eficonfig_sbkey.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Menu-driven UEFI Secure Boot Key Maintenance
  4. *
  5. * Copyright (c) 2022 Masahisa Kojima, Linaro Limited
  6. */
  7. #include <ansi.h>
  8. #include <common.h>
  9. #include <charset.h>
  10. #include <hexdump.h>
  11. #include <log.h>
  12. #include <malloc.h>
  13. #include <menu.h>
  14. #include <efi_loader.h>
  15. #include <efi_config.h>
  16. #include <efi_variable.h>
  17. #include <crypto/pkcs7_parser.h>
  18. struct eficonfig_sig_data {
  19. struct efi_signature_list *esl;
  20. struct efi_signature_data *esd;
  21. struct list_head list;
  22. u16 *varname;
  23. };
  24. enum efi_sbkey_signature_type {
  25. SIG_TYPE_X509 = 0,
  26. SIG_TYPE_HASH,
  27. SIG_TYPE_CRL,
  28. SIG_TYPE_RSA2048,
  29. };
  30. struct eficonfig_sigtype_to_str {
  31. efi_guid_t sig_type;
  32. char *str;
  33. enum efi_sbkey_signature_type type;
  34. };
  35. static const struct eficonfig_sigtype_to_str sigtype_to_str[] = {
  36. {EFI_CERT_X509_GUID, "X509", SIG_TYPE_X509},
  37. {EFI_CERT_SHA256_GUID, "SHA256", SIG_TYPE_HASH},
  38. {EFI_CERT_X509_SHA256_GUID, "X509_SHA256 CRL", SIG_TYPE_CRL},
  39. {EFI_CERT_X509_SHA384_GUID, "X509_SHA384 CRL", SIG_TYPE_CRL},
  40. {EFI_CERT_X509_SHA512_GUID, "X509_SHA512 CRL", SIG_TYPE_CRL},
  41. /* U-Boot does not support the following signature types */
  42. /* {EFI_CERT_RSA2048_GUID, "RSA2048", SIG_TYPE_RSA2048}, */
  43. /* {EFI_CERT_RSA2048_SHA256_GUID, "RSA2048_SHA256", SIG_TYPE_RSA2048}, */
  44. /* {EFI_CERT_SHA1_GUID, "SHA1", SIG_TYPE_HASH}, */
  45. /* {EFI_CERT_RSA2048_SHA_GUID, "RSA2048_SHA", SIG_TYPE_RSA2048 }, */
  46. /* {EFI_CERT_SHA224_GUID, "SHA224", SIG_TYPE_HASH}, */
  47. /* {EFI_CERT_SHA384_GUID, "SHA384", SIG_TYPE_HASH}, */
  48. /* {EFI_CERT_SHA512_GUID, "SHA512", SIG_TYPE_HASH}, */
  49. };
  50. /**
  51. * file_have_auth_header() - check file has EFI_VARIABLE_AUTHENTICATION_2 header
  52. * @buf: pointer to file
  53. * @size: file size
  54. * Return: true if file has auth header, false otherwise
  55. */
  56. static bool file_have_auth_header(void *buf, efi_uintn_t size)
  57. {
  58. struct efi_variable_authentication_2 *auth = buf;
  59. if (auth->auth_info.hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID)
  60. return false;
  61. if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
  62. return false;
  63. return true;
  64. }
  65. /**
  66. * file_is_null_key() - check the file is an authenticated and signed null key
  67. *
  68. * @auth: pointer to the file
  69. * @size: file size
  70. * @null_key: pointer to store the result
  71. * Return: status code
  72. */
  73. static efi_status_t file_is_null_key(struct efi_variable_authentication_2 *auth,
  74. efi_uintn_t size, bool *null_key)
  75. {
  76. efi_uintn_t auth_size =
  77. sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
