0038-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch 8.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232
  1. From 8f73052885892bc0dbc01e297f79d7cf4925e491 Mon Sep 17 00:00:00 2001
  2. From: Javier Martinez Canillas <javierm@redhat.com>
  3. Date: Mon, 28 Sep 2020 20:08:33 +0200
  4. Subject: [PATCH] efi: Use grub_is_lockdown() instead of hardcoding a disabled
  5. modules list
  6. Now the GRUB can check if it has been locked down and this can be used to
  7. prevent executing commands that can be utilized to circumvent the UEFI
  8. Secure Boot mechanisms. So, instead of hardcoding a list of modules that
  9. have to be disabled, prevent the usage of commands that can be dangerous.
  10. This not only allows the commands to be disabled on other platforms, but
  11. also properly separate the concerns. Since the shim_lock verifier logic
  12. should be only about preventing to run untrusted binaries and not about
  13. defining these kind of policies.
  14. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
  15. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  16. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  17. ---
  18. docs/grub.texi | 15 +++++++++------
  19. grub-core/commands/i386/wrmsr.c | 5 +++--
  20. grub-core/commands/iorw.c | 19 ++++++++++---------
  21. grub-core/commands/memrw.c | 19 ++++++++++---------
  22. grub-core/kern/efi/sb.c | 41 -----------------------------------------
  23. 5 files changed, 32 insertions(+), 67 deletions(-)
  24. diff --git a/docs/grub.texi b/docs/grub.texi
  25. index bdbb329..bbe60a4 100644
  26. --- a/docs/grub.texi
  27. +++ b/docs/grub.texi
  28. @@ -5256,6 +5256,9 @@ only applies to the particular cpu/core/thread that runs the command.
  29. Also, if you specify a reserved or unimplemented MSR address, it will
  30. cause a general protection exception (which is not currently being handled)
  31. and the system will reboot.
  32. +
  33. +Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
  34. + This is done to prevent subverting various security mechanisms.
  35. @end deffn
  36. @node xen_hypervisor
  37. @@ -5752,12 +5755,12 @@ boot and the shim. This functionality is provided by the shim_lock verifier. It
  38. is built into the @file{core.img} and is registered if the UEFI secure boot is
  39. enabled.
  40. -All modules not stored in the @file{core.img} and the ACPI tables for the
  41. -@command{acpi} command have to be signed, e.g. using PGP. Additionally, the
  42. -@command{iorw}, the @command{memrw} and the @command{wrmsr} commands are
  43. -prohibited if the UEFI secure boot is enabled. This is done due to
  44. -security reasons. All above mentioned requirements are enforced by the
  45. -shim_lock verifier logic.
  46. +All GRUB modules not stored in the @file{core.img}, OS kernels, ACPI tables,
  47. +Device Trees, etc. have to be signed, e.g, using PGP. Additionally, the commands
  48. +that can be used to subvert the UEFI secure boot mechanism, such as @command{iorw}
  49. +and @command{memrw} will not be available when the UEFI secure boot is enabled.
  50. +This is done for security reasons and are enforced by the GRUB Lockdown mechanism
  51. +(@pxref{Lockdown}).
  52. @node Measured Boot
  53. @section Measuring boot components
  54. diff --git a/grub-core/commands/i386/wrmsr.c b/grub-core/commands/i386/wrmsr.c
  55. index 9c5e510..56a29c2 100644
  56. --- a/grub-core/commands/i386/wrmsr.c
  57. +++ b/grub-core/commands/i386/wrmsr.c
  58. @@ -24,6 +24,7 @@
  59. #include <grub/env.h>
  60. #include <grub/command.h>
  61. #include <grub/extcmd.h>
  62. +#include <grub/lockdown.h>
  63. #include <grub/i18n.h>
  64. #include <grub/i386/cpuid.h>
  65. #include <grub/i386/wrmsr.h>
  66. @@ -83,8 +84,8 @@ grub_cmd_msr_write (grub_command_t cmd __attribute__ ((unused)), int argc, char
  67. GRUB_MOD_INIT(wrmsr)
  68. {
  69. - cmd_write = grub_register_command ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"),
  70. - N_("Write a value to a CPU model specific register."));
  71. + cmd_write = grub_register_command_lockdown ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"),
  72. + N_("Write a value to a CPU model specific register."));
  73. }
  74. GRUB_MOD_FINI(wrmsr)
  75. diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
  76. index a0c164e..584baec 100644
  77. --- a/grub-core/commands/iorw.c
  78. +++ b/grub-core/commands/iorw.c
  79. @@ -23,6 +23,7 @@
  80. #include <grub/env.h>
  81. #include <grub/cpu/io.h>
  82. #include <grub/i18n.h>
  83. +#include <grub/lockdown.h>
  84. GRUB_MOD_LICENSE ("GPLv3+");
  85. @@ -131,17 +132,17 @@ GRUB_MOD_INIT(memrw)
  86. N_("PORT"), N_("Read 32-bit value from PORT."),
  87. options);
  88. cmd_write_byte =
