|
 |
b1bcb2 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b1bcb2 |
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
b1bcb2 |
Date: Mon, 28 Sep 2020 20:08:33 +0200
|
|
|
b1bcb2 |
Subject: [PATCH] efi: Use grub_is_lockdown() instead of hardcoding a disabled
|
|
|
b1bcb2 |
modules list
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Now the GRUB can check if it has been locked down and this can be used to
|
|
|
b1bcb2 |
prevent executing commands that can be utilized to circumvent the UEFI
|
|
|
b1bcb2 |
Secure Boot mechanisms. So, instead of hardcoding a list of modules that
|
|
|
b1bcb2 |
have to be disabled, prevent the usage of commands that can be dangerous.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
This not only allows the commands to be disabled on other platforms, but
|
|
|
b1bcb2 |
also properly separate the concerns. Since the shim_lock verifier logic
|
|
|
b1bcb2 |
should be only about preventing to run untrusted binaries and not about
|
|
|
b1bcb2 |
defining these kind of policies.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
b1bcb2 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b1bcb2 |
---
|
|
|
b1bcb2 |
grub-core/commands/iorw.c | 26 ++++++++++----------------
|
|
|
b1bcb2 |
grub-core/commands/memrw.c | 26 ++++++++++----------------
|
|
|
b1bcb2 |
2 files changed, 20 insertions(+), 32 deletions(-)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
|
|
|
b1bcb2 |
index 41a7f3f0466..584baec8f91 100644
|
|
|
b1bcb2 |
--- a/grub-core/commands/iorw.c
|
|
|
b1bcb2 |
+++ b/grub-core/commands/iorw.c
|
|
|
b1bcb2 |
@@ -23,7 +23,7 @@
|
|
|
b1bcb2 |
#include <grub/env.h>
|
|
|
b1bcb2 |
#include <grub/cpu/io.h>
|
|
|
b1bcb2 |
#include <grub/i18n.h>
|
|
|
b1bcb2 |
-#include <grub/efi/sb.h>
|
|
|
b1bcb2 |
+#include <grub/lockdown.h>
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
@@ -119,9 +119,6 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
GRUB_MOD_INIT(memrw)
|
|
|
b1bcb2 |
{
|
|
|
b1bcb2 |
- if (grub_efi_secure_boot())
|
|
|
b1bcb2 |
- return;
|
|
|
b1bcb2 |
-
|
|
|
b1bcb2 |
cmd_read_byte =
|
|
|
b1bcb2 |
grub_register_extcmd ("inb", grub_cmd_read, 0,
|
|
|
b1bcb2 |
N_("PORT"), N_("Read 8-bit value from PORT."),
|
|
|
b1bcb2 |
@@ -135,24 +132,21 @@ GRUB_MOD_INIT(memrw)
|
|
|
b1bcb2 |
N_("PORT"), N_("Read 32-bit value from PORT."),
|
|
|
b1bcb2 |
options);
|
|
|
b1bcb2 |
cmd_write_byte =
|
|
|
b1bcb2 |
- grub_register_command ("outb", grub_cmd_write,
|
|
|
b1bcb2 |
- N_("PORT VALUE [MASK]"),
|
|
|
b1bcb2 |
- N_("Write 8-bit VALUE to PORT."));
|
|
|
b1bcb2 |
+ grub_register_command_lockdown ("outb", grub_cmd_write,
|
|
|
b1bcb2 |
+ N_("PORT VALUE [MASK]"),
|
|
|
b1bcb2 |
+ N_("Write 8-bit VALUE to PORT."));
|
|
|
b1bcb2 |
cmd_write_word =
|
|
|
b1bcb2 |
- grub_register_command ("outw", grub_cmd_write,
|
|
|
b1bcb2 |
- N_("PORT VALUE [MASK]"),
|
|
|
b1bcb2 |
- N_("Write 16-bit VALUE to PORT."));
|
|
|
b1bcb2 |
+ grub_register_command_lockdown ("outw", grub_cmd_write,
|
|
|
b1bcb2 |
+ N_("PORT VALUE [MASK]"),
|
|
|
b1bcb2 |
+ N_("Write 16-bit VALUE to PORT."));
|
|
|
b1bcb2 |
cmd_write_dword =
|
|
|
b1bcb2 |
- grub_register_command ("outl", grub_cmd_write,
|
|
|
b1bcb2 |
