Blame SOURCES/0376-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
9723a8
From: Javier Martinez Canillas <javierm@redhat.com>
9723a8
Date: Mon, 28 Sep 2020 20:08:33 +0200
9723a8
Subject: [PATCH] efi: Use grub_is_lockdown() instead of hardcoding a disabled
9723a8
 modules list
9723a8
9723a8
Now the GRUB can check if it has been locked down and this can be used to
9723a8
prevent executing commands that can be utilized to circumvent the UEFI
9723a8
Secure Boot mechanisms. So, instead of hardcoding a list of modules that
9723a8
have to be disabled, prevent the usage of commands that can be dangerous.
9723a8
9723a8
This not only allows the commands to be disabled on other platforms, but
9723a8
also properly separate the concerns. Since the shim_lock verifier logic
9723a8
should be only about preventing to run untrusted binaries and not about
9723a8
defining these kind of policies.
9723a8
9723a8
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
9723a8
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
9723a8
---
9723a8
 grub-core/commands/iorw.c  | 26 ++++++++++----------------
9723a8
 grub-core/commands/memrw.c | 26 ++++++++++----------------
9723a8
 2 files changed, 20 insertions(+), 32 deletions(-)
9723a8
9723a8
diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
b71686
index 41a7f3f04..584baec8f 100644
9723a8
--- a/grub-core/commands/iorw.c
9723a8
+++ b/grub-core/commands/iorw.c
9723a8
@@ -23,7 +23,7 @@
9723a8
 #include <grub/env.h>
9723a8
 #include <grub/cpu/io.h>
9723a8
 #include <grub/i18n.h>
9723a8
-#include <grub/efi/sb.h>
9723a8
+#include <grub/lockdown.h>
9723a8
 
9723a8
 GRUB_MOD_LICENSE ("GPLv3+");
9723a8
 
9723a8
@@ -119,9 +119,6 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
9723a8
 
9723a8
 GRUB_MOD_INIT(memrw)
9723a8
 {
9723a8
-  if (grub_efi_secure_boot())
9723a8
-    return;
9723a8
-
9723a8
   cmd_read_byte =
9723a8
     grub_register_extcmd ("inb", grub_cmd_read, 0,
9723a8
 			  N_("PORT"), N_("Read 8-bit value from PORT."),
9723a8
@@ -135,24 +132,21 @@ GRUB_MOD_INIT(memrw)
9723a8
 			  N_("PORT"), N_("Read 32-bit value from PORT."),
9723a8
 			  options);
9723a8
   cmd_write_byte =
9723a8
-    grub_register_command ("outb", grub_cmd_write,
9723a8
-			   N_("PORT VALUE [MASK]"),
9723a8
-			   N_("Write 8-bit VALUE to PORT."));
9723a8
+    grub_register_command_lockdown ("outb", grub_cmd_write,
9723a8
+                                    N_("PORT VALUE [MASK]"),
9723a8
+                                    N_("Write 8-bit VALUE to PORT."));
9723a8
   cmd_write_word =
9723a8
-    grub_register_command ("outw", grub_cmd_write,
9723a8
-			   N_("PORT VALUE [MASK]"),
9723a8
-			   N_("Write 16-bit VALUE to PORT."));
9723a8
+    grub_register_command_lockdown ("outw", grub_cmd_write,
9723a8
+                                    N_("PORT VALUE [MASK]"),
9723a8
+                                    N_("Write 16-bit VALUE to PORT."));
9723a8
   cmd_write_dword =
9723a8
-    grub_register_command ("outl", grub_cmd_write,
9723a8
-			   N_("ADDR VALUE [MASK]"),
9723a8
-			   N_("Write 32-bit VALUE to PORT."));
9723a8
+    grub_register_command_lockdown ("outl", grub_cmd_write,
9723a8
+                                    N_("ADDR VALUE [MASK]"),
9723a8
+                                    N_("Write 32-bit VALUE to PORT."));
9723a8
 }
9723a8
 
9723a8
 GRUB_MOD_FINI(memrw)
9723a8
 {
9723a8
-  if (grub_efi_secure_boot())
9723a8
-    return;
9723a8
-
9723a8
   grub_unregister_extcmd (cmd_read_byte);
9723a8
   grub_unregister_extcmd (cmd_read_word);
9723a8
   grub_unregister_extcmd (cmd_read_dword);
9723a8
diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
b71686
index 088cbe9e2..d401a6db0 100644
9723a8
--- a/grub-core/commands/memrw.c
9723a8
+++ b/grub-core/commands/memrw.c
9723a8
@@ -22,7 +22,7 @@
9723a8
 #include <grub/extcmd.h>
9723a8
 #include <grub/env.h>
9723a8
 #include <grub/i18n.h>
9723a8
-#include <grub/efi/sb.h>
9723a8
+#include <grub/lockdown.h>
9723a8
 
9723a8
 GRUB_MOD_LICENSE ("GPLv3+");
9723a8
 
9723a8
@@ -121,9 +121,6 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
9723a8
 
9723a8
 GRUB_MOD_INIT(memrw)
9723a8
 {
9723a8
-  if (grub_efi_secure_boot())
9723a8
-    return;
9723a8
-
9723a8
   cmd_read_byte =
9723a8
     grub_register_extcmd ("read_byte", grub_cmd_read, 0,
9723a8
 			  N_("ADDR"), N_("Read 8-bit value from ADDR."),
9723a8
@@ -137,24 +134,21 @@ GRUB_MOD_INIT(memrw)
9723a8
 			  N_("ADDR"), N_("Read 32-bit value from ADDR."),
9723a8
 			  options);
9723a8
   cmd_write_byte =
9723a8
-    grub_register_command ("write_byte", grub_cmd_write,
9723a8
-			   N_("ADDR VALUE [MASK]"),
9723a8
-			   N_("Write 8-bit VALUE to ADDR."));
9723a8
+    grub_register_command_lockdown ("write_byte", grub_cmd_write,
9723a8
+                                    N_("ADDR VALUE [MASK]"),
9723a8
+                                    N_("Write 8-bit VALUE to ADDR."));
9723a8
   cmd_write_word =
9723a8
-    grub_register_command ("write_word", grub_cmd_write,
9723a8
-			   N_("ADDR VALUE [MASK]"),
9723a8
-			   N_("Write 16-bit VALUE to ADDR."));
9723a8
+    grub_register_command_lockdown ("write_word", grub_cmd_write,
9723a8
+                                    N_("ADDR VALUE [MASK]"),
9723a8
+                                    N_("Write 16-bit VALUE to ADDR."));
9723a8
   cmd_write_dword =
9723a8
-    grub_register_command ("write_dword", grub_cmd_write,
9723a8
-			   N_("ADDR VALUE [MASK]"),
9723a8
-			   N_("Write 32-bit VALUE to ADDR."));
9723a8
+    grub_register_command_lockdown ("write_dword", grub_cmd_write,
9723a8
+                                    N_("ADDR VALUE [MASK]"),
9723a8
+                                    N_("Write 32-bit VALUE to ADDR."));
9723a8
 }
9723a8
 
9723a8
 GRUB_MOD_FINI(memrw)
9723a8
 {
9723a8
-  if (grub_efi_secure_boot())
9723a8
-    return;
9723a8
-
9723a8
   grub_unregister_extcmd (cmd_read_byte);
9723a8
   grub_unregister_extcmd (cmd_read_word);
9723a8
   grub_unregister_extcmd (cmd_read_dword);