  89. - grub_register_command ("outb", grub_cmd_write,
  90. - N_("PORT VALUE [MASK]"),
  91. - N_("Write 8-bit VALUE to PORT."));
  92. + grub_register_command_lockdown ("outb", grub_cmd_write,
  93. + N_("PORT VALUE [MASK]"),
  94. + N_("Write 8-bit VALUE to PORT."));
  95. cmd_write_word =
  96. - grub_register_command ("outw", grub_cmd_write,
  97. - N_("PORT VALUE [MASK]"),
  98. - N_("Write 16-bit VALUE to PORT."));
  99. + grub_register_command_lockdown ("outw", grub_cmd_write,
  100. + N_("PORT VALUE [MASK]"),
  101. + N_("Write 16-bit VALUE to PORT."));
  102. cmd_write_dword =
  103. - grub_register_command ("outl", grub_cmd_write,
  104. - N_("ADDR VALUE [MASK]"),
  105. - N_("Write 32-bit VALUE to PORT."));
  106. + grub_register_command_lockdown ("outl", grub_cmd_write,
  107. + N_("ADDR VALUE [MASK]"),
  108. + N_("Write 32-bit VALUE to PORT."));
  109. }
  110. GRUB_MOD_FINI(memrw)
  111. diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
  112. index 98769ea..d401a6d 100644
  113. --- a/grub-core/commands/memrw.c
  114. +++ b/grub-core/commands/memrw.c
  115. @@ -22,6 +22,7 @@
  116. #include <grub/extcmd.h>
  117. #include <grub/env.h>
  118. #include <grub/i18n.h>
  119. +#include <grub/lockdown.h>
  120. GRUB_MOD_LICENSE ("GPLv3+");
  121. @@ -133,17 +134,17 @@ GRUB_MOD_INIT(memrw)
  122. N_("ADDR"), N_("Read 32-bit value from ADDR."),
  123. options);
  124. cmd_write_byte =
  125. - grub_register_command ("write_byte", grub_cmd_write,
  126. - N_("ADDR VALUE [MASK]"),
  127. - N_("Write 8-bit VALUE to ADDR."));
  128. + grub_register_command_lockdown ("write_byte", grub_cmd_write,
  129. + N_("ADDR VALUE [MASK]"),
  130. + N_("Write 8-bit VALUE to ADDR."));
  131. cmd_write_word =
  132. - grub_register_command ("write_word", grub_cmd_write,
  133. - N_("ADDR VALUE [MASK]"),
  134. - N_("Write 16-bit VALUE to ADDR."));
  135. + grub_register_command_lockdown ("write_word", grub_cmd_write,
  136. + N_("ADDR VALUE [MASK]"),
  137. + N_("Write 16-bit VALUE to ADDR."));
  138. cmd_write_dword =
  139. - grub_register_command ("write_dword", grub_cmd_write,
  140. - N_("ADDR VALUE [MASK]"),
  141. - N_("Write 32-bit VALUE to ADDR."));
  142. + grub_register_command_lockdown ("write_dword", grub_cmd_write,
  143. + N_("ADDR VALUE [MASK]"),
  144. + N_("Write 32-bit VALUE to ADDR."));
  145. }
  146. GRUB_MOD_FINI(memrw)
  147. diff --git a/grub-core/kern/efi/sb.c b/grub-core/kern/efi/sb.c
  148. index ce3b7f6..5d7210a 100644
  149. --- a/grub-core/kern/efi/sb.c
  150. +++ b/grub-core/kern/efi/sb.c
  151. @@ -30,9 +30,6 @@
  152. static grub_efi_guid_t shim_lock_guid = GRUB_EFI_SHIM_LOCK_GUID;
  153. -/* List of modules which cannot be loaded if UEFI secure boot mode is enabled. */
  154. -static const char * const disabled_mods[] = {"iorw", "memrw", NULL};
  155. -
  156. /*
  157. * Determine whether we're in secure boot mode.
  158. *
  159. @@ -121,53 +118,15 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
  160. void **context __attribute__ ((unused)),
  161. enum grub_verify_flags *flags)
  162. {
  163. - const char *b, *e;
  164. - int i;
  165. -
  166. *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
  167. switch (type & GRUB_FILE_TYPE_MASK)
  168. {
  169. - case GRUB_FILE_TYPE_GRUB_MODULE:
  170. - /* Establish GRUB module name. */
  171. - b = grub_strrchr (io->name, '/');
  172. - e = grub_strrchr (io->name, '.');
  173. -
  174. - b = b ? (b + 1) : io->name;
  175. - e = e ? e : io->name + grub_strlen (io->name);
  176. - e = (e > b) ? e : io->name + grub_strlen (io->name);
  177. -
  178. - for (i = 0; disabled_mods[i]; i++)
  179. - if (!grub_strncmp (b, disabled_mods[i], grub_strlen (b) - grub_strlen (e)))
  180. - {
  181. - grub_error (GRUB_ERR_ACCESS_DENIED,
  182. - N_("module cannot be loaded in UEFI secure boot mode: %s"),
  183. - io->name);
  184. - return GRUB_ERR_ACCESS_DENIED;
  185. - }
  186. -
  187. - /* Fall through. */
  188. -
  189. - case GRUB_FILE_TYPE_ACPI_TABLE:
  190. - case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE:
  191. - *flags = GRUB_VERIFY_FLAGS_DEFER_AUTH;
  192. -
  193. - return GRUB_ERR_NONE;
  194. -
  195. case GRUB_FILE_TYPE_LINUX_KERNEL:
  196. case GRUB_FILE_TYPE_MULTIBOOT_KERNEL:
  197. case GRUB_FILE_TYPE_BSD_KERNEL:
  198. case GRUB_FILE_TYPE_XNU_KERNEL:
  199. case GRUB_FILE_TYPE_PLAN9_KERNEL:
  200. - for (i = 0; disabled_mods[i]; i++)
  201. - if (grub_dl_get (disabled_mods[i]))
  202. - {
  203. - grub_error (GRUB_ERR_ACCESS_DENIED,
  204. - N_("cannot boot due to dangerous module in memory: %s"),
  205. - disabled_mods[i]);
  206. - return GRUB_ERR_ACCESS_DENIED;
  207. - }
  208. -
  209. *flags = GRUB_VERIFY_FLAGS_SINGLE_CHUNK;
  210. /* Fall through. */
  211. --
  212. 2.14.2