  78. if (size < auth_size)
  79. return EFI_INVALID_PARAMETER;
  80. *null_key = (size == auth_size);
  81. return EFI_SUCCESS;
  82. }
  83. /**
  84. * eficonfig_process_enroll_key() - enroll key into signature database
  85. *
  86. * @data: pointer to the data for each entry
  87. * Return: status code
  88. */
  89. static efi_status_t eficonfig_process_enroll_key(void *data)
  90. {
  91. u32 attr;
  92. char *buf = NULL;
  93. efi_uintn_t size;
  94. efi_status_t ret;
  95. bool null_key = false;
  96. struct efi_file_handle *f = NULL;
  97. struct efi_device_path *full_dp = NULL;
  98. struct eficonfig_select_file_info file_info;
  99. file_info.current_path = calloc(1, EFICONFIG_FILE_PATH_BUF_SIZE);
  100. if (!file_info.current_path) {
  101. ret = EFI_OUT_OF_RESOURCES;
  102. goto out;
  103. }
  104. ret = eficonfig_process_select_file(&file_info);
  105. if (ret != EFI_SUCCESS)
  106. goto out;
  107. full_dp = eficonfig_create_device_path(file_info.dp_volume, file_info.current_path);
  108. if (!full_dp) {
  109. ret = EFI_OUT_OF_RESOURCES;
  110. goto out;
  111. }
  112. f = efi_file_from_path(full_dp);
  113. if (!f) {
  114. ret = EFI_NOT_FOUND;
  115. goto out;
  116. }
  117. size = 0;
  118. ret = EFI_CALL(f->getinfo(f, &efi_file_info_guid, &size, NULL));
  119. if (ret != EFI_BUFFER_TOO_SMALL)
  120. goto out;
  121. buf = malloc(size);
  122. if (!buf) {
  123. ret = EFI_OUT_OF_RESOURCES;
  124. goto out;
  125. }
  126. ret = EFI_CALL(f->getinfo(f, &efi_file_info_guid, &size, buf));
  127. if (ret != EFI_SUCCESS)
  128. goto out;
  129. size = ((struct efi_file_info *)buf)->file_size;
  130. free(buf);
  131. if (!size) {
  132. eficonfig_print_msg("ERROR! File is empty.");
  133. ret = EFI_INVALID_PARAMETER;
  134. goto out;
  135. }
  136. buf = malloc(size);
  137. if (!buf) {
  138. ret = EFI_OUT_OF_RESOURCES;
  139. goto out;
  140. }
  141. ret = EFI_CALL(f->read(f, &size, buf));
  142. if (ret != EFI_SUCCESS) {
  143. eficonfig_print_msg("ERROR! Failed to read file.");
  144. goto out;
  145. }
  146. if (!file_have_auth_header(buf, size)) {
  147. eficonfig_print_msg("ERROR! Invalid file format. Only .auth variables is allowed.");
  148. ret = EFI_INVALID_PARAMETER;
  149. goto out;
  150. }
  151. ret = file_is_null_key((struct efi_variable_authentication_2 *)buf,
  152. size, &null_key);
  153. if (ret != EFI_SUCCESS) {
  154. eficonfig_print_msg("ERROR! Invalid file format.");
  155. goto out;
  156. }
  157. attr = EFI_VARIABLE_NON_VOLATILE |
  158. EFI_VARIABLE_BOOTSERVICE_ACCESS |
  159. EFI_VARIABLE_RUNTIME_ACCESS |
  160. EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
  161. /*
  162. * PK can enroll only one certificate.
  163. * The signed null key is used to clear KEK, db and dbx.
  164. * EFI_VARIABLE_APPEND_WRITE attribute must not be set in these cases.
