From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1lIAMw-0001EO-2h for mharc-grub-devel@gnu.org; Fri, 05 Mar 2021 08:19:50 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:53384) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lIAMq-0001DY-32 for grub-devel@gnu.org; Fri, 05 Mar 2021 08:19:45 -0500 Received: from de-smtp-delivery-102.mimecast.com ([62.140.7.102]:53519) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1lIAMd-0007C8-Jr for grub-devel@gnu.org; Fri, 05 Mar 2021 08:19:40 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=mimecast20200619; t=1614950368; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=uW/ii6g7joY3UPFuado8RO4ow9HpV9mk/4BHLnv2JLI=; b=EoqkA9ZmOniNefMI5ZsGtT8/5QiOS7irUuH5BBmgnzdk37VXtiVPAquYI3xkbJZBopIv/8 TN3zZ8Pqyp7cfIV3UhnUNeH1G3j4AQxhUXNHSp31/MC/fX+ofgL4+6lNSd29IU9rBUtWjk jkNLRZMF8kQQz7gdaLeuUuzvVF+k2IQ= Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-ve1eur02lp2058.outbound.protection.outlook.com [104.47.6.58]) (Using TLS) by relay.mimecast.com with ESMTP id de-mta-38-46DDz0ydP_mEOf0NqT9W9g-1; Fri, 05 Mar 2021 14:19:27 +0100 X-MC-Unique: 46DDz0ydP_mEOf0NqT9W9g-1 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DMJBBGLRsxnT5arCenuhKwADFt/wlnMcNVlXujoIRrlkcSPOGQ+evQ93BhEb/4SJ98+Kw8g3pAfBSv0CG4VeAWds5mlINkt1qlm0YBCsiXifKV6+qtfwBBdeQIPWo9KRABa5JDzi5VbB31xVz004tBfWZUz1dKOx+Fah2tyD/JxCtBAZmQc6rk0M4PDUMN49djU49lP4w1cf3KH056Wd0rUOukR7fWA+GM4ZUwESGvVptgKPNZyvN0+jz6DsYjXke6EoivnTw1MrtnNcwLr8i9q6Gz0s94MLbM7qy0BQwAqpMSItai/7A2I6DmcDqtYgx1KewGCq8Z21fiGnH3FEwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uW/ii6g7joY3UPFuado8RO4ow9HpV9mk/4BHLnv2JLI=; b=eJ9FqzMn6E7tjUK/PTE4SxgrG3/nRuBIYZusVHWu4QjKf3CDfeOAFfI0RVboRPkwr+ihnt7zo2jhrAheOLoHYk+S+xFkdzaf+Htzz+X3uSigxnT1M/XNEKy1VtAMzBVpJz6mYQp23Hk07wOOB9qy0kcSKajblAbykqDeZ16y5PpMPHigkc9iIb4Nu36mRwjgPQyR6y2WS5LB5T9XsuhajN6tOPGG+RAuFKgwcWmZ3+SgTfEaTC3pBkjKYfZwQDqpaJN+zqfUv5PgX1NHxARrCWQhOsVA+rI8WgDmldb0N9+WSyksijc58AWDV4ssonmPuq9Ip7YsU0uCa/6Dg20AeA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none Authentication-Results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=suse.com; Received: from VI1PR04MB4991.eurprd04.prod.outlook.com (2603:10a6:803:57::28) by VI1PR0402MB3613.eurprd04.prod.outlook.com (2603:10a6:803:a::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3890.23; Fri, 5 Mar 2021 13:19:23 +0000 Received: from VI1PR04MB4991.eurprd04.prod.outlook.com ([fe80::28b7:e423:c3d7:7ccf]) by VI1PR04MB4991.eurprd04.prod.outlook.com ([fe80::28b7:e423:c3d7:7ccf%6]) with mapi id 15.20.3890.032; Fri, 5 Mar 2021 13:19:23 +0000 Date: Fri, 5 Mar 2021 21:19:11 +0800 From: Michael Chang To: Thomas Frauendorfer Cc: The development of GNU GRUB Subject: Re: [PATCH] Add chainloaded image as shim's verifiable object Message-ID: <20210305131911.GA24095@mercury> References: <20210305121126.23928-1-mchang@suse.com> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) X-Originating-IP: [2001:b011:30d0:3140:37e2:a559:41a5:49df] X-ClientProxiedBy: HKAPR04CA0012.apcprd04.prod.outlook.com (2603:1096:203:d0::22) To