From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1kUijv-0005mN-Kt for mharc-grub-devel@gnu.org; Mon, 19 Oct 2020 23:55:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:50398) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kUijt-0005lt-Um for grub-devel@gnu.org; Mon, 19 Oct 2020 23:55:09 -0400 Received: from de-smtp-delivery-102.mimecast.com ([62.140.7.102]:28649) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1kUijr-0003EA-C4 for grub-devel@gnu.org; Mon, 19 Oct 2020 23:55:09 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=mimecast20200619; t=1603166103; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=N9gSC/Wzt7+erZ0E4Drhka2mvaNDVjF2/lfNw8D2DHA=; b=T7BcF5HLIFOkOui4iWw+e8eUbuZxheIKEJEWuqVSMjDHxZZTxFPamFZNIkRFqr28IprxdM NTGEah7qQzm7bw/xe4HKZ+nFBmIDrs89ElOXVP6UV2B4NnBJx0g4qQP2VW7d1nVpvqbVNb CwTRpxqdNjWaDdlZDYVk+6Zx4FJXEuY= Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01lp2056.outbound.protection.outlook.com [104.47.2.56]) (Using TLS) by relay.mimecast.com with ESMTP id de-mta-32-O8-6ziAmMgmcWR8HrPWaOA-1; Tue, 20 Oct 2020 05:55:01 +0200 X-MC-Unique: O8-6ziAmMgmcWR8HrPWaOA-1 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M1zZfyQ6U/NNejS5f+rCBAl1dBPjB+/ZHLcjoZM58VtpKmPwh0m8mShiPy/pmNJrXBjN+e5XSNSjeAgndehqk+moyA+QC6bdQtvk6YNYcCQUe1BBT7Kr9SFmOW/q/n/WsFENENd+/LC5c1r5elq8slEAQtX72s3AZgjq1pfovg15DfG3rSNKkPov7PpHhMXPlCMmturGifkYIsb+WEi94bhm9n/yDakaCNAgYuwgVpQP+iZ6IXopKE7UXPKZocXu3AvBXmFHXF1bj4MvKxUb1gULo5Bpn2xBE5LfJnkgB9nmt8lbO1jv0g2NA/b3ib0gCbmxFM5r+CIadZZi1Uu9Ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=N9gSC/Wzt7+erZ0E4Drhka2mvaNDVjF2/lfNw8D2DHA=; b=VyTf9/smGjq3wSjtAPaN0glChTq2+Y6VS6jCHh0kqEDUCqL4q42RIJh4PExj6vCOGtALqMG6BAAUhD2JrlK9yrb41L3e+gwwrbBXwuPIMjXh9v+e5aMhDfC8P2/lrQILRwMTa46AIeTEmPg7g03TQZlXcTfHHn32L/OeA1gWT/zgZjSBcZT9YkXO6mCvpjWB5qbZX1lIofPHShA0iFL0P72dyUFzew6nzHNPQnxyrGBRxhsfw6lGcbSrW4/GWWIAec5hUZNoRaMY17SqR8wjNXAhglEqOJnzWNKjpcRFl/GvXF+SKFzi5RVjkoU8Az68yl2ShKj2XV1XqBJgR2xp/A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none Authentication-Results: gnu.org; dkim=none (message not signed) header.d=none;gnu.org; dmarc=none action=none header.from=suse.com; Received: from DB7PR04MB4985.eurprd04.prod.outlook.com (2603:10a6:10:20::14) by DB7PR04MB5355.eurprd04.prod.outlook.com (2603:10a6:10:86::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3477.25; Tue, 20 Oct 2020 03:55:00 +0000 Received: from DB7PR04MB4985.eurprd04.prod.outlook.com ([fe80::4d76:bd58:4e90:b245]) by DB7PR04MB4985.eurprd04.prod.outlook.com ([fe80::4d76:bd58:4e90:b245%6]) with mapi id 15.20.3477.028; Tue, 20 Oct 2020 03:55:00 +0000 Date: Tue, 20 Oct 2020 11:54:50 +0800 From: Michael Chang To: The development of GNU GRUB Cc: rashmica.g@gmail.com, alastair@d-silva.org, Daniel Axtens Subject: Re: [PATCH 3/3] docs/grub: Document signing grub with an appended signature Message-ID: <20201020035450.GA14748@mercury> References: <20200821023720.13747-1-dja@axtens.net> <20200821023720.13747-4-dja@axtens.net> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200821023720.13747-4-dja@axtens.net> User-Agent: Mutt/1.10.1 (2018-07-13) X-Originating-IP: [2001:b011:30d0:3845:3e97:eff:feb6:5ceb] X-ClientProxiedBy: HK2PR03CA0044.apcprd03.prod.outlook.com (2603:1096:202:17::14) To DB7PR04MB4985.eurprd04.prod.outlook.com (2603:10a6:10:20::14) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from mercury (2001:b011:30d0:3845:3e97:eff:feb6:5ceb) by HK2PR03CA0044.apcprd03.prod.outlook.com (2603:1096:202:17::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.4 via Frontend Transport; Tue, 20 Oct 2020 03:54:58 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7dc057ca-52a1-4298-46c3-08d874abea96 X-MS-TrafficTypeDiagnostic: DB7PR04MB5355: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: iKwtpVxNI0/57UET5qP1X8Q0lTWkS+T0bKbKRbTUbUMn2palb4Q3P06KRZKivjZGS0nMgYTPX4v/NyRz/SM1R7wu00290cXHLCkcEZVrke9RDewPrRNf+MpCg+8+lWJqfKxuti1QzG7Fh2DLzXgydQAdsaBcaZrZ4ZNBe7p8eSZ+Rp45NhQooK+K94O2EMDLO1440Dt8+hZMjPDIHNaSjZ0Hxi72VqCOSCNCBkvvCdtb+4H9NKyzZpql6EAM4A1HzFr6zr6z0T/cZ+y4ZUVkLs3zpLmBpmbJedpOAn+HkPfpPmm0DacjxGNzPyV3AcbYve1PR3adhSrX9UI69Ltxkh+VMnS3ZMuxIh39GupKNgJ/SP541AFGHMpwxYBKYnv0o26/3tYzDt3S1Puf+Kev8w== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB7PR04MB4985.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(346002)(366004)(396003)(136003)(39860400002)(376002)(966005)(55016002)(4326008)(86362001)(9686003)(33656002)(6496006)(8676002)(2906002)(9576002)(186003)(16526019)(8936002)(6916009)(478600001)(5660300002)(52116002)(33716001)(83380400001)(1076003)(66946007)(66476007)(66556008)(6666004)(316002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: tAJor+hb8XDEwmKabr+PvG2NjwyIvBASskOj8No68qARsRBUMMJhFm3VM1MJkdueERU3FM5iT2hkWfjT3K2QkEN8zHnCtU8bhgfaqGyjjITbWnvZWAw/cE9O0tRQmTfvMu8Y371h/073/wxYo5OSPDXBmkO91Xgxa7YbmCwAzwBXsC//c9Zv1T1vQx3iHhJoyWy77xRrZRKXEsG2ZJttnlpogX/1ZU8bVKDtpc7DvF8Jg6Mumtxv9D/oxdqmDXr7r1+6iUQwcFZcZ0vSkPuBN0/J1kYwpHDgHCS7euw9tXlAFHmpH8G9XtWVSr8eQDPjsBk7XGBx4CRFrp+JEoQ6EedaTadZdlt3qDO4cZ3pqG9f+Gs/K4Y+4HOnshORWz/0wazx5D6YBDae7SUSOgkbfSL93ElOxGVRqDpiLZ7HZ5CktNdy1WRVdpV4Q7dY77I2WbsyxwkqNyWljyQwd55bNeXKGGmMo5W53e81GhK/69mqXRl8yMnsS5ZUJMJOXJRb2109IrLdASw7hmnAsBHiM8lPA2/nKf68TwLLKfWmI2xcoeHH6gD/EXD2h9mUMbAjK6RBqH7BN1m00sHP1fh78WgGwB8DU4SruJsfOo5B74EYeggLltko4sKgCKBg/gVxJ8RtXiF66Z4cB4BEJP0aJ8b3lOENLmy3Nic+XP+hO+gPYX9MkBj1ZwVAbbgISqJJeTd+PKws6EHpXfhKKmQqZA== X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7dc057ca-52a1-4298-46c3-08d874abea96 X-MS-Exchange-CrossTenant-AuthSource: DB7PR04MB4985.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2020 03:55:00.0399 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: +Ulz+wshXKR2gdNAlM7nVNnT4r7/8vDiQqNUKbjp8Hyd1tmzGXlhfYMeDNqOkohs X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR04MB5355 Received-SPF: pass client-ip=62.140.7.102; envelope-from=mchang@suse.com; helo=de-smtp-delivery-102.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/10/19 23:55:03 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Oct 2020 03:55:10 -0000 On Fri, Aug 21, 2020 at 12:37:20PM +1000, Daniel Axtens wrote: > Signing grub for firmware that verifies an appended signature is a > bit fiddly. I don't want people to have to figure it out from scratch > so document it here. > > Signed-off-by: Daniel Axtens > --- > docs/grub.texi | 42 ++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 