  165. */
  166. if (u16_strcmp(data, u"PK") && !null_key) {
  167. efi_uintn_t db_size = 0;
  168. /* check the variable exists. If exists, add APPEND_WRITE attribute */
  169. ret = efi_get_variable_int(data, efi_auth_var_get_guid(data), NULL,
  170. &db_size, NULL, NULL);
  171. if (ret == EFI_BUFFER_TOO_SMALL)
  172. attr |= EFI_VARIABLE_APPEND_WRITE;
  173. }
  174. ret = efi_set_variable_int((u16 *)data, efi_auth_var_get_guid((u16 *)data),
  175. attr, size, buf, false);
  176. if (ret != EFI_SUCCESS)
  177. eficonfig_print_msg("ERROR! Failed to update signature database");
  178. out:
  179. free(file_info.current_path);
  180. free(buf);
  181. efi_free_pool(full_dp);
  182. if (f)
  183. EFI_CALL(f->close(f));
  184. /* return to the parent menu */
  185. ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
  186. return ret;
  187. }
  188. /**
  189. * eficonfig_process_show_siglist() - show signature list content
  190. *
  191. * @data: pointer to the data for each entry
  192. * Return: status code
  193. */
  194. static efi_status_t eficonfig_process_show_siglist(void *data)
  195. {
  196. u32 i;
  197. struct eficonfig_sig_data *sg = data;
  198. puts(ANSI_CURSOR_HIDE);
  199. puts(ANSI_CLEAR_CONSOLE);
  200. printf(ANSI_CURSOR_POSITION, 1, 1);
  201. printf("\n ** Show Signature Database (%ls) **\n\n"
  202. " Owner GUID:\n"
  203. " %pUL\n",
  204. sg->varname, sg->esd->signature_owner.b);
  205. for (i = 0; i < ARRAY_SIZE(sigtype_to_str); i++) {
  206. if (!guidcmp(&sg->esl->signature_type, &sigtype_to_str[i].sig_type)) {
  207. printf(" Signature Type:\n"
  208. " %s\n", sigtype_to_str[i].str);
  209. switch (sigtype_to_str[i].type) {
  210. case SIG_TYPE_X509:
  211. {
  212. struct x509_certificate *cert_tmp;
  213. cert_tmp = x509_cert_parse(sg->esd->signature_data,
  214. sg->esl->signature_size);
  215. printf(" Subject:\n"
  216. " %s\n"
  217. " Issuer:\n"
  218. " %s\n",
  219. cert_tmp->subject, cert_tmp->issuer);
  220. break;
  221. }
  222. case SIG_TYPE_CRL:
  223. {
  224. u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t) -
  225. sizeof(struct efi_time);
  226. struct efi_time *time =
  227. (struct efi_time *)((u8 *)sg->esd->signature_data +
  228. hash_size);
  229. printf(" ToBeSignedHash:\n");
  230. print_hex_dump(" ", DUMP_PREFIX_NONE, 16, 1,
  231. sg->esd->signature_data, hash_size, false);
  232. printf(" TimeOfRevocation:\n"
  233. " %d-%d-%d %02d:%02d:%02d\n",
  234. time->year, time->month, time->day,
  235. time->hour, time->minute, time->second);
  236. break;
  237. }
  238. case SIG_TYPE_HASH:
  239. {
  240. u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t);
  241. printf(" Hash:\n");
  242. print_hex_dump(" ", DUMP_PREFIX_NONE, 16, 1,
  243. sg->esd->signature_data, hash_size, false);
  244. break;
  245. }
  246. default:
  247. eficonfig_print_msg("ERROR! Unsupported format.");
  248. return EFI_INVALID_PARAMETER;
  249. }
  250. }
  251. }
  252. while (tstc())
  253. getchar();
  254. printf("\n\n Press any key to continue");
  255. getchar();
  256. return EFI_SUCCESS;
  257. }
  258. /**
  259. * prepare_signature_list_menu() - create the signature list menu entry
  260. *
  261. * @efimenu: pointer to the efimenu structure
  262. * @varname: pointer to the variable name
  263. * @db: pointer to the variable raw data
  264. * @db_size: variable data size
  265. * @func: callback of each entry
