Re: [PATCH v1 13/21] ieee1275: enter lockdown based on /ibm,secure-boot

[Avnish Chouhan <avnish@linux.ibm.com>]

On 2024-12-18 20:26, Sudhakar Kuppusamy wrote:
> From: Daniel Axtens <dja@axtens.net>
> 
> If the 'ibm,secure-boot' property of the root node is 2 or greater,
> enter lockdown.
> 
> Signed-off-by: Daniel Axtens <dja@axtens.net>
> Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
> ---
>  docs/grub.texi                 |  4 ++--
>  grub-core/Makefile.core.def    |  1 +
>  grub-core/kern/ieee1275/init.c | 28 ++++++++++++++++++++++++++++
>  include/grub/lockdown.h        |  3 ++-
>  4 files changed, 33 insertions(+), 3 deletions(-)
> 
> diff --git a/docs/grub.texi b/docs/grub.texi
> index f71ce9ffc..6b634f111 100644
> --- a/docs/grub.texi
> +++ b/docs/grub.texi
> @@ -8959,8 +8959,8 @@ platforms.
>  @section Lockdown when booting on a secure setup
> 
>  The GRUB can be locked down when booted on a secure boot environment,
> for example
> -if the UEFI secure boot is enabled. On a locked down configuration,
> the GRUB will
> -be restricted and some operations/commands cannot be executed.
> +if UEFI or Power secure boot is enabled. On a locked down 
> configuration, the
> +GRUB will be restricted and some operations/commands cannot be 
> executed.
> 
>  The @samp{lockdown} variable is set to @samp{y} when the GRUB is 
> locked down.
>  Otherwise it does not exit.
> diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
> index 9cf4a6009..1ed55b0e3 100644
> --- a/grub-core/Makefile.core.def
> +++ b/grub-core/Makefile.core.def
> @@ -331,6 +331,7 @@ kernel = {
>    powerpc_ieee1275 = kern/powerpc/cache.S;
>    powerpc_ieee1275 = kern/powerpc/dl.c;
>    powerpc_ieee1275 = kern/powerpc/compiler-rt.S;
> +  powerpc_ieee1275 = kern/lockdown.c;
> 
>    sparc64_ieee1275 = kern/sparc64/cache.S;
>    sparc64_ieee1275 = kern/sparc64/dl.c;
> diff --git a/grub-core/kern/ieee1275/init.c 
> b/grub-core/kern/ieee1275/init.c
> index dfbd0b899..59984b605 100644
> --- a/grub-core/kern/ieee1275/init.c
> +++ b/grub-core/kern/ieee1275/init.c
> @@ -49,6 +49,7 @@
>  #if defined(__powerpc__) || defined(__i386__)
>  #include <grub/ieee1275/alloc.h>
>  #endif
> +#include <grub/lockdown.h>
> 
>  /* The maximum heap size we're going to claim at boot. Not used by 
> sparc. */
>  #ifdef __i386__
> @@ -953,6 +954,31 @@ grub_parse_cmdline (void)
>      }
>  }
> 
> +static void
> +grub_get_ieee1275_secure_boot (void)
> +{
> +  grub_ieee1275_phandle_t root;
> +  int rc;
> +  grub_uint32_t is_sb;
> +
> +  grub_ieee1275_finddevice ("/", &root);

Hi,

Failure check condition is missing!

Thank you,
Avnish Chouhan

> +
> +  rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", 
> &is_sb,
> +                                           sizeof (is_sb), 0);
> +
> +  /*
> +   * ibm,secure-boot:
> +   * 0 - disabled
> +   * 1 - audit
> +   * 2 - enforce
> +   * 3 - enforce + OS-specific behaviour
> +   *
> +   * We only support enforce.
> +   */
> +  if (rc >= 0 && is_sb >= 2)
> +    grub_lockdown ();
> +}
> +
>  grub_addr_t grub_modbase;
> 
>  void
> @@ -978,6 +1004,8 @@ grub_machine_init (void)
>  #else
>    grub_install_get_time_ms (grub_rtc_get_time_ms);
>  #endif
> +
> +  grub_get_ieee1275_secure_boot ();
>  }
> 
>  void
> diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
> index 40531fa82..ebfee4bf0 100644
> --- a/include/grub/lockdown.h
> +++ b/include/grub/lockdown.h
> @@ -24,7 +24,8 @@
>  #define GRUB_LOCKDOWN_DISABLED       0
>  #define GRUB_LOCKDOWN_ENABLED        1
> 
> -#ifdef GRUB_MACHINE_EFI
> +#if defined(GRUB_MACHINE_EFI) || \
> +    (defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275))
>  extern void
>  EXPORT_FUNC (grub_lockdown) (void);
>  extern int

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel