From 89d72301aa67c82f00fe7fa4f42d7f6eb6045538 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 18 Feb 2020 12:03:28 +0100 Subject: [PATCH 45/62] shim: Update EFI_LOADED_IMAGE with the second stage loader file path When shim loads the second stage loader (e.g: GRUB) the FilePath field of the EFI_LOADED_IMAGE structure isn't updated with the path of the loaded binary. So it still contains the file path of the shim binary. This isn't a problem since the file path is currently not used. But should be used to set the DevicePath field of the EFI_IMAGE_LOAD_EVENT structure that is logged when measuring the PE/COFF binaries. In that case the TPM Event Log will have an incorrect file path for the measured binary, i.e: $ hexdump -Cv /sys/kernel/security/tpm0/binary_bios_measurements ... 00000a50 00 00 00 00 00 00 04 04 34 00 5c 00 45 00 46 00 |........4.\.E.F.| 00000a60 49 00 5c 00 72 00 65 00 64 00 68 00 61 00 74 00 |I.\.r.e.d.h.a.t.| 00000a70 5c 00 73 00 68 00 69 00 6d 00 78 00 36 00 34 00 |\.s.h.i.m.x.6.4.| 00000a80 2e 00 65 00 66 00 69 00 00 00 7f ff 04 00 00 00 |..e.f.i.........| 00000a90 00 00 00 00 00 00 af 08 00 00 00 0d 00 00 00 b5 |................| 00000aa0 cd d0 8f bb 16 31 e2 80 8b e8 58 75 c9 89 18 95 |.....1....Xu....| 00000ab0 d2 de 15 15 00 00 00 67 72 75 62 5f 63 6d 64 20 |.......grub_cmd | 00000ac0 73 65 74 20 70 61 67 65 72 3d 31 00 08 00 00 00 |set pager=1.....| ... So update the EFI_LOADED_IMAGE structure with the second stage loader file path to have the correct value in the log, i.e: $ hexdump -Cv /sys/kernel/security/tpm0/binary_bios_measurements ... 00000a50 00 00 00 00 00 00 04 04 34 00 5c 00 45 00 46 00 |........4.\.E.F.| 00000a60 49 00 5c 00 72 00 65 00 64 00 68 00 61 00 74 00 |I.\.r.e.d.h.a.t.| 00000a70 5c 00 67 00 72 00 75 00 62 00 78 00 36 00 34 00 |\.g.r.u.b.x.6.4.| 00000a80 2e 00 65 00 66 00 69 00 00 00 7f ff 04 00 00 00 |..e.f.i.........| 00000a90 00 00 00 00 00 00 af 08 00 00 00 0d 00 00 00 b5 |................| 00000aa0 cd d0 8f bb 16 31 e2 80 8b e8 58 75 c9 89 18 95 |.....1....Xu....| 00000ab0 d2 de 15 15 00 00 00 67 72 75 62 5f 63 6d 64 20 |.......grub_cmd | 00000ac0 73 65 74 20 70 61 67 65 72 3d 31 00 08 00 00 00 |set pager=1.....| ... Signed-off-by: Javier Martinez Canillas Upstream-commit-id: cd7d42d493d --- shim.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/shim.c b/shim.c index 5329795c333..a4f7769b38b 100644 --- a/shim.c +++ b/shim.c @@ -1925,6 +1925,16 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath) */ CopyMem(&li_bak, li, sizeof(li_bak)); + /* + * Update the loaded image with the second stage loader file path + */ + li->FilePath = FileDevicePath(NULL, PathName); + if (!li->FilePath) { + perror(L"Unable to update loaded image file path\n"); + efi_status = EFI_OUT_OF_RESOURCES; + goto restore; + } + /* * Verify and, if appropriate, relocate and execute the executable */ @@ -1934,8 +1944,7 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath) perror(L"Failed to load image: %r\n", efi_status); PrintErrors(); ClearErrors(); - CopyMem(li, &li_bak, sizeof(li_bak)); - goto done; + goto restore; } loader_is_participating = 0; @@ -1945,6 +1954,10 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath) */ efi_status = entry_point(image_handle, systab); +restore: + if (li->FilePath) + FreePool(li->FilePath); + /* * Restore our original loaded image values */ -- 2.26.2