Blame SOURCES/0197-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch

5593c8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
5593c8
From: Daniel Axtens <dja@axtens.net>
5593c8
Date: Mon, 28 Sep 2020 11:11:17 +1000
5593c8
Subject: [PATCH] ieee1275: enter lockdown based on /ibm,secure-boot
5593c8
5593c8
If the 'ibm,secure-boot' property of the root node is 2 or greater,
5593c8
enter lockdown.
5593c8
5593c8
Signed-off-by: Daniel Axtens <dja@axtens.net>
5593c8
---
5593c8
 grub-core/Makefile.core.def    |  1 +
5593c8
 grub-core/kern/ieee1275/init.c | 27 +++++++++++++++++++++++++++
5593c8
 include/grub/lockdown.h        |  3 ++-
5593c8
 docs/grub.texi                 |  4 ++--
5593c8
 4 files changed, 32 insertions(+), 3 deletions(-)
5593c8
5593c8
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
1c6ba0
index 6bddc841b8..3f3459b2c7 100644
5593c8
--- a/grub-core/Makefile.core.def
5593c8
+++ b/grub-core/Makefile.core.def
5593c8
@@ -323,6 +323,7 @@ kernel = {
5593c8
   powerpc_ieee1275 = kern/powerpc/cache.S;
5593c8
   powerpc_ieee1275 = kern/powerpc/dl.c;
5593c8
   powerpc_ieee1275 = kern/powerpc/compiler-rt.S;
5593c8
+  powerpc_ieee1275 = kern/lockdown.c;
5593c8
 
5593c8
   sparc64_ieee1275 = kern/sparc64/cache.S;
5593c8
   sparc64_ieee1275 = kern/sparc64/dl.c;
5593c8
diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
1c6ba0
index 937c1bc44c..fc7d971272 100644
5593c8
--- a/grub-core/kern/ieee1275/init.c
5593c8
+++ b/grub-core/kern/ieee1275/init.c
5593c8
@@ -44,6 +44,7 @@
5593c8
 #ifdef __sparc__
5593c8
 #include <grub/machine/kernel.h>
5593c8
 #endif
5593c8
+#include <grub/lockdown.h>
5593c8
 
5593c8
 /* The minimal heap size we can live with. */
5593c8
 #define HEAP_MIN_SIZE		(unsigned long) (2 * 1024 * 1024)
5593c8
@@ -271,6 +272,30 @@ grub_parse_cmdline (void)
5593c8
     }
5593c8
 }
5593c8
 
5593c8
+static void
5593c8
+grub_get_ieee1275_secure_boot (void)
5593c8
+{
5593c8
+  grub_ieee1275_phandle_t root;
5593c8
+  int rc;
5593c8
+  grub_uint32_t is_sb;
5593c8
+
5593c8
+  grub_ieee1275_finddevice ("/", &root);
5593c8
+
5593c8
+  rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", &is_sb,
5593c8
+                                           sizeof (is_sb), 0);
5593c8
+
5593c8
+  /* ibm,secure-boot:
5593c8
+   * 0 - disabled
5593c8
+   * 1 - audit
5593c8
+   * 2 - enforce
5593c8
+   * 3 - enforce + OS-specific behaviour
5593c8
+   *
5593c8
+   * We only support enforce.
5593c8
+   */
5593c8
+  if (rc >= 0 && is_sb >= 2)
5593c8
+    grub_lockdown ();
5593c8
+}
5593c8
+
5593c8
 grub_addr_t grub_modbase;
5593c8
 
5593c8
 void
5593c8
@@ -296,6 +321,8 @@ grub_machine_init (void)
5593c8
 #else
5593c8
   grub_install_get_time_ms (grub_rtc_get_time_ms);
5593c8
 #endif
5593c8
+
5593c8
+  grub_get_ieee1275_secure_boot ();
5593c8
 }
5593c8
 
5593c8
 void
5593c8
diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
1c6ba0
index 40531fa823..ebfee4bf06 100644
5593c8
--- a/include/grub/lockdown.h
5593c8
+++ b/include/grub/lockdown.h
5593c8
@@ -24,7 +24,8 @@
5593c8
 #define GRUB_LOCKDOWN_DISABLED       0
5593c8
 #define GRUB_LOCKDOWN_ENABLED        1
5593c8
 
5593c8
-#ifdef GRUB_MACHINE_EFI
5593c8
+#if defined(GRUB_MACHINE_EFI) || \
5593c8
+    (defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275))
5593c8
 extern void
5593c8
 EXPORT_FUNC (grub_lockdown) (void);
5593c8
 extern int
5593c8
diff --git a/docs/grub.texi b/docs/grub.texi
1c6ba0
index 4816be8561..a4da9c2a1b 100644
5593c8
--- a/docs/grub.texi
5593c8
+++ b/docs/grub.texi
5593c8
@@ -6227,8 +6227,8 @@ Measured boot is currently only supported on EFI platforms.
5593c8
 @section Lockdown when booting on a secure setup
5593c8
 
5593c8
 The GRUB can be locked down when booted on a secure boot environment, for example
5593c8
-if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
5593c8
-be restricted and some operations/commands cannot be executed.
5593c8
+if UEFI or Power secure boot is enabled. On a locked down configuration, the
5593c8
+GRUB will be restricted and some operations/commands cannot be executed.
5593c8
 
5593c8
 The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
5593c8
 Otherwise it does not exit.