Cyclic0007/wolfssl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

linuxkm: handle RHEL9 disabled akcipher sign/decrypt ops

Browse Source 
RHEL9 kernels (9.6+) disable RSA signing and decryption in the kernel
crypto API for security reasons (CVE-2023-6240). The kernel forcibly
overwrites akcipher sign/decrypt callbacks to return -ENOSYS, regardless
of what the driver provides.

Commit 3709c35c in the RHEL kernel:
"crypto: akcipher - Disable signing and decryption"

This affects our self-tests which call crypto_akcipher_sign() and
crypto_akcipher_decrypt(). On RHEL9, these operations return -ENOSYS
even though our driver correctly implements them.

Add compile-time checks for RHEL_RELEASE_CODE >= 9.6 to detect this
scenario and skip the affected self-tests gracefully. The tests pass
since the algorithms are registered correctly; the kernel simply
refuses to execute sign/decrypt operations as a matter of policy.

Note: encrypt and verify operations are unaffected and continue to be
tested normally.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
This commit is contained in:
Sameeh Jubran
2025-12-31 13:13:51 +02:00
parent 0d44018627
commit d27c04bbca
2 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.wolfssl_known_macro_extras
View File

@@ -478,6 +478,7 @@ REDIRECTION_OUT2_KEYELMID
REDIRECTION_OUT2_KEYID
RENESAS_T4_USE
RHEL_MAJOR
RHEL_RELEASE_CODE
RTC_ALARMSUBSECONDMASK_ALL
RTE_CMSIS_RTOS_RTX
RTOS_MODULE_NET_AVAIL

28
linuxkm/lkcapi_rsa_glue.c
View File

@@ -27,6 +27,10 @@
#error lkcapi_rsa_glue.c included in non-LINUXKM_LKCAPI_REGISTER project.
#endif
#ifndef RHEL_RELEASE_VERSION
#define RHEL_RELEASE_VERSION(a, b) (((a) << 8) + (b))
#endif
#if !defined(NO_RSA)
#if (defined(LINUXKM_LKCAPI_REGISTER_ALL) || \
(defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_RSA))) && \
@@ -2347,6 +2351,14 @@ static int linuxkm_test_rsa_driver(const char * driver, int nbits)
memset(dec, 0, key_len);
ret = crypto_akcipher_decrypt(req);
#if defined(RHEL_RELEASE_CODE) && \
(RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(9, 6))
if (ret == -ENOSYS) {
pr_info("info: ignoring failure from crypto_akcipher_decrypt (disabled by RHEL policy)\n");
test_rc = 0;
goto test_rsa_end;
}
#endif
if (ret) {
pr_err("error: crypto_akcipher_decrypt returned: %d\n", ret);
goto test_rsa_end;
@@ -2721,6 +2733,14 @@ static int linuxkm_test_pkcs1pad_driver(const char * driver, int nbits,
akcipher_request_set_crypt(req, &src, &dst, hash_len, key_len);
ret = crypto_akcipher_sign(req);
#if defined(RHEL_RELEASE_CODE) && \
(RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(9, 6))
if (ret == -ENOSYS) {
pr_info("info: ignoring failure from crypto_akcipher_sign (disabled by RHEL policy)\n");
test_rc = 0;
goto test_pkcs1_end;
}
#endif
if (ret) {
pr_err("error: crypto_akcipher_sign returned: %d\n", ret);
test_rc = BAD_FUNC_ARG;
@@ -2847,6 +2867,14 @@ static int linuxkm_test_pkcs1pad_driver(const char * driver, int nbits,
}
ret = crypto_akcipher_decrypt(req);
#if defined(RHEL_RELEASE_CODE) && \
(RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(9, 6))
if (ret == -ENOSYS) {
pr_info("info: ignoring failure from crypto_akcipher_decrypt (disabled by RHEL policy)\n");
test_rc = 0;
goto test_pkcs1_end;
}
#endif
if (ret) {
pr_err("error: crypto_akcipher_decrypt returned: %d\n", ret);
test_rc = BAD_FUNC_ARG;