From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1kQAJq-0006YE-So for mharc-grub-devel@gnu.org; Wed, 07 Oct 2020 10:21:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:40156) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kQAJp-0006Y5-Gn for grub-devel@gnu.org; Wed, 07 Oct 2020 10:21:25 -0400 Received: from mail-pl1-x642.google.com ([2607:f8b0:4864:20::642]:34035) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kQAJn-0002pY-BH for grub-devel@gnu.org; Wed, 07 Oct 2020 10:21:25 -0400 Received: by mail-pl1-x642.google.com with SMTP id t18so1091230plo.1 for ; Wed, 07 Oct 2020 07:21:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Mqz3ht/a1BKfFRvvvy7niE7+x5USSSgghc5u0kJMB9w=; b=NLtronOOORVnXntqzkfTqEtWY1wyilfziOyhJcfJbyRFjBTr7J77sHPhOsWzs9T/gP McNLHeJ16+VvveYk6d6gZk0BCLMZlNf1d9SPLysPGpA8qVaMEq1A5vSMfJwxS0nTygsW ZgEJ+khDW67ROUsCYWH0C0Hl7OWORxoT/YO0Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Mqz3ht/a1BKfFRvvvy7niE7+x5USSSgghc5u0kJMB9w=; b=ptA/vFkwp7jEOlABykBeHr3MRHgRSqr+8E7N8Fg7M0z5qgumVAbBhjLs18N7CrLCuH eYgItHquT87aUrjT5vvkaMJHjiQFIWayDaGj4+SS29zbdxZghJKfRa7MDMa1Vy3iIdcp ZjVCd6DOaL91gd5ljY4rbam3W90ZdLTQADHYAuPCjadYBett6N8gzYzK1D2nw5pU44aT mjtIuSbD9VtkOyHi6xkiD3bSwMV1Wm7/wOgMGrwDJO3O+iHRu9b5Wrgkv4C5msZYOD1y pbZnThxqIg5j15sVD/AajJQa49ajyoYCwo6ATYoX3oXDHf9KqjHLPBWrtQcbJ5ALWBFo wMSw== X-Gm-Message-State: AOAM531kPTVnVZnchpFBzsxK0g8nFMuXgpxwhiZY2pgOb2puFcXQS1Ea yCH4w4EtrVMKB7NplOHFp/8XNtxfOr0Qqw== X-Google-Smtp-Source: ABdhPJyrzkcQEZPsCeRMDR5d72whPrjOf/PYwNSJ+xS7mNgQ8RdMY/QW7R/lqNegK1nXb5aNrdGsyQ== X-Received: by 2002:a17:90a:f184:: with SMTP id bv4mr2960900pjb.1.1602080481311; Wed, 07 Oct 2020 07:21:21 -0700 (PDT) Received: from localhost (2001-44b8-111e-5c00-d027-2f4c-df69-d3d5.static.ipv6.internode.on.net. [2001:44b8:111e:5c00:d027:2f4c:df69:d3d5]) by smtp.gmail.com with ESMTPSA id q6sm3317792pfn.10.2020.10.07.07.21.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2020 07:21:20 -0700 (PDT) From: Daniel Axtens To: grub-devel@gnu.org Cc: rashmica.g@gmail.com, alastair@d-silva.org, Daniel Axtens Subject: [PATCH 0/1] RFC: ieee1275: link appended-signature enforcement to secure boot Date: Thu, 8 Oct 2020 01:21:15 +1100 Message-Id: <20201007142116.43454-1-dja@axtens.net> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::642; envelope-from=dja@axtens.net; helo=mail-pl1-x642.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Oct 2020 14:21:25 -0000 This patch demonstrates how secure boot on pseries machines could be linked to the appended signature verification I sent earlier. It's a pretty big hammer at the moment - I am posting it so we can discuss whether this is something that would be acceptable in upstream grub. If it acceptable in theory I'm happy to rework it to be less invasive. (The rest of this cover letter concerns testing the entire end-to-end setup - signing grub, verifying signatures in grub and enforcing secure boot.) You can experiement with this using entirely free software. You need the following trees: https://github.com/daxtens/qemu branch pseries-secboot https://github.com/daxtens/SLOF branch ibm,secure-boot https://github.com/daxtens/grub branch ibm,secure-boot You also need: - a key to sign grub, and accompanying DER certificate - a key to sign linux, and accompanying DER certificate Both should have keyUsage=digitalSignature and not be CAs. Lastly you will need a working a ppc64(le) vm. Then: - build qemu. You need qemu-system-ppc64. - use xxd to convert the certificate for verifying grub into a header file, and copy it in to SLOF/lib/libcrypto/certificate.h. It must create variables certificate_der and certificate_der_len. - build SLOF for qemu (make qemu) - verify that you can boot your VM with new SLOF and stock grub. To boot with new SLOF, pass -bios ./SLOF/boot_rom.bin . It should boot with new slof in non-secure (default) mode. To enable secure boot, add ",secure-boot" to your machine parameter, e.g. "-M pseries,secure-boot". This should now refuse to boot with an error in SLOF. (Note that the SLOF verfication is a bit lackadaisical, it doesn't stop you dropping to the all-powerful OF prompt, and it only requires signatures on 32-bit binaries. -kernel vmlinux should still work even in SB mode, for example. I haven't tested netbooting.) - Build grub in your VM. - Build the signing key into grub, along with the appendedsig module. The following incantation should give you a working but non-portable grub, assuming you have grub installed on /dev/sda1: touch empty sign-file SHA256 grub-signing.key grub-signing-certificate.der \ empty empty.signed SIG_SIZE=`stat -c '%s' empty.signed` echo "Detected signature size: $SIG_SIZE bytes" rm empty empty.signed GRUB_MODULES="appendedsig gcry_sha256 all_video boot btrfs cat configfile echo ext2 fat font gfxmenu gfxterm gzio halt hfsplus http iso9660 jpeg loadenv loopback linux lvm mdraid09 mdraid1x minicmd net normal part_apple part_msdos part_gpt password_pbkdf2 png reboot regexp search search_fs_uuid search_fs_file search_label serial sleep syslinuxcfg test tftp video xfs" ./grub-install --appended-signature-size $SIG_SIZE --modules="$GRUB_MODULES" \ -d ./grub-core/ /dev/sda1 -x linux-signing-certificate.der cp /boot/grub/powerpc-ieee1275/core.elf core.elf truncate -s -$SIG_SIZE core.elf sign-file SHA256 grub-signing.key grub-signing-certificate.der \ core.elf core.elf.signed dd if=core.elf.signed of=/dev/sda1 - Sign your kernel, e.g.: sign-file SHA256 linux-signing.key linux-signing-certificate.der \ /boot/vmlinux /boot/vmlinux.signed - You should now be able to boot with new SLOF and qemu in secure-boot mode. Daniel Axtens (1): ieee1275: link appended-signature enforcement to /ibm,secure-boot grub-core/commands/appendedsig/appendedsig.c | 44 +++++++++++++++----- grub-core/kern/ieee1275/init.c | 26 ++++++++++++ 2 files changed, 60 insertions(+), 10 deletions(-) -- 2.25.1