VI1PR04MB4991.eurprd04.prod.outlook.com (2603:10a6:803:57::28) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from mercury (2001:b011:30d0:3140:37e2:a559:41a5:49df) by HKAPR04CA0012.apcprd04.prod.outlook.com (2603:1096:203:d0::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3912.17 via Frontend Transport; Fri, 5 Mar 2021 13:19:22 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8d938147-2c9e-402c-7959-08d8dfd94ad9 X-MS-TrafficTypeDiagnostic: VI1PR0402MB3613: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: D48f1y7UJJHlsh4arzdECa6srmSQXutMlXbOdAUaCd5xpHWPXyNM6Ic2WG7ZZhWAYM1IlCLTTMCGTMDTn898/E+VCHka2mGjht8u5ygqSbl8obO1bXyLbBZcQAUEfhJdf9PcKGfO2cTBSe6hSFxBDIwv8+ZZTJ7K6w3FjFtG/oNWYU34oHGlM8UrLSuRGh4RJmjZn9duTdJepdZNesVh/HfnGW7HMT1RRTOXbEA4DhZwcplnhmsfTEJYLCiuRPTzK5R3otEJib7pk5PvN8xE9ihLFxLXJ107EQuE10n+xZArpWqGRtkqBSUeeB+f5/LI8NCs/iQ2m6sBVCGGaUyQpB1fGXZFpwulq3npZUfd6R/wCLJe0wEtkBKsDoKsDJad2/bsTimbIcZJFQxoi709/+Kf9vHZSzIftJV8vGPnzjgVh6OPbl52JNgVyAv+SdkmF9Wx7/+GLaju80QbA24XRaxIohNg5ay5M0CJ+bp9K1P+BA8morjlro1Rt/h2ExQ2rpme8WofIqDO+61e8DhVnxHPpTEdkH25tpustMv1k0AfLvBteNmnvUIUvMoiF+a7e9MUDwwso25eiKNS5HJTEHb5rJ7b/H4Di0WuOqWLeYQ= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:VI1PR04MB4991.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(396003)(366004)(39860400002)(376002)(136003)(346002)(8676002)(83380400001)(6916009)(186003)(6496006)(6666004)(66556008)(9686003)(66946007)(316002)(16526019)(1076003)(66476007)(33656002)(5660300002)(9576002)(52116002)(33716001)(86362001)(2906002)(4326008)(55016002)(8936002)(478600001)(53546011)(966005)(45080400002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?20ZKNaO+abJflu3xfuiIOD/3kXgbjuySIa8NPbW72s5P1dQxdcleCPgYNtdV?= =?us-ascii?Q?b3M0nifBN8CM8nl4QHXIJLVuDaxGHoeVTNNLkVZPhuDjTnG/7TaQgN8a8N4Y?= =?us-ascii?Q?3KalvKJ4fD2apz6ANYgRbV9/IsNDV2BCwnneqK7XnKhOohYUg+QVTi5Bcbgq?= =?us-ascii?Q?OAdseMDZBcKWeUofRuEqbbJCH53jdCtuxp3OqJeinfLeiIIuD67dj74xc53e?= =?us-ascii?Q?ebqeCJf2//xw778TVK4AZ4tWfdSt8vxH0E4B8VwmtCauzJk0K4lDabMsucjl?= =?us-ascii?Q?TygGLqD83hnTHhwiRCq77b7R97/aAHEIb1NTISrjvEe8CMTwOEpFFbKznztz?= =?us-ascii?Q?PF+ZnPa21euibpwvzi9ApgxPvAlLHTEnJn+6m201WqXjyaMx5IXNYi4ehWVI?= =?us-ascii?Q?fdx6j3U9XEa+xHpNGewEESg+FE1Wuv3whD8E9X0dPQy41+0YuZ1u7E2LHP43?= =?us-ascii?Q?yMIUvj7nR6NY1TyZnVTKzKHpl831JoGspZMtoA82/az3HTK8XTuEI3VcjMFR?= =?us-ascii?Q?2Meyihgox0cepV8gV83M2xwfIsIwsKSgOjDfZWwIK6o1zMQEzEUePoheqZyV?= =?us-ascii?Q?VUxjD4qVpFdcG3Tj9XNouVdlgoqKaABy7wlj5z/MHxtwTqisVBHYoE5AZKuP?= =?us-ascii?Q?KSDtuMKXA6Vig/g/A52g3lqycEWJ940Jg1Hb9O0kXhy9ZChNMTpA6UOdOpQ+?= =?us-ascii?Q?cfzT1LEB/9K0Gj7BMndIJYgZLuApgNqMn+17owKqb4+YwgDUdrwVpXOGVxbZ?= =?us-ascii?Q?GkQJ4RshcsmnvH/Qzsb5Ibkt8DSxDzHvmte4Nia0bJyL0gkU9Mr5HCmHiEyL?= =?us-ascii?Q?dKLyiJuzHIA1wGbLJBYY3gZex4PGAKCyqDlxxKYVG1Em76dowGc6Mo2sQ06B?= =?us-ascii?Q?npwe5SsP0AR5gTS+3HhYWo8s6OG++4wULGpz/WNrDaaMQR/goBTgzxhZ99gq?= =?us-ascii?Q?TDgBExugktz7qW4KAqw8AtcSB2qt+ngHR1/slKEgp0e17wOJtxbZCsI1yWwo?= =?us-ascii?Q?b48HL/aNAc/97P6raGOH9gmi4i2LZaoGIGkvEPFO0VpDnin2ZnAPQDWARMm3?= =?us-ascii?Q?NdlFSWQg9GtCMktrHc7+e6eRKjvVYFFHkSzzZGommeWwzN+/+zDjmz08Ycds?