commit ea5f10ba55fce68d1ed614ca33afdb38816f0830

Author: Frank Ch. Eigler <fche@redhat.com>

Date:   Mon Nov 16 18:54:11 2020 -0500

    PR26665: mokutil output parsing tweaks

    We encountered secureboot keys in the wild that didn't live up

    to the expectations of the current little state machine.  Tweaked

    regexps to accept Issuer: O= as well as Issuer: CN= lines.  With

    more verbosity, produces output on parsing process.

diff --git a/session.cxx b/session.cxx

index b5a8044..0437ca4 100644

--- a/session.cxx

+++ b/session.cxx

@@ -2859,6 +2859,9 @@ systemtap_session::get_mok_info()

       // PR26665: but only Systemtap MOK keys; there may be others.

       getline(out, line);

+      if (verbose > 3)

+        clog << "MOK parse state: " << state << " line: " << line << endl;

+      

       if (state == "SHA1") { // look for a new key fingerprint

 	if (! regexp_match(line, "^SHA1 Fingerprint: ([0-9a-f:]+)$", matches))

 	  {

@@ -2871,11 +2874,14 @@ systemtap_session::get_mok_info()

 	  }

 	// else stay in SHA1 state

       } else if (state == "Issuer") { // validate issuer

-	if (! regexp_match(line, "^[ \t]*Issuer: O=(.*)$", matches)) {

+	if (! regexp_match(line, "^[ \t]*Issuer: [A-Z]*=(.*)$", matches)) {

 	  if (verbose > 2)

 	    clog << "Issuer found: " << matches[1] << endl;

-	  if (! regexp_match(matches[1], "Systemtap", matches))

+	  if (! regexp_match(matches[1], "Systemtap", matches)) {

+            if (verbose > 2)

+              clog << "Recognized Systemtap MOK fingerprint: " << fingerprint << endl;

 	    mok_fingerprints.push_back(fingerprint);

+          }

 	  state = "SHA1"; // start looking for another key

 	}

       } else { // some other line in mokutil output ... there are plenty

commit 532eb9a1502026300a7f0b4bd287499101dd5803

Author: Frank Ch. Eigler <fche@redhat.com>

Date:   Tue Nov 17 16:34:59 2020 -0500

    PR26665 detect rhel8 (4.18) era kernel_is_locked_down() as procfs trigger

    A different older kernel API needs to be probed for rhel8 era detection

    of lockdown in effect.  Added an (undocumented) $SYSTEMTAP_NOSIGN env

    var to override automatic --use-server on lockdown, so that one can

    inspect runtime/autoconf* operation locally, without stap-server.

diff --git a/buildrun.cxx b/buildrun.cxx

index 9b4066d..9c8e648 100644

--- a/buildrun.cxx

+++ b/buildrun.cxx

@@ -517,6 +517,7 @@ compile_pass (systemtap_session& s)

   output_autoconf(s, o, cs, "autoconf-atomic_fetch_add_unless.c",

 		  "STAPCONF_ATOMIC_FETCH_ADD_UNLESS", NULL);

   output_autoconf(s, o, cs, "autoconf-lockdown-debugfs.c", "STAPCONF_LOCKDOWN_DEBUGFS", NULL);

+  output_autoconf(s, o, cs, "autoconf-lockdown-kernel.c", "STAPCONF_LOCKDOWN_KERNEL", NULL);

   // used by runtime/linux/netfilter.c

   output_exportconf(s, o2, "nf_register_hook", "STAPCONF_NF_REGISTER_HOOK");

diff --git a/runtime/linux/autoconf-lockdown-kernel.c b/runtime/linux/autoconf-lockdown-kernel.c

new file mode 100644

index 0000000..90c2414

--- /dev/null

+++ b/runtime/linux/autoconf-lockdown-kernel.c

@@ -0,0 +1,5 @@

+#include <linux/kernel.h>

+

+int foo(void) {

+  return kernel_is_locked_down("something");

+}

diff --git a/runtime/transport/transport.c b/runtime/transport/transport.c

index bb4a98b..5795533 100644

--- a/runtime/transport/transport.c

+++ b/runtime/transport/transport.c

@@ -123,6 +123,12 @@ static int _stp_transport_fs_init(const char *module_name)

 		dbug_trans(1, "choosing procfs_p=1\n");

         }

 #endif

+#ifdef STAPCONF_LOCKDOWN_KERNEL

+        if (!debugfs_p && kernel_is_locked_down ("debugfs")) {

+                procfs_p = 1;

+		dbug_trans(1, "choosing procfs_p=1\n");

+        }

+#endif

         if (!procfs_p) {

                 debugfs_p = 1;

 		dbug_trans(1, "choosing debugfs_p=1\n");

diff --git a/session.cxx b/session.cxx

index 0437ca4..36a4053 100644

--- a/session.cxx

+++ b/session.cxx

@@ -2804,7 +2804,9 @@ systemtap_session::modules_must_be_signed()

   if (getenv("SYSTEMTAP_SIGN"))

     return true;

-

+  if (getenv("SYSTEMTAP_NOSIGN"))

+    return false;

+  

   statm >> status;

   if (status == 'Y')

     return true;