Blame SOURCES/0339-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Javier Martinez Canillas <javierm@redhat.com>
b1bcb2
Date: Mon, 28 Sep 2020 20:08:33 +0200
b1bcb2
Subject: [PATCH] efi: Use grub_is_lockdown() instead of hardcoding a disabled
b1bcb2
 modules list
b1bcb2
b1bcb2
Now the GRUB can check if it has been locked down and this can be used to
b1bcb2
prevent executing commands that can be utilized to circumvent the UEFI
b1bcb2
Secure Boot mechanisms. So, instead of hardcoding a list of modules that
b1bcb2
have to be disabled, prevent the usage of commands that can be dangerous.
b1bcb2
b1bcb2
This not only allows the commands to be disabled on other platforms, but
b1bcb2
also properly separate the concerns. Since the shim_lock verifier logic
b1bcb2
should be only about preventing to run untrusted binaries and not about
b1bcb2
defining these kind of policies.
b1bcb2
b1bcb2
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/commands/iorw.c  | 26 ++++++++++----------------
b1bcb2
 grub-core/commands/memrw.c | 26 ++++++++++----------------
b1bcb2
 2 files changed, 20 insertions(+), 32 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
b1bcb2
index 41a7f3f0466..584baec8f91 100644
b1bcb2
--- a/grub-core/commands/iorw.c
b1bcb2
+++ b/grub-core/commands/iorw.c
b1bcb2
@@ -23,7 +23,7 @@
b1bcb2
 #include <grub/env.h>
b1bcb2
 #include <grub/cpu/io.h>
b1bcb2
 #include <grub/i18n.h>
b1bcb2
-#include <grub/efi/sb.h>
b1bcb2
+#include <grub/lockdown.h>
b1bcb2
 
b1bcb2
 GRUB_MOD_LICENSE ("GPLv3+");
b1bcb2
 
b1bcb2
@@ -119,9 +119,6 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
b1bcb2
 
b1bcb2
 GRUB_MOD_INIT(memrw)
b1bcb2
 {
b1bcb2
-  if (grub_efi_secure_boot())
b1bcb2
-    return;
b1bcb2
-
b1bcb2
   cmd_read_byte =
b1bcb2
     grub_register_extcmd ("inb", grub_cmd_read, 0,
b1bcb2
 			  N_("PORT"), N_("Read 8-bit value from PORT."),
b1bcb2
@@ -135,24 +132,21 @@ GRUB_MOD_INIT(memrw)
b1bcb2
 			  N_("PORT"), N_("Read 32-bit value from PORT."),
b1bcb2
 			  options);
b1bcb2
   cmd_write_byte =
b1bcb2
-    grub_register_command ("outb", grub_cmd_write,
b1bcb2
-			   N_("PORT VALUE [MASK]"),
b1bcb2
-			   N_("Write 8-bit VALUE to PORT."));
b1bcb2
+    grub_register_command_lockdown ("outb", grub_cmd_write,
b1bcb2
+                                    N_("PORT VALUE [MASK]"),
b1bcb2
+                                    N_("Write 8-bit VALUE to PORT."));
b1bcb2
   cmd_write_word =
b1bcb2
-    grub_register_command ("outw", grub_cmd_write,
b1bcb2
-			   N_("PORT VALUE [MASK]"),
b1bcb2
-			   N_("Write 16-bit VALUE to PORT."));
b1bcb2
+    grub_register_command_lockdown ("outw", grub_cmd_write,
b1bcb2
+                                    N_("PORT VALUE [MASK]"),
b1bcb2
+                                    N_("Write 16-bit VALUE to PORT."));
b1bcb2
   cmd_write_dword =
b1bcb2
-    grub_register_command ("outl", grub_cmd_write,
b1bcb2
-			   N_("ADDR VALUE [MASK]"),
b1bcb2
-			   N_("Write 32-bit VALUE to PORT."));
b1bcb2
+    grub_register_command_lockdown ("outl", grub_cmd_write,
b1bcb2
+                                    N_("ADDR VALUE [MASK]"),
b1bcb2
+                                    N_("Write 32-bit VALUE to PORT."));
b1bcb2
 }
b1bcb2
 
