Wipe the decrypted key material and the sealed blob held in the payload. Used by CONFIG_CRASH_WIPE_SECRETS.
Signed-off-by: Jan Sebastian Götte <[email protected]> --- security/keys/encrypted-keys/encrypted.c | 13 +++++++++++++ security/keys/trusted-keys/trusted_core.c | 15 +++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c index 59cb77b237b3..9d6fe08ecb7a 100644 --- a/security/keys/encrypted-keys/encrypted.c +++ b/security/keys/encrypted-keys/encrypted.c @@ -12,6 +12,7 @@ */ #include <linux/uaccess.h> +#include <linux/crash_core.h> #include <linux/module.h> #include <linux/hex.h> #include <linux/init.h> @@ -970,11 +971,23 @@ static void encrypted_destroy(struct key *key) kfree_sensitive(key->payload.data[0]); } +static void encrypted_wipe(struct key *key) +{ + struct encrypted_key_payload *epayload = key->payload.data[0]; + + if (!epayload) + return; + + crash_wipe_memzero(epayload->payload_data, + epayload->payload_datalen + epayload->datablob_len); +} + struct key_type key_type_encrypted = { .name = "encrypted", .instantiate = encrypted_instantiate, .update = encrypted_update, .destroy = encrypted_destroy, + .wipe = encrypted_wipe, .describe = user_describe, .read = encrypted_read, }; diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c index 0509d9955f2a..7b220c6381b5 100644 --- a/security/keys/trusted-keys/trusted_core.c +++ b/security/keys/trusted-keys/trusted_core.c @@ -14,6 +14,7 @@ #include <keys/trusted_tpm.h> #include <keys/trusted_pkwm.h> #include <linux/capability.h> +#include <linux/crash_core.h> #include <linux/err.h> #include <linux/hex.h> #include <linux/init.h> @@ -325,11 +326,25 @@ static void trusted_destroy(struct key *key) kfree_sensitive(key->payload.data[0]); } +static void trusted_wipe(struct key *key) +{ + struct trusted_key_payload *p = key->payload.data[0]; + + if (!p) + return; + + crash_wipe_memzero(p->key, sizeof(p->key)); + crash_wipe_memzero(p->blob, sizeof(p->blob)); + p->key_len = 0; + p->blob_len = 0; +} + struct key_type key_type_trusted = { .name = "trusted", .instantiate = trusted_instantiate, .update = trusted_update, .destroy = trusted_destroy, + .wipe = trusted_wipe, .describe = user_describe, .read = trusted_read, }; -- 2.53.0
