From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1k8ww1-0006C0-I3 for mharc-grub-devel@gnu.org; Thu, 20 Aug 2020 22:37:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:55328) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k8ww0-0006As-HY for grub-devel@gnu.org; Thu, 20 Aug 2020 22:37:40 -0400 Received: from mail-pf1-x42f.google.com ([2607:f8b0:4864:20::42f]:46484) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1k8wvy-0004En-1H for grub-devel@gnu.org; Thu, 20 Aug 2020 22:37:40 -0400 Received: by mail-pf1-x42f.google.com with SMTP id 74so321609pfx.13 for ; Thu, 20 Aug 2020 19:37:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=anj90DufSFGFf6H61gPmIE5X9ZXNokFGmlDwa3befOU=; b=GfGW7As3Q864tIBzKjpXm1KZqD+p19GHy3GUIe1CdAEltqSspUTaJHZlZSC9MWOnav 1l1isCp7xrTv5JwQGa+QcdtUrQ9Jvy8gwIXKRXJOrFQG6ahMUeWO18bNCM40NecZ++iG r9Z7aIORiDi7TVjLVDXdqkiWl7ViNRy3b/40o= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=anj90DufSFGFf6H61gPmIE5X9ZXNokFGmlDwa3befOU=; b=nCBi40xwBTGFEHRFIBe9pxr+8H/Pa5byt01ONuk+eEhuB1NIhRPpUTOJ9NHPskMgbx pyWBgTyLEDg6A33OfNtIdkM/CNdo3TxIwHzr9q2FkHSrm7b3x93iZEvrZsnRt+dUAdm7 MhmH+CWeqlKxuRWVDOX4YW01sMYup4vH+O1Zd2LQxI3zW3ZVMBBPS+kwAgiVk7dn7RWf GTI/od49BAw9MT3c1I+ugiHvPNWEeVzCw2iisvXVIbJXRgOqHBpcGE2KagyrIIEKxRs0 p1+e1V2IpksDj56kyCCSWyi2VedH3+cZ+c8VIjlghn9/uwgAM/sl5neoPt/6ZpmMs8M1 b83Q== X-Gm-Message-State: AOAM5335cgbWzWCC26z3tqSuXEgPHtqFhd+Ef/+fs2v+HgAxeOU6jJ1/ xZ3LRt7Z6y4oJf5MptTHONu6R9stlkNkmg== X-Google-Smtp-Source: ABdhPJz6R0xAMY8v5D1V2pT6qMhBxnRpAZW/eBKCE7Y7/fLqcP7NGC3cMD2ICffXATefQ+OhmwlOPw== X-Received: by 2002:a63:4b21:: with SMTP id y33mr792123pga.142.1597977456058; Thu, 20 Aug 2020 19:37:36 -0700 (PDT) Received: from localhost (2001-44b8-1113-6700-0951-8f5b-1590-b7af.static.ipv6.internode.on.net. [2001:44b8:1113:6700:951:8f5b:1590:b7af]) by smtp.gmail.com with ESMTPSA id 30sm240560pjz.24.2020.08.20.19.37.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2020 19:37:35 -0700 (PDT) From: Daniel Axtens To: grub-devel@gnu.org Cc: rashmica.g@gmail.com, alastair@d-silva.org, Daniel Axtens Subject: [PATCH 1/3] Add suport for signing grub with an appended signature Date: Fri, 21 Aug 2020 12:37:18 +1000 Message-Id: <20200821023720.13747-2-dja@axtens.net> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200821023720.13747-1-dja@axtens.net> References: <20200821023720.13747-1-dja@axtens.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::42f; envelope-from=dja@axtens.net; helo=mail-pf1-x42f.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2020 02:37:40 -0000 From: Rashmica Gupta Add infrastructure to allow firmware to verify the integrity of grub by use of a Linux-kernel-module-style appended signature. We initially target powerpc-ieee1275, but the code should be extensible to other platforms. Usually these signatures are appended to a file without modifying the ELF file itself. (This is what the 'sign-file' tool does, for example.) The verifier loads the signed file from the file system and looks at the end of the file for the appended signature. However, on powerpc-ieee1275 platforms, the bootloader is often stored directly in the PReP partition as raw bytes without a file-system. This makes determining the location of an appended signature more difficult. To address this, we add a new ELF note. The name field of shall be the string "Appended-Signature", zero-padded to 4 byte alignment. The type field shall be 0x41536967 (the ASCII values for the string "ASig"). It must be the final section in the ELF binary. The description shall contain the appended signature structure as defined by the Linux kernel. The description will also be padded to be a multiple of 4 bytes. The padding shall be added before the appended signature structure (not at the end) so that the final bytes of a signed ELF file are the appended signature magic. A subsequent patch documents how to create a grub core.img validly signed under this scheme. Signed-off-by: Daniel Axtens Signed-off-by: Rashmica Gupta --- You can experiment with this code with a patched version of SLOF that verifies these signatures. You can find one at: https://github.com/daxtens/SLOF I will be proposing the ELF note details for inclusion in a future Power Architecture Platform Reference (PAPR). --- include/grub/util/install.h | 8 ++++++-- include/grub/util/mkimage.h | 4 ++-- util/grub-install-common.c | 16 ++++++++++++--- util/grub-mkimage.c | 11 +++++++++++ util/grub-mkimagexx.c | 39 ++++++++++++++++++++++++++++++++++++- util/mkimage.c | 10 +++++----- 