From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1kQAJv-0006Zp-Qe for mharc-grub-devel@gnu.org; Wed, 07 Oct 2020 10:21:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:40168) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kQAJt-0006Yn-6b for grub-devel@gnu.org; Wed, 07 Oct 2020 10:21:29 -0400 Received: from mail-pf1-x443.google.com ([2607:f8b0:4864:20::443]:42601) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kQAJr-0002pg-3c for grub-devel@gnu.org; Wed, 07 Oct 2020 10:21:28 -0400 Received: by mail-pf1-x443.google.com with SMTP id d6so1408826pfn.9 for ; Wed, 07 Oct 2020 07:21:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=DDnNegpms78t7R6M17M7RefIDgk04VlEiT1pMx94JrQ=; b=jRFdN9U0KpQe4wB1NqkHzLlbKs+d8uV6ZkauP12O2jXoIHHL/XQiLv7jcpU8s6493i eYK9oihYvJlSrOW7ykiVeg4Cmze/G4Fr0lkqxIpPZ/en4RcP4g86asCxmbflDoI+yHVz ugVTW/0yhu4tEdZHo3PtydovypXYRMGh8f+iU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=DDnNegpms78t7R6M17M7RefIDgk04VlEiT1pMx94JrQ=; b=ngRV/7hBClXASWXMSfQ33JoYJkOFYFT+/nVIZHw3+YV5j59n39FG1MazLdu6Q9JplK 6J4pVS2MOmDl8cV86rkqb8qxU9poeR/N2FkxFN+ngRNit52Xz5s9LSbEgKB/qa04E6+y nF14VK4VzDH4dzVywNuoSz3kOxuIfiOBL4UAtEl2sVulchyWK9IL0q8HiErBkpWqKELy q1rGutVtwQ/mjOLU+tcyOit4rsiWBPa28GsN4zQqnFe+mFz3ci9lT+2cyEVVqyw+BXcv HMOq8BiPr6Vq3SctKg1OtZQPA9I+5QOvO2IzNbvxe0aLSoKPhlI7AeIvetnCrvXMv7BK 4SQw== X-Gm-Message-State: AOAM531BH1kjKCStbZd/NHSgzyixDUtfcR+JrH0/QsngYX/WYPnBeMN5 Y8etXPrylxZrJE6UiUhAaEBJ2dgiHmRF1A== X-Google-Smtp-Source: ABdhPJzXdc06jED9lozP5/O7c+u6EYWSFA3PO9FD4sCW08BQxTrL/3PKS5FUeyS6b6N13b/G/YyEBA== X-Received: by 2002:aa7:9695:0:b029:154:5bc1:6cf8 with SMTP id f21-20020aa796950000b02901545bc16cf8mr3244420pfk.14.1602080485021; Wed, 07 Oct 2020 07:21:25 -0700 (PDT) Received: from localhost (2001-44b8-111e-5c00-d027-2f4c-df69-d3d5.static.ipv6.internode.on.net. [2001:44b8:111e:5c00:d027:2f4c:df69:d3d5]) by smtp.gmail.com with ESMTPSA id m11sm3382987pfa.69.2020.10.07.07.21.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2020 07:21:24 -0700 (PDT) From: Daniel Axtens To: grub-devel@gnu.org Cc: rashmica.g@gmail.com, alastair@d-silva.org, Daniel Axtens Subject: [PATCH] ieee1275: link appended-signature enforcement to /ibm, secure-boot Date: Thu, 8 Oct 2020 01:21:16 +1100 Message-Id: <20201007142116.43454-2-dja@axtens.net> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20201007142116.43454-1-dja@axtens.net> References: <20201007142116.43454-1-dja@axtens.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::443; envelope-from=dja@axtens.net; helo=mail-pf1-x443.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Oct 2020 14:21:29 -0000 If the 'ibm,secure-boot' property of the root node is 2 or greater, require that the kernel pass appended-signature verification. Do not consider the presence of a certificate to enforce verification. Signed-off-by: Daniel Axtens --- grub-core/commands/appendedsig/appendedsig.c | 44 +++++++++++++++----- grub-core/kern/ieee1275/init.c | 26 ++++++++++++ 2 files changed, 60 