42 insertions(+) > > diff --git a/docs/grub.texi b/docs/grub.texi > index 35da48456d9e..bbbe6c7e07bf 100644 > --- a/docs/grub.texi > +++ b/docs/grub.texi > @@ -5970,6 +5970,48 @@ image works under UEFI secure boot and can maintain the secure-boot chain. It > will also be necessary to enrol the public key used into a relevant firmware > key database. > > +@section Signing GRUB with an appended signature > + > +The @file{core.img} itself can be signed with a Linux kernel module-style > +appended signature. > + > +To support IEEE1275 platforms where the boot image is often loaded directly > +from a disk partition rather than from a file system, the @file{core.img} Maybe `core.elf` should be used for embedded image on ieee1275 platform? The core.img is more pc bios specific IMHO, and hence would be edited on-the-fly during the grub-install/grub-bios-setup process for keeping or adding some records, making it not a good example to the proposed procedure here as the image on filesysetm and partition may differ. > +can specify the size and location of the appended signature with an ELF > +note added by @command{grub-install}. > + > +An image can be signed this way using the @command{sign-file} command from > +the Linux kernel: > + > +@example > +@group > +# grub.key is your private key and certificate.der is your public key > + > +# Determine the size of the appended signature. It depends on the signing > +# certificate and the hash algorithm > +touch empty > +sign-file SHA256 grub.key certificate.der empty empty.sig > +SIG_SIZE=`stat -c '%s' empty.sig` > +rm empty empty.sig > + > +# Build a grub image with $SIG_SIZE reserved for the signature > +grub-install --appended-signature-size $SIG_SIZE --modules="..." ... > + > +# Replace the reserved size with a signature: > +# cut off the last $SIG_SIZE bytes with truncate's minus modifier > +truncate -s -$SIG_SIZE /boot/grub/powerpc-ieee1275/core.elf core.elf.unsigned > +# sign the trimmed file with an appended signature, restoring the correct size > +sign-file SHA256 grub.key certificate.der core.elf.unsigned core.elf.signed > + > +# Don't forget to install the signed image as required > +# (e.g. on powerpc-ieee1275, to the PReP partition) Could you please provide more indication on how to install the signed image afterwards ? I suppose it is 'dd' for writing the core.elf.signed to the PReP partition but not really sure that is correct. It also looked to me that the entire process can be integrated to grub-install so the user can get less hassle to setting it up. For that matters we could work out new grub-install options to accept user's private key and public key certicate to compose signed image with appended signature and install it on the fly. Is there anything that I could have missed here ? Thanks, Michael > +@end group > +@end example > + > +As with UEFI secure boot, it is necessary to build in the required modules, > +or sign them separately. > + > + > @node Platform limitations > @chapter Platform limitations > > -- > 2.25.1 > > > _______________________________________________ > Grub-devel mailing list > Grub-devel@gnu.org > https://lists.gnu.org/mailman/listinfo/grub-devel