6 files changed, 75 insertions(+), 13 deletions(-) diff --git a/include/grub/util/install.h b/include/grub/util/install.h index 2631b1074513..eb1b83b6d946 100644 --- a/include/grub/util/install.h +++ b/include/grub/util/install.h @@ -63,6 +63,9 @@ /* TRANSLATORS: "embed" is a verb (command description). "*/ \ { "pubkey", 'k', N_("FILE"), 0, \ N_("embed FILE as public key for signature checking"), 0}, \ + { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ + "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ + 1}, \ { "verbose", 'v', 0, 0, \ N_("print verbose messages."), 1 } @@ -122,7 +125,8 @@ enum grub_install_options { GRUB_INSTALL_OPTIONS_THEMES_DIRECTORY, GRUB_INSTALL_OPTIONS_GRUB_MKIMAGE, GRUB_INSTALL_OPTIONS_INSTALL_CORE_COMPRESS, - GRUB_INSTALL_OPTIONS_DTB + GRUB_INSTALL_OPTIONS_DTB, + GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE }; extern char *grub_install_source_directory; @@ -182,7 +186,7 @@ grub_install_generate_image (const char *dir, const char *prefix, size_t npubkeys, char *config_path, const struct grub_install_image_target_desc *image_target, - int note, + int note, size_t appsig_size, grub_compression_t comp, const char *dtb_file); const struct grub_install_image_target_desc * diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h index ba9f568f6926..2000d6fbdf1e 100644 --- a/include/grub/util/mkimage.h +++ b/include/grub/util/mkimage.h @@ -50,12 +50,12 @@ grub_mkimage_load_image64 (const char *kernel_path, const struct grub_install_image_target_desc *image_target); void grub_mkimage_generate_elf32 (const struct grub_install_image_target_desc *image_target, - int note, char **core_img, size_t *core_size, + int note, size_t appsig_size, char **core_img, size_t *core_size, Elf32_Addr target_addr, struct grub_mkimage_layout *layout); void grub_mkimage_generate_elf64 (const struct grub_install_image_target_desc *image_target, - int note, char **core_img, size_t *core_size, + int note, size_t appsig_size, char **core_img, size_t *core_size, Elf64_Addr target_addr, struct grub_mkimage_layout *layout); diff --git a/util/grub-install-common.c b/util/grub-install-common.c index ca0ac612ac51..e9b75d6f1fcf 100644 --- a/util/grub-install-common.c +++ b/util/grub-install-common.c @@ -308,10 +308,12 @@ handle_install_list (struct install_list *il, const char *val, static char **pubkeys; static size_t npubkeys; static grub_compression_t compression; +static size_t appsig_size; int grub_install_parse (int key, char *arg) { + const char *end; switch (key) { case 'C': @@ -400,6 +402,12 @@ grub_install_parse (int key, char *arg) grub_util_error (_("Unrecognized compression `%s'"), arg); case GRUB_INSTALL_OPTIONS_GRUB_MKIMAGE: return 1; + case GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE: + grub_errno = 0; + appsig_size = grub_strtol(arg, &end, 10); + if (grub_errno) + return 0; + return 1; default: return 0; } @@ -498,10 +506,12 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, grub_util_info ("grub-mkimage --directory '%s' --prefix '%s'" " --output '%s' " " --dtb '%s' " - "--format '%s' --compression '%s' %s %s\n", + "--format '%s' --compression '%s' " + "--appended-signature-size %zu %s %s\n", dir, prefix, outname, dtb ? : "", mkimage_target, - compnames[compression], note ? "--note" : "", s); + compnames[compression], appsig_size, + note ? "--note" : "", s); free (s); tgt = grub_install_get_image_target (mkimage_target); @@ -511,7 +521,7 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, grub_install_generate_image (dir, prefix, fp, outname, modules.entries, memdisk_path, pubkeys, npubkeys, config_path, tgt, - note, compression, dtb); + note, appsig_size, compression, dtb); while (dc--) grub_install_pop_module (); } diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c index 912564e3622f..c1e07c70dc7e 100644 --- a/util/grub-mkimage.c +++ b/util/grub-mkimage.c @@ -82,6 +82,7 @@ static struct argp_option options[] = { {"format", 'O', N_("FORMAT"), 0, 0, 0}, {"compression", 'C', "(xz|none|auto)", 0, N_("choose the compression to use for core image"), 0}, {"verbose", 'v', 0, 0, N_("print verbose messages."), 0}, + {"appended-signature-size", 's', N_("SIZE"), 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), 0}, { 0, 0, 0, 0, 0, 0 } }; @@ -124,6 +125,7 @@ struct arguments char *font; char *config; int note; + size_t appsig_size; const struct grub_install_image_target_desc *image_target; grub_compression_t comp; }; @@ -134,6 +136,7 @@ argp_parser (int key, char *arg, struct argp_state *state) /* Get the input argument from argp_parse, which we know is a pointer to our arguments structure. */ struct arguments *arguments = state->input; + const char* end; switch (key) { @@ -166,6 +169,13 @@ argp_parser (int key, char *arg, struct argp_state *state) arguments->note = 1; break; + case 's': + grub_errno = 0; + arguments->appsig_size = grub_strtol(arg, &end, 10); + if (grub_errno) + return 0; + break; + case 'm': if (arguments->memdisk) free (arguments->memdisk); @@ -309,6 +319,7 @@ main (int argc, char *argv[]) arguments.memdisk, arguments.pubkeys, arguments.npubkeys, arguments.config, arguments.image_target, arguments.note, + arguments.appsig_size, arguments.comp, arguments.dtb); if (grub_util_file_sync (fp) < 0) diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c index ab6dfab79242..3bfed4369fd3 100644 --- a/util/grub-mkimagexx.c +++ b/util/grub-mkimagexx.c @@ -84,6 +84,15 @@ struct grub_ieee1275_note struct grub_ieee1275_note_desc descriptor; }; +#define GRUB_APPENDED_SIGNATURE_NOTE_NAME "Appended-Signature" +#define GRUB_APPENDED_SIGNATURE_NOTE_TYPE 0x41536967 /* "ASig" */ + +struct grub_appended_signature_note +{ + Elf32_Nhdr header; + char name[ALIGN_UP(sizeof (GRUB_APPENDED_SIGNATURE_NOTE_NAME), 4)]; +}; + #define GRUB_XEN_NOTE_NAME "Xen" struct fixup_block_list @@ -207,7 +216,7 @@ grub_arm_reloc_jump24 (grub_uint32_t *target, Elf32_Addr sym_addr) void SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc *image_target, - int note, char **core_img, size_t *core_size, + int note, size_t appsig_size, char **core_img, size_t *core_size, Elf_Addr target_addr, struct grub_mkimage_layout *layout) { @@ -221,6 +230,12 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc int shnum = 4; int string_size = sizeof (".text") + sizeof ("mods") + 1; + if (appsig_size) + { + phnum++; + footer_size += ALIGN_UP(sizeof (struct grub_appended_signature_note) + appsig_size, 4); + } + if (image_target->id != IMAGE_LOONGSON_ELF) phnum += 2; @@ -484,6 +499,28 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_offset = grub_host_to_target32 (header_size + program_size); } + if (appsig_size) { + int note_size = ALIGN_UP(sizeof (struct grub_appended_signature_note) + appsig_size, 4); + struct grub_appended_signature_note *note_ptr = (struct grub_appended_signature_note *) + (elf_img + program_size + header_size + (note ? sizeof (struct grub_ieee1275_note) : 0)); + + note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_APPENDED_SIGNATURE_NOTE_NAME)); + /* needs to sit at the end, so we round this up and sign some zero padding */ + note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP(appsig_size, 4)); + note_ptr->header.n_type = grub_host_to_target32 (GRUB_APPENDED_SIGNATURE_NOTE_TYPE); + strcpy (note_ptr->name, GRUB_APPENDED_SIGNATURE_NOTE_NAME); + + phdr++; + phdr->p_type = grub_host_to_target32 (PT_NOTE); + phdr->p_flags = grub_host_to_target32 (PF_R); + phdr->p_align = grub_host_to_target32 (image_target->voidp_sizeof); + phdr->p_vaddr = 0; + phdr->p_paddr = 0; + phdr->p_filesz = grub_host_to_target32 (note_size); + phdr->p_memsz = 0; + phdr->p_offset = grub_host_to_target32 (header_size + program_size + (note ? sizeof (struct grub_ieee1275_note) : 0)); + } + { char *str_start = (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr) + shnum * sizeof (*shdr)); diff --git a/util/mkimage.c b/util/mkimage.c index 37d6249f16b3..bd06968deccb 100644 --- a/util/mkimage.c +++ b/util/mkimage.c @@ -822,7 +822,7 @@ grub_install_generate_image (const char *dir, const char *prefix, char *memdisk_path, char **pubkey_paths, size_t npubkeys, char *config_path, const struct grub_install_image_target_desc *image_target, - int note, grub_compression_t comp, const char *dtb_path) + int note, size_t appsig_size, grub_compression_t comp, const char *dtb_path) { char *kernel_img, *core_img; size_t total_module_size, core_size; @@ -1742,11 +1742,11 @@ grub_install_generate_image (const char *dir, const char *prefix, else target_addr = image_target->link_addr; if (image_target->voidp_sizeof == 4) - grub_mkimage_generate_elf32 (image_target, note, &core_img, &core_size, - target_addr, &layout); + grub_mkimage_generate_elf32 (image_target, note, appsig_size, &core_img, + &core_size, target_addr, &layout); else - grub_mkimage_generate_elf64 (image_target, note, &core_img, &core_size, - target_addr, &layout); + grub_mkimage_generate_elf64 (image_target, note, appsig_size, &core_img, + &core_size, target_addr, &layout); } break; } -- 2.25.1