insertions(+), 10 deletions(-) diff --git a/grub-core/commands/appendedsig/appendedsig.c b/grub-core/commands/appendedsig/appendedsig.c index 1fbc942254a7..6efe58ce8b2c 100644 --- a/grub-core/commands/appendedsig/appendedsig.c +++ b/grub-core/commands/appendedsig/appendedsig.c @@ -95,10 +95,24 @@ static char * grub_env_write_sec (struct grub_env_var *var __attribute__((unused)), const char *val) { + if (check_sigs == 2) + return grub_strdup ("forced"); check_sigs = (*val == '1') || (*val == 'e'); return grub_strdup (check_sigs ? "enforce" : "no"); } +static const char * +grub_env_read_sec (struct grub_env_var *var __attribute__ ((unused)), + const char *val __attribute__ ((unused))) +{ + if (check_sigs == 2) + return "forced"; + else if (check_sigs == 1) + return "enforce"; + else + return "no"; +} + static grub_err_t read_cert_from_file (grub_file_t f, struct x509_certificate *certificate) { @@ -552,14 +566,20 @@ GRUB_MOD_INIT (appendedsig) val = grub_env_get ("check_appended_signatures"); grub_dprintf ("appendedsig", "check_appended_signatures='%s'\n", val); - if (val && (val[0] == '1' || val[0] == 'e')) - check_sigs = 1; - else - check_sigs = 0; + if (val) + { + if (val[0] == '2' || val[0] == 'f') + check_sigs = 2; + else if (val[0] == '1' || val[0] == 'e') + check_sigs = 1; + else + check_sigs = 0; + } grub_trusted_key = NULL; - grub_register_variable_hook ("check_appended_signatures", 0, + grub_register_variable_hook ("check_appended_signatures", + grub_env_read_sec, grub_env_write_sec); grub_env_export ("check_appended_signatures"); @@ -603,11 +623,15 @@ GRUB_MOD_INIT (appendedsig) grub_trusted_key = pk; } - if (!val || val[0] == '\0') - { - grub_env_set ("check_appended_signatures", - grub_trusted_key ? "enforce" : "no"); - } + /* + * When controlled by ibm,secure-boot, we don't want the presence of + * a certificate to enforce secure boot. + * if (!val || val[0] == '\0') + * { + * grub_env_set ("check_appended_signatures", + * grub_trusted_key ? "enforce" : "no"); + * } + */ cmd_trust = grub_register_command ("trust_certificate", grub_cmd_trust, diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c index fd80eed1a4fa..9c2e2aa0f5a1 100644 --- a/grub-core/kern/ieee1275/init.c +++ b/grub-core/kern/ieee1275/init.c @@ -371,6 +371,30 @@ grub_parse_cmdline (void) } } +static void +grub_get_ieee1275_secure_boot (void) +{ + grub_ieee1275_phandle_t root; + int rc; + grub_uint32_t is_sb; + + grub_ieee1275_finddevice ("/", &root); + + rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", &is_sb, + sizeof (is_sb), 0); + + /* ibm,secure-boot: + * 0 - disabled + * 1 - audit + * 2 - enforce + * 3 - enforce + OS-specific behaviour + * + * We only support enforce. + */ + if (rc >= 0 && is_sb >= 2) + grub_env_set("check_appended_signatures", "forced"); +} + grub_addr_t grub_modbase; void @@ -396,6 +420,8 @@ grub_machine_init (void) #else grub_install_get_time_ms (grub_rtc_get_time_ms); #endif + + grub_get_ieee1275_secure_boot (); } void -- 2.25.1