diff options
| -rw-r--r-- | efi-lockdown.patch | 716 |
1 files changed, 20 insertions, 696 deletions
diff --git a/efi-lockdown.patch b/efi-lockdown.patch index 6bbc24fa1..dcdd2e99a 100644 --- a/efi-lockdown.patch +++ b/efi-lockdown.patch @@ -1,666 +1,3 @@ -From d1d5053106cd1f8b2ae52fb6ffb2962f76053bf0 Mon Sep 17 00:00:00 2001 -From: Ard Biesheuvel <ard.biesheuvel@linaro.org> -Date: Wed, 23 Nov 2016 10:42:44 +0000 -Subject: [PATCH 01/32] efi: use typed function pointers for runtime services - table - -Instead of using void pointers, and casting them to correctly typed -function pointers upon use, declare the runtime services pointers -as function pointers using their respective prototypes, for which -typedefs are already available. - -Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - include/linux/efi.h | 36 ++++++++++++++++++------------------ - 1 file changed, 18 insertions(+), 18 deletions(-) - -diff --git a/include/linux/efi.h b/include/linux/efi.h -index a07a476..93a82de 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -508,24 +508,6 @@ typedef struct { - u64 query_variable_info; - } efi_runtime_services_64_t; - --typedef struct { -- efi_table_hdr_t hdr; -- void *get_time; -- void *set_time; -- void *get_wakeup_time; -- void *set_wakeup_time; -- void *set_virtual_address_map; -- void *convert_pointer; -- void *get_variable; -- void *get_next_variable; -- void *set_variable; -- void *get_next_high_mono_count; -- void *reset_system; -- void *update_capsule; -- void *query_capsule_caps; -- void *query_variable_info; --} efi_runtime_services_t; -- - typedef efi_status_t efi_get_time_t (efi_time_t *tm, efi_time_cap_t *tc); - typedef efi_status_t efi_set_time_t (efi_time_t *tm); - typedef efi_status_t efi_get_wakeup_time_t (efi_bool_t *enabled, efi_bool_t *pending, -@@ -560,6 +542,24 @@ typedef efi_status_t efi_query_variable_store_t(u32 attributes, - unsigned long size, - bool nonblocking); - -+typedef struct { -+ efi_table_hdr_t hdr; -+ efi_get_time_t *get_time; -+ efi_set_time_t *set_time; -+ efi_get_wakeup_time_t *get_wakeup_time; -+ efi_set_wakeup_time_t *set_wakeup_time; -+ efi_set_virtual_address_map_t *set_virtual_address_map; -+ void *convert_pointer; -+ efi_get_variable_t *get_variable; -+ efi_get_next_variable_t *get_next_variable; -+ efi_set_variable_t *set_variable; -+ efi_get_next_high_mono_count_t *get_next_high_mono_count; -+ efi_reset_system_t *reset_system; -+ efi_update_capsule_t *update_capsule; -+ efi_query_capsule_caps_t *query_capsule_caps; -+ efi_query_variable_info_t *query_variable_info; -+} efi_runtime_services_t; -+ - void efi_native_runtime_setup(void); - - /* --- -2.9.3 - -From 150ebd38630a3ac558b8ab839a7c7e5fd41cc5a8 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Mon, 21 Nov 2016 23:36:31 +0000 -Subject: [PATCH 02/32] x86/efi: Allow invocation of arbitrary runtime services - -Provide the ability to perform mixed-mode runtime service calls for x86 in -the same way that commit 0a637ee61247bd4bed9b2a07568ef7a1cfc76187 -("x86/efi: Allow invocation of arbitrary boot services") provides the -ability to invoke arbitrary boot services. - -Suggested-by: Lukas Wunner <lukas@wunner.de> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - arch/x86/boot/compressed/eboot.c | 1 + - arch/x86/boot/compressed/head_32.S | 6 +++--- - arch/x86/boot/compressed/head_64.S | 8 ++++---- - arch/x86/include/asm/efi.h | 5 +++++ - 4 files changed, 13 insertions(+), 7 deletions(-) - -diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index ff01c8f..c8c32eb 100644 ---- a/arch/x86/boot/compressed/eboot.c -+++ b/arch/x86/boot/compressed/eboot.c -@@ -32,6 +32,7 @@ static void setup_boot_services##bits(struct efi_config *c) \ - \ - table = (typeof(table))sys_table; \ - \ -+ c->runtime_services = table->runtime; \ - c->boot_services = table->boottime; \ - c->text_output = table->con_out; \ - } -diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S -index fd0b6a2..d85b962 100644 ---- a/arch/x86/boot/compressed/head_32.S -+++ b/arch/x86/boot/compressed/head_32.S -@@ -82,7 +82,7 @@ ENTRY(efi_pe_entry) - - /* Relocate efi_config->call() */ - leal efi32_config(%esi), %eax -- add %esi, 32(%eax) -+ add %esi, 40(%eax) - pushl %eax - - call make_boot_params -@@ -108,7 +108,7 @@ ENTRY(efi32_stub_entry) - - /* Relocate efi_config->call() */ - leal efi32_config(%esi), %eax -- add %esi, 32(%eax) -+ add %esi, 40(%eax) - pushl %eax - 2: - call efi_main -@@ -264,7 +264,7 @@ relocated: - #ifdef CONFIG_EFI_STUB - .data - efi32_config: -- .fill 4,8,0 -+ .fill 5,8,0 - .long efi_call_phys - .long 0 - .byte 0 -diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S -index efdfba2..beab832 100644 ---- a/arch/x86/boot/compressed/head_64.S -+++ b/arch/x86/boot/compressed/head_64.S -@@ -265,7 +265,7 @@ ENTRY(efi_pe_entry) - /* - * Relocate efi_config->call(). - */ -- addq %rbp, efi64_config+32(%rip) -+ addq %rbp, efi64_config+40(%rip) - - movq %rax, %rdi - call make_boot_params -@@ -285,7 +285,7 @@ handover_entry: - * Relocate efi_config->call(). - */ - movq efi_config(%rip), %rax -- addq %rbp, 32(%rax) -+ addq %rbp, 40(%rax) - 2: - movq efi_config(%rip), %rdi - call efi_main -@@ -457,14 +457,14 @@ efi_config: - #ifdef CONFIG_EFI_MIXED - .global efi32_config - efi32_config: -- .fill 4,8,0 -+ .fill 5,8,0 - .quad efi64_thunk - .byte 0 - #endif - - .global efi64_config - efi64_config: -- .fill 4,8,0 -+ .fill 5,8,0 - .quad efi_call - .byte 1 - #endif /* CONFIG_EFI_STUB */ -diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h -index e99675b..2f77bce 100644 ---- a/arch/x86/include/asm/efi.h -+++ b/arch/x86/include/asm/efi.h -@@ -191,6 +191,7 @@ static inline efi_status_t efi_thunk_set_virtual_address_map( - struct efi_config { - u64 image_handle; - u64 table; -+ u64 runtime_services; - u64 boot_services; - u64 text_output; - efi_status_t (*call)(unsigned long, ...); -@@ -226,6 +227,10 @@ static inline bool efi_is_64bit(void) - #define __efi_call_early(f, ...) \ - __efi_early()->call((unsigned long)f, __VA_ARGS__); - -+#define efi_call_runtime(f, ...) \ -+ __efi_early()->call(efi_table_attr(efi_runtime_services, f, \ -+ __efi_early()->runtime_services), __VA_ARGS__) -+ - extern bool efi_reboot_required(void); - - #else --- -2.9.3 - -From 1342301133b5619b79f3288acf7e39450f8ba34f Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Tue, 22 Nov 2016 00:20:00 +0000 -Subject: [PATCH 03/32] arm/efi: Allow invocation of arbitrary runtime services - -efi_call_runtime() is provided for x86 to be able abstract mixed mode -support. Provide this for ARM also so that common code work in mixed mode -also. - -Suggested-by: Lukas Wunner <lukas@wunner.de> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - arch/arm/include/asm/efi.h | 1 + - arch/arm64/include/asm/efi.h | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/arch/arm/include/asm/efi.h b/arch/arm/include/asm/efi.h -index 0b06f53..e4e6a9d6 100644 ---- a/arch/arm/include/asm/efi.h -+++ b/arch/arm/include/asm/efi.h -@@ -55,6 +55,7 @@ void efi_virtmap_unload(void); - - #define efi_call_early(f, ...) sys_table_arg->boottime->f(__VA_ARGS__) - #define __efi_call_early(f, ...) f(__VA_ARGS__) -+#define efi_call_runtime(f, ...) sys_table_arg->runtime->f(__VA_ARGS__) - #define