remove S4 sign key. It moved the
code of reload sign key  to software_resume() in hibernate.c after we
confirmed the snapshot image doesn't in swap partition. We ignore the
errors, -ENOENT, -ENODEV and -NENXIO to ignore the checking result before
swap partition available. It avoid the S4 sign key removed before we
load it after S4 resume success.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Hibernate: introduced SNAPSHOT_VERIFICATION config to switch signature check

This patch introduced SNAPSHOT_VERIFICATION kernel config for switching
signature check of hibernate snapshot image.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Hibernate: adapt to UEFI secure boot with signature check

In current solution, the snapshot signature check used the RSA key-pair
that are generated by bootloader(e.g. shim) and pass the key-pair to
kernel through EFI variables. I choice to binding the snapshot
signature check mechanism with UEFI secure boot for provide stronger
protection of hibernate. Current behavior is following:

 + UEFI Secure Boot ON, Kernel found key-pair from shim:
   Will do the S4 signature check.

 + UEFI Secure Boot ON, Kernel didn't find key-pair from shim:
   Will lock down S4 function.

 + UEFI Secure Boot OFF
   Will NOT do the S4 signature check.
   Ignore any keys from bootloader.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Hibernate: show the verification time for monitor performance

Show the verification time for monitor the performance of SHA256 and RSA
verification.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>