- N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
- N_("Write 32-bit VALUE to PORT."));
|
|
|
b1bcb2 |
+ grub_register_command_lockdown ("outl", grub_cmd_write,
|
|
|
b1bcb2 |
+ N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
+ N_("Write 32-bit VALUE to PORT."));
|
|
|
b1bcb2 |
}
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
GRUB_MOD_FINI(memrw)
|
|
|
b1bcb2 |
{
|
|
|
b1bcb2 |
- if (grub_efi_secure_boot())
|
|
|
b1bcb2 |
- return;
|
|
|
b1bcb2 |
-
|
|
|
b1bcb2 |
grub_unregister_extcmd (cmd_read_byte);
|
|
|
b1bcb2 |
grub_unregister_extcmd (cmd_read_word);
|
|
|
b1bcb2 |
grub_unregister_extcmd (cmd_read_dword);
|
|
|
b1bcb2 |
diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
|
|
|
b1bcb2 |
index 088cbe9e2bc..d401a6db0ef 100644
|
|
|
b1bcb2 |
--- a/grub-core/commands/memrw.c
|
|
|
b1bcb2 |
+++ b/grub-core/commands/memrw.c
|
|
|
b1bcb2 |
@@ -22,7 +22,7 @@
|
|
|
b1bcb2 |
#include <grub/extcmd.h>
|
|
|
b1bcb2 |
#include <grub/env.h>
|
|
|
b1bcb2 |
#include <grub/i18n.h>
|
|
|
b1bcb2 |
-#include <grub/efi/sb.h>
|
|
|
b1bcb2 |
+#include <grub/lockdown.h>
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
@@ -121,9 +121,6 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
GRUB_MOD_INIT(memrw)
|
|
|
b1bcb2 |
{
|
|
|
b1bcb2 |
- if (grub_efi_secure_boot())
|
|
|
b1bcb2 |
- return;
|
|
|
b1bcb2 |
-
|
|
|
b1bcb2 |
cmd_read_byte =
|
|
|
b1bcb2 |
grub_register_extcmd ("read_byte", grub_cmd_read, 0,
|
|
|
b1bcb2 |
N_("ADDR"), N_("Read 8-bit value from ADDR."),
|
|
|
b1bcb2 |
@@ -137,24 +134,21 @@ GRUB_MOD_INIT(memrw)
|
|
|
b1bcb2 |
N_("ADDR"), N_("Read 32-bit value from ADDR."),
|
|
|
b1bcb2 |
options);
|
|
|
b1bcb2 |
cmd_write_byte =
|
|
|
b1bcb2 |
- grub_register_command ("write_byte", grub_cmd_write,
|
|
|
b1bcb2 |
- N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
- N_("Write 8-bit VALUE to ADDR."));
|
|
|
b1bcb2 |
+ grub_register_command_lockdown ("write_byte", grub_cmd_write,
|
|
|
b1bcb2 |
+ N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
+ N_("Write 8-bit VALUE to ADDR."));
|
|
|
b1bcb2 |
cmd_write_word =
|
|
|
b1bcb2 |
- grub_register_command ("write_word", grub_cmd_write,
|
|
|
b1bcb2 |
- N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
- N_("Write 16-bit VALUE to ADDR."));
|
|
|
b1bcb2 |
+ grub_register_command_lockdown ("write_word", grub_cmd_write,
|
|
|
b1bcb2 |
+ N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
+ N_("Write 16-bit VALUE to ADDR."));
|
|
|
b1bcb2 |
cmd_write_dword =
|
|
|
b1bcb2 |
- grub_register_command ("write_dword", grub_cmd_write,
|
|
|
b1bcb2 |
- N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
- N_("Write 32-bit VALUE to ADDR."));
|
|
|
b1bcb2 |
+ grub_register_command_lockdown ("write_dword", grub_cmd_write,
|
|
|
b1bcb2 |
+ N_("ADDR VALUE [MASK]"),
|
|
|
b1bcb2 |
+ N_("Write 32-bit VALUE to ADDR."));
|
|
|
b1bcb2 |
}
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
GRUB_MOD_FINI(memrw)
|
|
|
b1bcb2 |
{
|
|
|
b1bcb2 |
- if (grub_efi_secure_boot())
|
|
|
b1bcb2 |
- return;
|
|
|
b1bcb2 |
-
|
|
|
b1bcb2 |
grub_unregister_extcmd (cmd_read_byte);
|
|
|
b1bcb2 |
grub_unregister_extcmd (cmd_read_word);
|
|
|
b1bcb2 |
grub_unregister_extcmd (cmd_read_dword);
|