From 29c89e27805f7a6a22bce11ed9bb430e19c972a9 Mon Sep 17 00:00:00 2001

From: Colin Watson <cjwatson@ubuntu.com>

Date: Tue, 23 Oct 2012 10:40:49 -0400

Subject: [PATCH 449/482] Don't allow insmod when secure boot is enabled.

Hi,

Fedora's patch to forbid insmod in UEFI Secure Boot environments is fine

as far as it goes.  However, the insmod command is not the only way that

modules can be loaded.  In particular, the 'normal' command, which

implements the usual GRUB menu and the fully-featured command prompt,

will implicitly load commands not currently loaded into memory.  This

permits trivial Secure Boot violations by writing commands implementing

whatever you want to do and pointing $prefix at the malicious code.

I'm currently test-building this patch (replacing your current

grub-2.00-no-insmod-on-sb.patch), but this should be more correct.  It

moves the check into grub_dl_load_file.

---

 grub-core/kern/dl.c      | 17 +++++++++++++++++

 grub-core/kern/efi/efi.c | 28 ++++++++++++++++++++++++++++

 include/grub/efi/efi.h   |  1 +

 3 files changed, 46 insertions(+)

diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c

index 6c086ad..5521463 100644

--- a/grub-core/kern/dl.c

+++ b/grub-core/kern/dl.c

@@ -42,6 +42,10 @@

 #include <sys/mman.h>

 #endif

+#ifdef GRUB_MACHINE_EFI

+#include <grub/efi/efi.h>

+#endif

+

 #pragma GCC diagnostic ignored "-Wcast-align"

@@ -665,6 +669,19 @@ grub_dl_load_file (const char *filename)

   void *core = 0;

   grub_dl_t mod = 0;

+#ifdef GRUB_MACHINE_EFI

+  if (grub_efi_secure_boot ())

+    {

+#if 0

+      /* This is an error, but grub2-mkconfig still generates a pile of

+       * insmod commands, so emitting it would be mostly just obnoxious. */

+      grub_error (GRUB_ERR_ACCESS_DENIED,

+		  "Secure Boot forbids loading module from %s", filename);

+#endif

+      return 0;

+    }

+#endif

+

   file = grub_file_open (filename);

   if (! file)

     return 0;

diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c

index e8a62ec..0f513e8 100644

--- a/grub-core/kern/efi/efi.c

+++ b/grub-core/kern/efi/efi.c

@@ -259,6 +259,34 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,

   return NULL;

 }

+grub_efi_boolean_t

+grub_efi_secure_boot (void)

+{

+  grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;

+  grub_size_t datasize;

+  char *secure_boot = NULL;

+  char *setup_mode = NULL;

+  grub_efi_boolean_t ret = 0;

+

+  secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);

+

+  if (datasize != 1 || !secure_boot)

+    goto out;

+

+  setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);

+

+  if (datasize != 1 || !setup_mode)

+    goto out;

+

+  if (*secure_boot && !*setup_mode)

+    ret = 1;

+

+ out:

+  grub_free (secure_boot);

+  grub_free (setup_mode);

+  return ret;

+}

+

 #pragma GCC diagnostic ignored "-Wcast-align"

 /* Search the mods section from the PE32/PE32+ image. This code uses

diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h

index 9370fd5..a000c38 100644

--- a/include/grub/efi/efi.h

+++ b/include/grub/efi/efi.h

@@ -72,6 +72,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,

 				     const grub_efi_guid_t *guid,

 				     void *data,

 				     grub_size_t datasize);

+grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);

 int

 EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,

 					     const grub_efi_device_path_t *dp2);

-- 

1.8.2.1