efi_is_64bit() (false) - - #define efi_call_proto(protocol, f, instance, ...) \ -diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h -index 771b3f0..d74ae22 100644 ---- a/arch/arm64/include/asm/efi.h -+++ b/arch/arm64/include/asm/efi.h -@@ -49,6 +49,7 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md); - - #define efi_call_early(f, ...) sys_table_arg->boottime->f(__VA_ARGS__) - #define __efi_call_early(f, ...) f(__VA_ARGS__) -+#define efi_call_runtime(f, ...) sys_table_arg->runtime->f(__VA_ARGS__) - #define efi_is_64bit() (true) - - #define efi_call_proto(protocol, f, instance, ...) \ --- -2.9.3 - -From 2e25c5beef2a97abbb660e707bced77c0eb0ace9 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Tue, 22 Nov 2016 00:10:55 +0000 -Subject: [PATCH 04/32] efi: Add SHIM and image security database GUID - definitions - -Add the definitions for shim and image security database, both of which -are used widely in various Linux distros. - -Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> -Signed-off-by: David Howells <dhowells@redhat.com> -Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> ---- - include/linux/efi.h | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 93a82de..c790455 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -610,6 +610,9 @@ void efi_native_runtime_setup(void); - #define EFI_CONSOLE_OUT_DEVICE_GUID EFI_GUID(0xd3b36f2c, 0xd551, 0x11d4, 0x9a, 0x46, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d) - #define APPLE_PROPERTIES_PROTOCOL_GUID EFI_GUID(0x91bd12fe, 0xf6c3, 0x44fb, 0xa5, 0xb7, 0x51, 0x22, 0xab, 0x30, 0x3a, 0xe0) - -+#define EFI_IMAGE_SECURITY_DATABASE_GUID EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f) -+#define EFI_SHIM_LOCK_GUID EFI_GUID(0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23) -+ - /* - * This GUID is used to pass to the kernel proper the struct screen_info - * structure that was populated by the stub based on the GOP protocol instance --- -2.9.3 - -From 820d2f84670080c406bad4c8469e80e1e5f8a191 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 05/32] efi: Get the secure boot status - -Get the firmware's secure-boot status in the kernel boot wrapper and stash -it somewhere that the main kernel image can find. - -The efi_get_secureboot() function is extracted from the arm stub and (a) -generalised so that it can be called from x86 and (b) made to use -efi_call_runtime() so that it can be run in mixed-mode. - -Suggested-by: Lukas Wunner <lukas@wunner.de> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - Documentation/x86/zero-page.txt | 2 + - arch/x86/boot/compressed/eboot.c | 2 + - arch/x86/boot/compressed/head_32.S | 1 + - arch/x86/boot/compressed/head_64.S | 1 + - arch/x86/include/asm/bootparam_utils.h | 5 ++- - arch/x86/include/uapi/asm/bootparam.h | 3 +- - arch/x86/kernel/asm-offsets.c | 1 + - drivers/firmware/efi/libstub/Makefile | 2 +- - drivers/firmware/efi/libstub/arm-stub.c | 58 ++------------------------- - drivers/firmware/efi/libstub/secureboot.c | 66 +++++++++++++++++++++++++++++++ - include/linux/efi.h | 8 ++++ - 11 files changed, 90 insertions(+), 59 deletions(-) - create mode 100644 drivers/firmware/efi/libstub/secureboot.c - -diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt -index 95a4d34..b8527c6 100644 ---- a/Documentation/x86/zero-page.txt -+++ b/Documentation/x86/zero-page.txt -@@ -31,6 +31,8 @@ Offset Proto Name Meaning - 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below) - 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer - (below) -+1EB/001 ALL kbd_status Numlock is enabled -+1EC/001 ALL secure_boot Secure boot is enabled in the firmware - 1EF/001 ALL sentinel Used to detect broken bootloaders - 290/040 ALL edd_mbr_sig_buffer EDD MBR signatures - 2D0/A00 ALL e820_map E820 memory map table -diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index c8c32eb..5b151c2 100644 ---- a/arch/x86/boot/compressed/eboot.c -+++ b/arch/x86/boot/compressed/eboot.c -@@ -1158,6 +1158,8 @@ struct boot_params *efi_main(struct efi_config *c, - else - setup_boot_services32(efi_early); - -+ boot_params->secure_boot = efi_get_secureboot(sys_table); -+ - setup_graphics(boot_params); - - setup_efi_pci(boot_params); -diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S -index d85b962..c635f7e 100644 ---- a/arch/x86/boot/compressed/head_32.S -+++ b/arch/x86/boot/compressed/head_32.S -@@ -61,6 +61,7 @@ - - __HEAD - ENTRY(startup_32) -+ movb $0, BP_secure_boot(%esi) - #ifdef CONFIG_EFI_STUB - jmp preferred_addr - -diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S -index beab832..ccd2c74 100644 ---- a/arch/x86/boot/compressed/head_64.S -+++ b/arch/x86/boot/compressed/head_64.S -@@ -244,6 +244,7 @@ ENTRY(startup_64) - * that maps our entire kernel(text+data+bss+brk), zero page - * and command line. - */ -+ movb $0, BP_secure_boot(%rsi) - #ifdef CONFIG_EFI_STUB - /* - * The entry point for the PE/COFF executable is efi_pe_entry, so -diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h -index 4a8cb8d..7e16d53 100644 ---- a/arch/x86/include/asm/bootparam_utils.h -+++ b/arch/x86/include/asm/bootparam_utils.h -@@ -38,9 +38,10 @@ static void sanitize_boot_params(struct boot_params *boot_params) - memset(&boot_params->ext_ramdisk_image, 0, - (char *)&boot_params->efi_info - - (char *)&boot_params->ext_ramdisk_image); -- memset(&boot_params->kbd_status, 0, -+ boot_params->kbd_status = 0; -+ memset(&boot_params->_pad5, 0, - (char *)&boot_params->hdr - -- (char *)&boot_params->kbd_status); -+ (char *)&boot_params->_pad5); - memset(&boot_params->_pad7[0], 0, - (char *)&boot_params->edd_mbr_sig_buffer[0] - - (char *)&boot_params->_pad7[0]); -diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h -index b10bf31..5138dac 100644 ---- a/arch/x86/include/uapi/asm/bootparam.h -+++ b/arch/x86/include/uapi/asm/bootparam.h -@@ -135,7 +135,8 @@ struct boot_params { - __u8 eddbuf_entries; /* 0x1e9 */ - __u8 edd_mbr_sig_buf_entries; /* 0x1ea */ - __u8 kbd_status; /* 0x1eb */ -- __u8 _pad5[3]; /* 0x1ec */ -+ __u8 secure_boot; /* 0x1ec */ -+ __u8 _pad5[2]; /* 0x1ed */ - /* - * The sentinel is set to a nonzero value (0xff) in header.S. - * -diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c -index c62e015..de827d6 100644 ---- a/arch/x86/kernel/asm-offsets.c -+++ b/arch/x86/kernel/asm-offsets.c -@@ -81,6 +81,7 @@ void common(void) { - - BLANK(); - OFFSET(BP_scratch, boot_params, scratch); -+ OFFSET(BP_secure_boot, boot_params, secure_boot); - OFFSET(BP_loadflags, boot_params, hdr.loadflags); - OFFSET(BP_hardware_subarch, boot_params, hdr.hardware_subarch); - OFFSET(BP_version, boot_params, hdr.version); -diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile -index 6621b13..9af9668 100644 ---- a/drivers/firmware/efi/libstub/Makefile -+++ b/drivers/firmware/efi/libstub/Makefile -@@ -28,7 +28,7 @@ OBJECT_FILES_NON_STANDARD := y - # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in. - KCOV_INSTRUMENT := n - --lib-y := efi-stub-helper.o gop.o -+lib-y := efi-stub-helper.o gop.o secureboot.o - - # include the stub's generic dependencies from lib/ when building for ARM/arm64 - arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c sort.c -diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c -index b4f7d78..06d5034 