From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1kUjcG-0007TO-MO for mharc-grub-devel@gnu.org; Tue, 20 Oct 2020 00:51:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:58560) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kUjcF-0007SJ-0p for grub-devel@gnu.org; Tue, 20 Oct 2020 00:51:19 -0400 Received: from mail-pj1-x102f.google.com ([2607:f8b0:4864:20::102f]:40913) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kUjcC-0006aY-Kn for grub-devel@gnu.org; Tue, 20 Oct 2020 00:51:18 -0400 Received: by mail-pj1-x102f.google.com with SMTP id j8so320089pjy.5 for ; Mon, 19 Oct 2020 21:51:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:in-reply-to:references:date:message-id :mime-version; bh=3TxABqJPXP4V4onxrMnPmn7yqYr/yJbcFbukvQKWW7I=; b=FxKNTzAV+SpByL0jtwmweWU2rplN1IP+5AHUB5KShu3ACdokJNQ8lZmmsPMoqgTH1K ukETZ2uM2Us6WuggozFk4+UIrauGq0AEh0OmfikF+TvIsXl+9vi/zQoUN2oLqLRnNbRw oCa1Q6p9zQqUqj7zFgcUDDLObPqdS0jyXW86c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:in-reply-to:references:date :message-id:mime-version; bh=3TxABqJPXP4V4onxrMnPmn7yqYr/yJbcFbukvQKWW7I=; b=TBcvImxneauafd5ZqJErUSjBUdqTOABvxPgqTw+Dt6wVfjIu+D0d1Y0O78q6/R3ykm lGXH1FlfRJ2yDqBtdTL3BU9uKaphX23+jL0UuOjxE9YeyieMsN//aYWt6dYZmDRfviHU eW28/T3mY4wEV5oN3mauQ930E0HGRovZUEG21zuJWQO4GvnSwAQ4zsXMnvukmJ0LyL/O FU/6OWhnIob+kToa3B5E3TR5/EA7HDYDJyZya9NWyBmD8Cqr7h+6LuIKw6wW1ItDB23l lX4/cOJp3UdkCDY99fIu1YmRTg7EaDKI7trleowT6RZ08u2g9LtbKzfEQ73x6iNdQqAt fi0w== X-Gm-Message-State: AOAM530B8P5m54c+H+mG4kiomXCXbqfDwHtgB0GUW6M7LUA7k7GFosRh pu4v9Vk1hH9rgQ6MqmtL1+o4TA== X-Google-Smtp-Source: ABdhPJw8KAaW9NcTn+5glXX7qEQzdaIdHTaPiOr01Sja2Je9rXEePSo8MvfqhpcaiMmnf1eesjCKvw== X-Received: by 2002:a17:90a:c388:: with SMTP id h8mr1217936pjt.100.1603169475034; Mon, 19 Oct 2020 21:51:15 -0700 (PDT) Received: from localhost (2001-44b8-111e-5c00-15e7-974c-83a1-4605.static.ipv6.internode.on.net. [2001:44b8:111e:5c00:15e7:974c:83a1:4605]) by smtp.gmail.com with ESMTPSA id t5sm444386pgs.74.2020.10.19.21.51.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Oct 2020 21:51:14 -0700 (PDT) From: Daniel Axtens To: Michael Chang , The development of GNU GRUB Cc: rashmica.g@gmail.com, alastair@d-silva.org Subject: Re: [PATCH 3/3] docs/grub: Document signing grub with an appended signature In-Reply-To: <20201020035450.GA14748@mercury> References: <20200821023720.13747-1-dja@axtens.net> <20200821023720.13747-4-dja@axtens.net> <20201020035450.GA14748@mercury> Date: Tue, 20 Oct 2020 15:51:11 +1100 Message-ID: <87sga9v6tc.fsf@dja-thinkpad.axtens.net> MIME-Version: 1.0 Content-Type: text/plain Received-SPF: pass client-ip=2607:f8b0:4864:20::102f; envelope-from=dja@axtens.net; helo=mail-pj1-x102f.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Oct 2020 04:51:19 -0000 Hi Michael, >> +@section Signing GRUB with an appended signature >> + >> +The @file{core.img} itself can be signed with a Linux kernel module-style >> +appended signature. >> + >> +To support IEEE1275 platforms where the boot image is often loaded directly >> +from a disk partition rather than from a file system, the @file{core.img} > > Maybe `core.elf` should be used for embedded image on ieee1275 platform? > The core.img is more pc bios specific IMHO, and hence would be edited > on-the-fly during the grub-install/grub-bios-setup process for keeping > or adding some records, making it not a good example to the proposed > procedure here as the image on filesysetm and partition may differ. Sure, I will change this in v2. >> +can specify the size and location of the appended signature with an ELF >> +note added by @command{grub-install}. >> + >> +An image can be signed this way using the @command{sign-file} command from >> +the Linux kernel: >> + >> +@example >> +@group >> +# grub.key is your private key and certificate.der is your public key >> + >> +# Determine the size of the appended signature. It depends on the signing >> +# certificate and the hash algorithm >> +touch empty >> +sign-file SHA256 grub.key certificate.der empty empty.sig >> +SIG_SIZE=`stat -c '%s' empty.sig` >> +rm empty empty.sig >> + >> +# Build a grub image with $SIG_SIZE reserved for the signature >> +grub-install --appended-signature-size $SIG_SIZE --modules="..." ... >> + >> +# Replace the reserved size with a signature: >> +# cut off the last $SIG_SIZE bytes with truncate's minus modifier >> +truncate -s -$SIG_SIZE /boot/grub/powerpc-ieee1275/core.elf core.elf.unsigned >> +# sign the trimmed file with an appended signature, restoring the correct size >> +sign-file SHA256 grub.key certificate.der core.elf.unsigned core.elf.signed >> + >> +# Don't forget to install the signed image as required >> +# (e.g. on powerpc-ieee1275, to the PReP partition) > > Could you please provide more indication on how to install the signed > image afterwards ? I suppose it is 'dd' for writing the core.elf.signed > to the PReP partition but not really sure that is correct. At the moment, yes, dd. Firmware loads raw bytes off the PReP partition and expects them to be a 32-bit BE ELF binary. Therefore any method that can put raw bytes on disk will work, and dd is the classic tool for the job. I'll improve this for v2 on the basis of how the discussions on Michal's proposal to do away with the ELF note go. > It also looked to me that the entire process can be integrated to > grub-install so the user can get less hassle to setting it up. For that > matters we could work out new grub-install options to accept user's > private key and public key certicate to compose signed image with > appended signature and install it on the fly. Is there anything that > I could have missed here ? We'd need to add a dependency on OpenSSL (or maybe GNUTLS) to grub-install, as there's no support in grub to generate PKCS#7 messages. I don't know if that's acceptable? One of the reasons I didn't go down that road initially is that I imagine that most signed images are going to be signed by distros prior to installation. Maybe grub-mkimage would be a better place to add this feature. I think this is something we'll need to revisit once we resolve the discussion about the ELF note generally. Kind regards, Daniel > > Thanks, > Michael > >> +@end group >> +@end example >> + >> +As with UEFI secure boot, it is necessary to build in the required modules, >> +or sign them separately. >> + >> + >> @node Platform limitations >> @chapter Platform limitations >> >> -- >> 2.25.1 >> >> >> _______________________________________________ >> Grub-devel mailing list >> Grub-devel@gnu.org >> https://lists.gnu.org/mailman/listinfo/grub-devel