From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1nEssP-00053h-UD for mharc-grub-devel@gnu.org; Tue, 01 Feb 2022 08:07:18 -0500 Received: from eggs.gnu.org ([209.51.188.92]:57252) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nEsoi-0004bn-Bk for grub-devel@gnu.org; Tue, 01 Feb 2022 08:04:10 -0500 Received: from linux.microsoft.com ([13.77.154.182]:46370) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1nEsoX-0005QH-NE for grub-devel@gnu.org; Tue, 01 Feb 2022 08:03:24 -0500 Received: from linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net (linux.microsoft.com [13.77.154.182]) by linux.microsoft.com (Postfix) with ESMTPSA id 8833420B800A; Tue, 1 Feb 2022 05:03:13 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 8833420B800A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1643720593; bh=wwYJNh3OV1cJDbQHv2or1FJlIebvcBLBujaK8zuzfM0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KB7qVdVarMc74/LV2jn5G4N0jddB+3m+1ypNYP6UVC3+8eftnr+V1RwiACkeGhJM9 7Wc6FH/qrnCYLMCg6/B2imulv1Cc78uzIPzzPOq71yS2NxP/Le3qPf29aFV5rRD8DJ nBYTp9D838cqTjWlfGGUWJMcyElaFc02KDw5kom4= From: Hernan Gatta To: grub-devel@gnu.org Cc: shkhisti@microsoft.com, jaskaran.khurana@microsoft.com, christopher.co@microsoft.com, daniel.mihai@microsoft.com, rharwood@redhat.com, jaredz@redhat.com, development@efficientek.com, jejb@linux.ibm.com Subject: [PATCH v2 1/5] protectors: Add key protectors framework Date: Tue, 1 Feb 2022 05:02:53 -0800 Message-Id: <1643720577-22911-2-git-send-email-hegatta@linux.microsoft.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1643720577-22911-1-git-send-email-hegatta@linux.microsoft.com> References: <1643720577-22911-1-git-send-email-hegatta@linux.microsoft.com> Received-SPF: pass client-ip=13.77.154.182; envelope-from=hegatta@linux.microsoft.com; helo=linux.microsoft.com X-Spam_score_int: -197 X-Spam_score: -19.8 X-Spam_bar: ------------------- X-Spam_report: (-19.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Feb 2022 13:04:31 -0000 A key protector encapsulates functionality to retrieve an unlocking key for a fully-encrypted disk from a specific source. A key protector module registers itself with the key protectors framework when it is loaded and unregisters when unloaded. Additionally, a key protector may accept parameters that describe how it should operate. The key protectors framework, besides offering registration and unregistration functions, also offers a one-stop routine for finding and invoking a key protector by name. If a key protector with the specified name exists and if an unlocking key is successfully retrieved by it, the function returns to the caller the retrieved key and its length. Signed-off-by: Hernan Gatta --- grub-core/Makefile.am | 1 + grub-core/Makefile.core.def | 1 + grub-core/kern/protectors.c | 75 +++++++++++++++++++++++++++++++++++++++++++++ include/grub/protector.h | 48 +++++++++++++++++++++++++++++ 4 files changed, 125 insertions(+) create mode 100644 grub-core/kern/protectors.c create mode 100644 include/grub/protector.h diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am index ee88e44..f78cd9d 100644 --- a/grub-core/Makefile.am +++ b/grub-core/Makefile.am @@ -90,6 +90,7 @@ endif KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm.h KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/parser.h KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/partition.h +KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/protector.h KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/stack_protector.h KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def index 8022e1c..e4ae78b 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def @@ -138,6 +138,7 @@ kernel = { common = kern/misc.c; common = kern/parser.c; common = kern/partition.c; + common = kern/protectors.c; common = kern/rescue_parser.c; common = kern/rescue_reader.c; common = kern/term.c; diff --git a/grub-core/kern/protectors.c b/grub-core/kern/protectors.c new file mode 100644 index 0000000..21954df --- /dev/null +++ b/grub-core/kern/protectors.c @@ -0,0 +1,75 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2022 Microsoft Corporation + * + * GRUB is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * GRUB is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GRUB. If not, see . + */ + +#include +#include +#include +#include + +struct grub_key_protector *grub_key_protectors = NULL; + +grub_err_t +grub_key_protector_register (struct grub_key_protector *protector) +{ + if (!protector || !protector->name || !grub_strlen(protector->name)) + return GRUB_ERR_BAD_ARGUMENT; + + if (grub_key_protectors && + grub_named_list_find (GRUB_AS_NAMED_LIST (grub_key_protectors), + protector->name)) + return GRUB_ERR_BAD_ARGUMENT; + + grub_list_push (GRUB_AS_LIST_P (&grub_key_protectors), + GRUB_AS_LIST (protector)); + + return GRUB_ERR_NONE; +} + +grub_err_t +grub_key_protector_unregister (struct grub_key_protector *protector) +{ + if (!protector) + return GRUB_ERR_BAD_ARGUMENT; + + grub_list_remove (GRUB_AS_LIST (protector)); + + return GRUB_ERR_NONE; +} + +grub_err_t +grub_key_protector_recover_key (const char *protector, grub_uint8_t **key, + grub_size_t *key_size) +{ + struct grub_key_protector *kp = NULL; + + if (!grub_key_protectors) + return GRUB_ERR_OUT_OF_RANGE; + + if (!protector || !grub_strlen (protector)) + return GRUB_ERR_BAD_ARGUMENT; + + kp = grub_named_list_find (GRUB_AS_NAMED_LIST (grub_key_protectors), + protector); + if (!kp) + return grub_error (GRUB_ERR_OUT_OF_RANGE, + N_("A key protector with name '%s' could not be found. " + "Is the name spelled correctly and is the " + "corresponding module loaded?"), protector); + + return kp->recover_key (key, key_size); +} diff --git a/include/grub/protector.h b/include/grub/protector.h new file mode 100644 index 0000000..179020a --- /dev/null +++ b/include/grub/protector.h @@ -0,0 +1,48 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2022 Microsoft Corporation + * + * GRUB is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * GRUB is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GRUB. If not, see . + */ + +#ifndef GRUB_PROTECTOR_HEADER +#define GRUB_PROTECTOR_HEADER 1 + +#include +#include + +struct grub_key_protector +{ + struct grub_key_protector *next; + struct grub_key_protector **prev; + + const char *name; + + grub_err_t (*recover_key) (grub_uint8_t **key, grub_size_t *key_size); +}; + +extern struct grub_key_protector *EXPORT_VAR (grub_key_protectors); + +grub_err_t +EXPORT_FUNC (grub_key_protector_register) (struct grub_key_protector *protector); + +grub_err_t +EXPORT_FUNC (grub_key_protector_unregister) (struct grub_key_protector *protector); + +grub_err_t +EXPORT_FUNC (grub_key_protector_recover_key) (const char *protector, + grub_uint8_t **key, + grub_size_t *key_size); + +#endif /* ! GRUB_PROTECTOR_HEADER */ -- 1.8.3.1