  266. * Return: status code
  267. */
  268. static efi_status_t prepare_signature_list_menu(struct efimenu *efi_menu, void *varname,
  269. void *db, efi_uintn_t db_size,
  270. eficonfig_entry_func func)
  271. {
  272. u32 num = 0;
  273. efi_uintn_t size;
  274. struct eficonfig_sig_data *sg;
  275. struct efi_signature_list *esl;
  276. struct efi_signature_data *esd;
  277. efi_status_t ret = EFI_SUCCESS;
  278. INIT_LIST_HEAD(&efi_menu->list);
  279. esl = db;
  280. size = db_size;
  281. while (size > 0) {
  282. u32 remain;
  283. esd = (struct efi_signature_data *)((u8 *)esl +
  284. (sizeof(struct efi_signature_list) +
  285. esl->signature_header_size));
  286. remain = esl->signature_list_size - sizeof(struct efi_signature_list) -
  287. esl->signature_header_size;
  288. for (; remain > 0; remain -= esl->signature_size) {
  289. char buf[37];
  290. char *title;
  291. if (num >= EFICONFIG_ENTRY_NUM_MAX - 1) {
  292. ret = EFI_OUT_OF_RESOURCES;
  293. goto out;
  294. }
  295. sg = calloc(1, sizeof(struct eficonfig_sig_data));
  296. if (!sg) {
  297. ret = EFI_OUT_OF_RESOURCES;
  298. goto err;
  299. }
  300. snprintf(buf, sizeof(buf), "%pUL", &esd->signature_owner);
  301. title = strdup(buf);
  302. if (!title) {
  303. free(sg);
  304. ret = EFI_OUT_OF_RESOURCES;
  305. goto err;
  306. }
  307. sg->esl = esl;
  308. sg->esd = esd;
  309. sg->varname = varname;
  310. ret = eficonfig_append_menu_entry(efi_menu, title, func, sg);
  311. if (ret != EFI_SUCCESS) {
  312. free(sg);
  313. free(title);
  314. goto err;
  315. }
  316. esd = (struct efi_signature_data *)((u8 *)esd + esl->signature_size);
  317. num++;
  318. }
  319. size -= esl->signature_list_size;
  320. esl = (struct efi_signature_list *)((u8 *)esl + esl->signature_list_size);
  321. }
  322. out:
  323. ret = eficonfig_append_quit_entry(efi_menu);
  324. err:
  325. return ret;
  326. }
  327. /**
  328. * enumerate_and_show_signature_database() - enumerate and show the signature database
  329. *
  330. * @data: pointer to the data for each entry
  331. * Return: status code
  332. */
  333. static efi_status_t enumerate_and_show_signature_database(void *varname)
  334. {
  335. void *db;
  336. char buf[50];
  337. efi_status_t ret;
  338. efi_uintn_t db_size;
  339. struct efimenu *efi_menu;
  340. struct list_head *pos, *n;
  341. struct eficonfig_entry *entry;
  342. db = efi_get_var(varname, efi_auth_var_get_guid(varname), &db_size);
  343. if (!db) {
  344. eficonfig_print_msg("There is no entry in the signature database.");
  345. return EFI_NOT_FOUND;
  346. }
  347. efi_menu = calloc(1, sizeof(struct efimenu));
  348. if (!efi_menu) {
  349. free(db);
  350. return EFI_OUT_OF_RESOURCES;
  351. }
  352. ret = prepare_signature_list_menu(efi_menu, varname, db, db_size,
  353. eficonfig_process_show_siglist);
  354. if (ret != EFI_SUCCESS)
  355. goto out;
  356. snprintf(buf, sizeof(buf), " ** Show Signature Database (%ls) **", (u16 *)varname);
  357. ret = eficonfig_process_common(efi_menu, buf, eficonfig_menu_desc,
  358. eficonfig_display_statusline,
  359. eficonfig_print_entry,
  360. eficonfig_choice_entry);
  361. out:
  362. list_for_each_safe(pos, n, &efi_menu->list) {
  363. entry = list_entry(pos, struct eficonfig_entry, list);
  364. free(entry->data);
  365. }
  366. eficonfig_destroy(efi_menu);
  367. free(db);
  368. return ret;
  369. }
  370. /**
