[PATCH v8 15/20] appended signatures: Read default db keys from the ELF Note

[Sudhakar Kuppusamy <sudhakar@linux.ibm.com>]

If Secure Boot is enabled with dynamic key management mode and the
use_static_keys flag is set, then read the static keys as a db default
keys from the ELF Note and add them into the db.

Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
---
 grub-core/commands/appendedsig/appendedsig.c | 42 ++++++++++++++------
 1 file changed, 30 insertions(+), 12 deletions(-)

diff --git a/grub-core/commands/appendedsig/appendedsig.c b/grub-core/commands/appendedsig/appendedsig.c
index b6cd9af32..146017867 100644
--- a/grub-core/commands/appendedsig/appendedsig.c
+++ b/grub-core/commands/appendedsig/appendedsig.c
@@ -1200,7 +1200,8 @@ build_static_db_list (void)
   grub_err_t err;
   struct grub_module_header *header;
   struct grub_file pseudo_file;
-  struct x509_certificate *cert;
+  grub_uint8_t *cert_data = NULL;
+  grub_size_t cert_data_size = 0;
 
   FOR_MODULES (header)
     {
@@ -1216,22 +1217,25 @@ build_static_db_list (void)
       grub_dprintf ("appendedsig", "found an X.509 certificate, size=%" PRIuGRUB_UINT64_T "\n",
                     pseudo_file.size);
 
-      err = read_cert_from_file (&pseudo_file, &cert);
+      err = file_read_whole (&pseudo_file, &cert_data, &cert_data_size);
       if (err == GRUB_ERR_OUT_OF_MEMORY)
-        return;
+        break;
       else if (err != GRUB_ERR_NONE)
+        continue;
+
+      if (grub_pks_use_keystore == true)
         {
-          grub_dprintf ("appendedsig",
-                        "warning: cannot add a certificate %u to the db list\n",
-                        db.cert_entries + 1);
-          continue;
+          if (is_dbx_cert_hash (cert_data, cert_data_size) == true)
+            {
+              grub_free (cert_data);
+              continue;
+            }
         }
 
-      grub_dprintf ("appendedsig", "add a certificate CN='%s' to db\n", cert->subject);
-
-      cert->next = db.certs;
-      db.certs = cert;
-      db.cert_entries++;
+      err = add_certificate (cert_data, cert_data_size, &db, true);
+      grub_free (cert_data);
+      if (err == GRUB_ERR_OUT_OF_MEMORY)
+        break;
     }
 }
 
@@ -1248,6 +1252,20 @@ build_pks_keystore (void)
   if (err != GRUB_ERR_NONE)
     grub_printf ("warning: db list might not be fully populated\n");
 
+  if (grub_pks_keystore.use_static_keys == true)
+    {
+      grub_dprintf ("appendedsig", "db variable is not available at PKS and "
+                    "using a static keys as a default key in db list\n");
+    }
+
+  build_static_db_list ();
+  if (grub_pks_keystore.use_static_keys == false)
+    {
+      err = create_db_list ();
+      if (err != GRUB_ERR_NONE)
+        grub_dprintf ("appendedsig", "warning: db list might not be fully populated\n");
+    }
+
   err = create_dbx_list ();
   if (err != GRUB_ERR_NONE)
     grub_printf ("warning: dbx list might not be fully populated\n");
-- 
2.39.5 (Apple Git-154)


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel