|
 |
b35c50 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b35c50 |
From: Julian Andres Klode <julian.klode@canonical.com>
|
|
|
b35c50 |
Date: Thu, 2 Dec 2021 15:03:53 +0100
|
|
|
b35c50 |
Subject: [PATCH] kern/efi/sb: Reject non-kernel files in the shim_lock
|
|
|
b35c50 |
verifier
|
|
|
b35c50 |
|
|
|
b35c50 |
We must not allow other verifiers to pass things like the GRUB modules.
|
|
|
b35c50 |
Instead of maintaining a blocklist, maintain an allowlist of things
|
|
|
b35c50 |
that we do not care about.
|
|
|
b35c50 |
|
|
|
b35c50 |
This allowlist really should be made reusable, and shared by the
|
|
|
b35c50 |
lockdown verifier, but this is the minimal patch addressing
|
|
|
b35c50 |
security concerns where the TPM verifier was able to mark modules
|
|
|
b35c50 |
as verified (or the OpenPGP verifier for that matter), when it
|
|
|
b35c50 |
should not do so on shim-powered secure boot systems.
|
|
|
b35c50 |
|
|
|
b35c50 |
Fixes: CVE-2022-28735
|
|
|
b35c50 |
|
|
|
b35c50 |
Signed-off-by: Julian Andres Klode <julian.klode@canonical.com>
|
|
|
b35c50 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b35c50 |
(cherry picked from commit fa61ad69861c1cb3f68bf853d78fae7fd93986a0)
|
|
|
b35c50 |
---
|
|
|
b35c50 |
grub-core/kern/efi/sb.c | 39 ++++++++++++++++++++++++++++++++++++---
|
|
|
b35c50 |
include/grub/verify.h | 1 +
|
|
|
b35c50 |
2 files changed, 37 insertions(+), 3 deletions(-)
|
|
|
b35c50 |
|
|
|
b35c50 |
diff --git a/grub-core/kern/efi/sb.c b/grub-core/kern/efi/sb.c
|
|
|
b35c50 |
index c52ec6226a..89c4bb3fd1 100644
|
|
|
b35c50 |
--- a/grub-core/kern/efi/sb.c
|
|
|
b35c50 |
+++ b/grub-core/kern/efi/sb.c
|
|
|
b35c50 |
@@ -119,10 +119,11 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
|
|
|
b35c50 |
void **context __attribute__ ((unused)),
|
|
|
b35c50 |
enum grub_verify_flags *flags)
|
|
|
b35c50 |
{
|
|
|
b35c50 |
- *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
|
|
|
b35c50 |
+ *flags = GRUB_VERIFY_FLAGS_NONE;
|
|
|
b35c50 |
|
|
|
b35c50 |
switch (type & GRUB_FILE_TYPE_MASK)
|
|
|
b35c50 |
{
|
|
|
b35c50 |
+ /* Files we check. */
|
|
|
b35c50 |
case GRUB_FILE_TYPE_LINUX_KERNEL:
|
|
|
b35c50 |
case GRUB_FILE_TYPE_MULTIBOOT_KERNEL:
|
|
|
b35c50 |
case GRUB_FILE_TYPE_BSD_KERNEL:
|
|
|
b35c50 |
@@ -130,11 +131,43 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
|
|
|
b35c50 |
case GRUB_FILE_TYPE_PLAN9_KERNEL:
|
|
|
b35c50 |
case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE:
|
|
|
b35c50 |
*flags = GRUB_VERIFY_FLAGS_SINGLE_CHUNK;
|
|
|
b35c50 |
+ return GRUB_ERR_NONE;
|
|
|
b35c50 |
|
|
|
b35c50 |
- /* Fall through. */
|
|
|
b35c50 |
+ /* Files that do not affect secureboot state. */
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_NONE:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_LOOPBACK:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_LINUX_INITRD:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_OPENBSD_RAMDISK:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_XNU_RAMDISK:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_SIGNATURE:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_PUBLIC_KEY:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_PUBLIC_KEY_TRUST:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_PRINT_BLOCKLIST:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_TESTLOAD:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_GET_SIZE:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_FONT:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_CAT:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_HEXCAT:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_CMP:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_HASHLIST:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_TO_HASH:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_KEYBOARD_LAYOUT:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_PIXMAP:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_GRUB_MODULE_LIST:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_CONFIG:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_THEME:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_GETTEXT_CATALOG:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_FS_SEARCH:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_LOADENV:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_SAVEENV:
|
|
|
b35c50 |
+ case GRUB_FILE_TYPE_VERIFY_SIGNATURE:
|
|
|
b35c50 |
+ *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
|
|
|
b35c50 |
+ return GRUB_ERR_NONE;
|
|
|
b35c50 |
|
|
|
b35c50 |
+ /* Other files. */
|
|
|
b35c50 |
default:
|
|
|
b35c50 |
- return GRUB_ERR_NONE;
|
|
|
b35c50 |
+ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited by secure boot policy"));
|
|
|
b35c50 |
}
|
|
|
b35c50 |
}
|
|
|
b35c50 |
|
|
|
b35c50 |
diff --git a/include/grub/verify.h b/include/grub/verify.h
|
|
|
b35c50 |
index cd129c398f..672ae16924 100644
|
|
|
b35c50 |
--- a/include/grub/verify.h
|
|
|
b35c50 |
+++ b/include/grub/verify.h
|
|
|
b35c50 |
@@ -24,6 +24,7 @@
|
|
|
b35c50 |
|
|
|
b35c50 |
enum grub_verify_flags
|
|
|
b35c50 |
{
|
|
|
b35c50 |
+ GRUB_VERIFY_FLAGS_NONE = 0,
|
|
|
b35c50 |
GRUB_VERIFY_FLAGS_SKIP_VERIFICATION = 1,
|
|
|
b35c50 |
GRUB_VERIFY_FLAGS_SINGLE_CHUNK = 2,
|
|
|
b35c50 |
/* Defer verification to another authority. */
|