100644 ---- a/drivers/firmware/efi/libstub/arm-stub.c -+++ b/drivers/firmware/efi/libstub/arm-stub.c -@@ -20,52 +20,6 @@ - - bool __nokaslr; - --static int efi_get_secureboot(efi_system_table_t *sys_table_arg) --{ -- static efi_char16_t const sb_var_name[] = { -- 'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 }; -- static efi_char16_t const sm_var_name[] = { -- 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 }; -- -- efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID; -- efi_get_variable_t *f_getvar = sys_table_arg->runtime->get_variable; -- u8 val; -- unsigned long size = sizeof(val); -- efi_status_t status; -- -- status = f_getvar((efi_char16_t *)sb_var_name, (efi_guid_t *)&var_guid, -- NULL, &size, &val); -- -- if (status != EFI_SUCCESS) -- goto out_efi_err; -- -- if (val == 0) -- return 0; -- -- status = f_getvar((efi_char16_t *)sm_var_name, (efi_guid_t *)&var_guid, -- NULL, &size, &val); -- -- if (status != EFI_SUCCESS) -- goto out_efi_err; -- -- if (val == 1) -- return 0; -- -- return 1; -- --out_efi_err: -- switch (status) { -- case EFI_NOT_FOUND: -- return 0; -- case EFI_DEVICE_ERROR: -- return -EIO; -- case EFI_SECURITY_VIOLATION: -- return -EACCES; -- default: -- return -EINVAL; -- } --} -- - efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg, - void *__image, void **__fh) - { -@@ -226,7 +180,7 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table, - efi_guid_t loaded_image_proto = LOADED_IMAGE_PROTOCOL_GUID; - unsigned long reserve_addr = 0; - unsigned long reserve_size = 0; -- int secure_boot = 0; -+ enum efi_secureboot_mode secure_boot = efi_secureboot_mode_unknown; - struct screen_info *si; - - /* Check if we were booted by the EFI firmware */ -@@ -296,19 +250,13 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table, - pr_efi_err(sys_table, "Failed to parse EFI cmdline options\n"); - - secure_boot = efi_get_secureboot(sys_table); -- if (secure_boot > 0) -- pr_efi(sys_table, "UEFI Secure Boot is enabled.\n"); -- -- if (secure_boot < 0) { -- pr_efi_err(sys_table, -- "could not determine UEFI Secure Boot status.\n"); -- } - - /* - * Unauthenticated device tree data is a security hazard, so - * ignore 'dtb=' unless UEFI Secure Boot is disabled. - */ -- if (secure_boot != 0 && strstr(cmdline_ptr, "dtb=")) { -+ if (secure_boot != efi_secureboot_mode_disabled && -+ strstr(cmdline_ptr, "dtb=")) { - pr_efi(sys_table, "Ignoring DTB from command line.\n"); - } else { - status = handle_cmdline_files(sys_table, image, cmdline_ptr, -diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c -new file mode 100644 -index 0000000..70e2a36 ---- /dev/null -+++ b/drivers/firmware/efi/libstub/secureboot.c -@@ -0,0 +1,66 @@ -+/* -+ * Secure boot handling. -+ * -+ * Copyright (C) 2013,2014 Linaro Limited -+ * Roy Franz <roy.franz@linaro.org -+ * Copyright (C) 2013 Red Hat, Inc. -+ * Mark Salter <msalter@redhat.com> -+ * -+ * This file is part of the Linux kernel, and is made available under the -+ * terms of the GNU General Public License version 2. -+ * -+ */ -+ -+#include <linux/efi.h> -+#include <asm/efi.h> -+ -+/* BIOS variables */ -+static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID; -+static const efi_char16_t const efi_SecureBoot_name[] = { -+ 'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 -+}; -+static const efi_char16_t const efi_SetupMode_name[] = { -+ 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 -+}; -+ -+#define get_efi_var(name, vendor, ...) \ -+ efi_call_runtime(get_variable, \ -+ (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ -+ __VA_ARGS__); -+ -+/* -+ * Determine whether we're in secure boot mode. We return: -+ */ -+enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) -+{ -+ u8 secboot, setupmode; -+ unsigned long size; -+ efi_status_t status; -+ -+ size = sizeof(secboot); -+ status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, -+ NULL, &size, &secboot); -+ if (status != EFI_SUCCESS) -+ goto out_efi_err; -+ -+ size = sizeof(setupmode); -+ status = get_efi_var(efi_SetupMode_name, &efi_variable_guid, -+ NULL, &size, &setupmode); -+ if (status != EFI_SUCCESS) -+ goto out_efi_err; -+ -+ if (secboot == 0 || setupmode == 1) -+ goto secure_boot_disabled; -+ -+ pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); -+ return efi_secureboot_mode_enabled; -+ -+secure_boot_disabled: -+ return efi_secureboot_mode_disabled; -+ -+out_efi_err: -+ pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); -+ if (status == EFI_NOT_FOUND) -+ goto secure_boot_disabled; -+ return efi_secureboot_mode_unknown; -+} -diff --git a/include/linux/efi.h b/include/linux/efi.h -index c790455..92e23f0 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -1477,6 +1477,14 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg, - bool efi_runtime_disabled(void); - extern void efi_call_virt_check_flags(unsigned long flags, const char *call); - -+enum efi_secureboot_mode { -+ efi_secureboot_mode_unset, -+ efi_secureboot_mode_unknown, -+ efi_secureboot_mode_disabled, -+ efi_secureboot_mode_enabled, -+}; -+enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table); -+ - /* - * Arch code can implement the following three template macros, avoiding - * reptition for the void/non-void return cases of {__,}efi_call_virt(): --- -2.9.3 - -From baa6cdc01e6017c6bd798b1af89458359e13155e Mon Sep 17 00:00:00 2001 -From: Josh Boyer <jwboyer@fedoraproject.org> -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 06/32] efi: Disable secure boot if shim is in insecure mode - -A user can manually tell the shim boot loader to disable validation of -images it loads. When a user does this, it creates a UEFI variable called -MokSBState that does not have the runtime attribute set. Given that the -user explicitly disabled validation, we can honor that and not enable -secure boot mode if that variable is set. - -Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - drivers/firmware/efi/libstub/secureboot.c | 24 +++++++++++++++++++++++- - 1 file changed, 23 insertions(+), 1 deletion(-) - -diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c -index 70e2a36..ba6ef71 100644 ---- a/drivers/firmware/efi/libstub/secureboot.c -+++ b/drivers/firmware/efi/libstub/secureboot.c -@@ -23,6 +23,12 @@ static const efi_char16_t const efi_SetupMode_name[] = { - 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 - }; - -+/* SHIM variables */ -+static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; -+static efi_char16_t const shim_MokSBState_name[] = { -+ 'M', 'o', 'k', 'S', 'B', 'S', 't', 'a', 't', 'e', 0 -+}; -+ - #define get_efi_var(name, vendor, ...) \ - efi_call_runtime(get_variable, \ - (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ -@@ -33,7 +39,8 @@ static const efi_char16_t const efi_SetupMode_name[] = { - */ - enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) - { -- u8 secboot, setupmode; -+ u32 attr; -+ u8 secboot, setupmode, moksbstate; - unsigned long size; - efi_status_t status; - -@@ -52,6 +59,21 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) - if (secboot == 0 || setupmode == 1) - goto secure_boot_disabled; - -+ /* See if a user has put shim into insecure mode. If so, and if the -+ * variable doesn't have the runtime attribute set, we might