  371. * eficonfig_process_show_signature_database() - process show signature database
  372. *
  373. * @data: pointer to the data for each entry
  374. * Return: status code
  375. */
  376. static efi_status_t eficonfig_process_show_signature_database(void *data)
  377. {
  378. efi_status_t ret;
  379. while (1) {
  380. ret = enumerate_and_show_signature_database(data);
  381. if (ret != EFI_SUCCESS && ret != EFI_NOT_READY)
  382. break;
  383. }
  384. /* return to the parent menu */
  385. ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
  386. return ret;
  387. }
  388. static struct eficonfig_item key_config_menu_items[] = {
  389. {"Enroll New Key", eficonfig_process_enroll_key},
  390. {"Show Signature Database", eficonfig_process_show_signature_database},
  391. {"Quit", eficonfig_process_quit},
  392. };
  393. /**
  394. * eficonfig_process_set_secure_boot_key() - display the key configuration menu
  395. *
  396. * @data: pointer to the data for each entry
  397. * Return: status code
  398. */
  399. static efi_status_t eficonfig_process_set_secure_boot_key(void *data)
  400. {
  401. u32 i;
  402. efi_status_t ret;
  403. char header_str[32];
  404. struct efimenu *efi_menu;
  405. for (i = 0; i < ARRAY_SIZE(key_config_menu_items); i++)
  406. key_config_menu_items[i].data = data;
  407. snprintf(header_str, sizeof(header_str), " ** Configure %ls **", (u16 *)data);
  408. while (1) {
  409. efi_menu = eficonfig_create_fixed_menu(key_config_menu_items,
  410. ARRAY_SIZE(key_config_menu_items));
  411. ret = eficonfig_process_common(efi_menu, header_str,
  412. eficonfig_menu_desc,
  413. eficonfig_display_statusline,
  414. eficonfig_print_entry,
  415. eficonfig_choice_entry);
  416. eficonfig_destroy(efi_menu);
  417. if (ret == EFI_ABORTED)
  418. break;
  419. }
  420. /* return to the parent menu */
  421. ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
  422. return ret;
  423. }
  424. static const struct eficonfig_item secure_boot_menu_items[] = {
  425. {"PK", eficonfig_process_set_secure_boot_key, u"PK"},
  426. {"KEK", eficonfig_process_set_secure_boot_key, u"KEK"},
  427. {"db", eficonfig_process_set_secure_boot_key, u"db"},
  428. {"dbx", eficonfig_process_set_secure_boot_key, u"dbx"},
  429. {"Quit", eficonfig_process_quit},
  430. };
  431. /**
  432. * eficonfig_process_secure_boot_config() - display the key list menu
  433. *
  434. * @data: pointer to the data for each entry
  435. * Return: status code
  436. */
  437. efi_status_t eficonfig_process_secure_boot_config(void *data)
  438. {
  439. efi_status_t ret;
  440. struct efimenu *efi_menu;
  441. while (1) {
  442. char header_str[64];
  443. snprintf(header_str, sizeof(header_str),
  444. " ** UEFI Secure Boot Key Configuration (SecureBoot : %s) **",
  445. (efi_secure_boot_enabled() ? "ON" : "OFF"));
  446. efi_menu = eficonfig_create_fixed_menu(secure_boot_menu_items,
  447. ARRAY_SIZE(secure_boot_menu_items));
  448. if (!efi_menu) {
  449. ret = EFI_OUT_OF_RESOURCES;
  450. break;
  451. }
  452. ret = eficonfig_process_common(efi_menu, header_str,
  453. eficonfig_menu_desc,
  454. eficonfig_display_statusline,
  455. eficonfig_print_entry,
  456. eficonfig_choice_entry);
  457. eficonfig_destroy(efi_menu);
  458. if (ret == EFI_ABORTED)
  459. break;
  460. }
  461. /* return to the parent menu */
  462. ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
  463. return ret;
  464. }