= =?us-ascii?Q?//irsCO6fwnj4Zj5XuD9Q8ziwqTr9T1Q/0xxZs4fIviXh8UUKdOFPNmoE0K/?= =?us-ascii?Q?HxyfvHAMR07dXknY/2WMDbycFukCyhVyaLQvLtz7yuFn06w/cDzP6WT/AqQf?= =?us-ascii?Q?yM7G/GSrKi7upU7EEy6ZLoMhXn81O7sxW+Bbac7PYG2hwA0ho0AibgrbGtGS?= =?us-ascii?Q?qKBhxZDzynDMi6gQP51RxnwmZZKfoXbIBtELXeNNKXN+0K9SSnvrOn5W6DaK?= =?us-ascii?Q?KVg/0Te9mrs5/WciQ65kbjnJoSR0?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8d938147-2c9e-402c-7959-08d8dfd94ad9 X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB4991.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Mar 2021 13:19:23.1117 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: P+cGTmDrZedsenSNTh+RQ/xv/xpx0O3iJw+UudyybvMMZA2rd1iqZnPZyCOhpAr5 X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0402MB3613 Received-SPF: pass client-ip=62.140.7.102; envelope-from=mchang@suse.com; helo=de-smtp-delivery-102.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Mar 2021 13:19:45 -0000 On Fri, Mar 05, 2021 at 01:32:57PM +0100, Thomas Frauendorfer wrote: > On Fri, Mar 5, 2021 at 1:12 PM Michael Chang via Grub-devel > wrote: > > > > While attempting to dual boot Microsoft Windows with efi chainloader, it > > failed with below error when secure boot was enabled. > > > > error ../../grub-core/kern/verifiers.c:119:verification requested but > > nobody cares: /EFI/Microsoft/Boot/bootmgfw.efi. > > > > It is a regression, as previously it worked without problem. > > > > It turns out chainloading image has been locked down introduced by > > > > 578c95298 kern: Add lockdown support > > > > However we should consider it as verifiable object to shim to allow > > booting in secure boot enabled mode. The chainloaded image could also > > have trusted signature signed by vendor with their pubkey cert in db. > > For that matters it's usage should not be locked down in secure boot, > > and instead use shim to validate it's signature before running it. > > > > Signed-off-by: Michael Chang > > [cut out] > > > /* Fall through. */ > > diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c > > index 0bc70fd42..e1fd1c1e2 100644 > > --- a/grub-core/kern/lockdown.c > > +++ b/grub-core/kern/lockdown.c > > @@ -48,7 +48,6 @@ lockdown_verifier_init (grub_file_t io __attribute__ ((unused)), > > case GRUB_FILE_TYPE_PXECHAINLOADER: > > case GRUB_FILE_TYPE_PCCHAINLOADER: > > case GRUB_FILE_TYPE_COREBOOT_CHAINLOADER: > > - case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE: > > case GRUB_FILE_TYPE_ACPI_TABLE: > > case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE: > > *flags = GRUB_VERIFY_FLAGS_DEFER_AUTH; > > -- > > 2.26.2 > > The lockdown verifier makes sure that at least one verifer has > validated the image. > So removing GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE from it is a very bad idea. Indeed. I will send second patch for not removing it from lockdown. Thanks a lot for your review. Michael > > > _______________________________________________ > > Grub-devel mailing list > > Grub-devel@gnu.orgthe > > https://lists.gnu.org/mailman/listinfo/grub-devel >