as well -+ * honor that. -+ */ -+ size = sizeof(moksbstate); -+ status = get_efi_var(shim_MokSBState_name, &shim_guid, -+ &attr, &size, &moksbstate); -+ -+ /* If it fails, we don't care why. Default to secure */ -+ if (status != EFI_SUCCESS) -+ goto secure_boot_enabled; -+ if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1) -+ goto secure_boot_disabled; -+ -+secure_boot_enabled: - pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); - return efi_secureboot_mode_enabled; - --- -2.9.3 - From 9079547f4808ea5c8cd844bf40d3895994bd175e Mon Sep 17 00:00:00 2001 From: Josh Boyer <jwboyer@fedoraproject.org> Date: Mon, 21 Nov 2016 23:55:55 +0000 @@ -681,40 +18,26 @@ Signed-off-by: David Howells <dhowells@redhat.com> 2 files changed, 16 insertions(+) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 9c337b0..d8972ec 100644 +index 69780ed..447905e 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1152,6 +1152,21 @@ void __init setup_arch(char **cmdline_p) - /* Allocate bigger log buffer */ - setup_log_buf(1); - -+ if (IS_ENABLED(CONFIG_EFI)) { -+ switch (boot_params.secure_boot) { -+ case efi_secureboot_mode_disabled: -+ pr_info("Secure boot disabled\n"); -+ break; -+ case efi_secureboot_mode_enabled: +@@ -1182,6 +1182,7 @@ void __init setup_arch(char **cmdline_p) + pr_info("Secure boot disabled\n"); + break; + case efi_secureboot_mode_enabled: + set_bit(EFI_SECURE_BOOT, &efi.flags); -+ pr_info("Secure boot enabled\n"); -+ break; -+ default: -+ pr_info("Secure boot could not be determined\n"); -+ break; -+ } -+ } -+ - reserve_initrd(); - - acpi_table_upgrade(); + pr_info("Secure boot enabled\n"); + break; + default: diff --git a/include/linux/efi.h b/include/linux/efi.h -index 92e23f0..135ca9c 100644 +index 94d34e0..6049600 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -1066,6 +1066,7 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_ARCH_1 7 /* First arch-specific bit */ +@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *); #define EFI_DBG 8 /* Print additional debug info at runtime */ #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ -+#define EFI_SECURE_BOOT 10 /* Are we in Secure Boot mode? */ + #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ ++#define EFI_SECURE_BOOT 11 /* Are we in Secure Boot mode? */ #ifdef CONFIG_EFI /* @@ -759,9 +82,9 @@ index ba6ef71..333b159 100644 unsigned long size; efi_status_t status; -@@ -59,6 +62,17 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) +@@ -57,6 +57,17 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) if (secboot == 0 || setupmode == 1) - goto secure_boot_disabled; + return efi_secureboot_mode_disabled; + /* UEFI-2.6 requires DeployedMode to be 1. */ + if (sys_table_arg->hdr.revision >= EFI_2_60_SYSTEM_TABLE_REVISION) { @@ -771,10 +94,11 @@ index ba6ef71..333b159 100644 + if (status != EFI_SUCCESS) + goto out_efi_err; + if (deployedmode == 0) -+ goto secure_boot_disabled; ++ return efi_secureboot_mode_disabled; + } + - /* See if a user has put shim into insecure mode. If so, and if the + /* + * See if a user has put the shim into insecure mode. If so, and if the * variable doesn't have the runtime attribute set, we might as well * honor that. diff --git a/include/linux/efi.h b/include/linux/efi.h @@ -1979,9 +1303,9 @@ index 5b151c2..5093a76 100644 + /* Ask the firmware to clear memory if we don't have a clean shutdown */ + enable_reset_attack_mitigation(); + - boot_params->secure_boot = efi_get_secureboot(sys_table); - - setup_graphics(boot_params); + /* + * If the boot loader gave us a value for secure_boot then we use that, + * otherwise we ask the BIOS. -- 2.9.3 |