b1bcb2
 GRUB_MOD_FINI(memrw)
b1bcb2
 {
b1bcb2
-  if (grub_efi_secure_boot())
b1bcb2
-    return;
b1bcb2
-
b1bcb2
   grub_unregister_extcmd (cmd_read_byte);
b1bcb2
   grub_unregister_extcmd (cmd_read_word);
b1bcb2
   grub_unregister_extcmd (cmd_read_dword);
b1bcb2
diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
b1bcb2
index 088cbe9e2bc..d401a6db0ef 100644
b1bcb2
--- a/grub-core/commands/memrw.c
b1bcb2
+++ b/grub-core/commands/memrw.c
b1bcb2
@@ -22,7 +22,7 @@
b1bcb2
 #include <grub/extcmd.h>
b1bcb2
 #include <grub/env.h>
b1bcb2
 #include <grub/i18n.h>
b1bcb2
-#include <grub/efi/sb.h>
b1bcb2
+#include <grub/lockdown.h>
b1bcb2
 
b1bcb2
 GRUB_MOD_LICENSE ("GPLv3+");
b1bcb2
 
b1bcb2
@@ -121,9 +121,6 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
b1bcb2
 
b1bcb2
 GRUB_MOD_INIT(memrw)
b1bcb2
 {
b1bcb2
-  if (grub_efi_secure_boot())
b1bcb2
-    return;
b1bcb2
-
b1bcb2
   cmd_read_byte =
b1bcb2
     grub_register_extcmd ("read_byte", grub_cmd_read, 0,
b1bcb2
 			  N_("ADDR"), N_("Read 8-bit value from ADDR."),
b1bcb2
@@ -137,24 +134,21 @@ GRUB_MOD_INIT(memrw)
b1bcb2
 			  N_("ADDR"), N_("Read 32-bit value from ADDR."),
b1bcb2
 			  options);
b1bcb2
   cmd_write_byte =
b1bcb2
-    grub_register_command ("write_byte", grub_cmd_write,
b1bcb2
-			   N_("ADDR VALUE [MASK]"),
b1bcb2
-			   N_("Write 8-bit VALUE to ADDR."));
b1bcb2
+    grub_register_command_lockdown ("write_byte", grub_cmd_write,
b1bcb2
+                                    N_("ADDR VALUE [MASK]"),
b1bcb2
+                                    N_("Write 8-bit VALUE to ADDR."));
b1bcb2
   cmd_write_word =
b1bcb2
-    grub_register_command ("write_word", grub_cmd_write,
b1bcb2
-			   N_("ADDR VALUE [MASK]"),
b1bcb2
-			   N_("Write 16-bit VALUE to ADDR."));
b1bcb2
+    grub_register_command_lockdown ("write_word", grub_cmd_write,
b1bcb2
+                                    N_("ADDR VALUE [MASK]"),
b1bcb2
+                                    N_("Write 16-bit VALUE to ADDR."));
b1bcb2
   cmd_write_dword =
b1bcb2
-    grub_register_command ("write_dword", grub_cmd_write,
b1bcb2
-			   N_("ADDR VALUE [MASK]"),
b1bcb2
-			   N_("Write 32-bit VALUE to ADDR."));
b1bcb2
+    grub_register_command_lockdown ("write_dword", grub_cmd_write,
b1bcb2
+                                    N_("ADDR VALUE [MASK]"),
b1bcb2
+                                    N_("Write 32-bit VALUE to ADDR."));
b1bcb2
 }
b1bcb2
 
b1bcb2
 GRUB_MOD_FINI(memrw)
b1bcb2
 {
b1bcb2
-  if (grub_efi_secure_boot())
b1bcb2
-    return;
b1bcb2
-
b1bcb2
   grub_unregister_extcmd (cmd_read_byte);
b1bcb2
   grub_unregister_extcmd (cmd_read_word);
b1bcb2
   grub_unregister_extcmd (cmd_read_dword);