lkml.org 
[lkml]   [2021]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 100/101] integrity: Load mokx variables into the blacklist keyring
    Date
    From: Eric Snowberg <eric.snowberg@oracle.com>

    [ Upstream commit ebd9c2ae369a45bdd9f8615484db09be58fc242b ]

    During boot the Secure Boot Forbidden Signature Database, dbx,
    is loaded into the blacklist keyring. Systems booted with shim
    have an equivalent Forbidden Signature Database called mokx.
    Currently mokx is only used by shim and grub, the contents are
    ignored by the kernel.

    Add the ability to load mokx into the blacklist keyring during boot.

    Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
    Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
    cc: keyrings@vger.kernel.org
    Link: https://lore.kernel.org/r/c33c8e3839a41e9654f41cc92c7231104931b1d7.camel@HansenPartnership.com/
    Link: https://lore.kernel.org/r/20210122181054.32635-5-eric.snowberg@oracle.com/ # v5
    Link: https://lore.kernel.org/r/161428674320.677100.12637282414018170743.stgit@warthog.procyon.org.uk/
    Link: https://lore.kernel.org/r/161433313205.902181.2502803393898221637.stgit@warthog.procyon.org.uk/ # v2
    Link: https://lore.kernel.org/r/161529607422.163428.13530426573612578854.stgit@warthog.procyon.org.uk/ # v3
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/integrity/platform_certs/load_uefi.c | 20 +++++++++++++++++--
    1 file changed, 18 insertions(+), 2 deletions(-)

    diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
    index ee4b4c666854..f290f78c3f30 100644
    --- a/security/integrity/platform_certs/load_uefi.c
    +++ b/security/integrity/platform_certs/load_uefi.c
    @@ -132,8 +132,9 @@ static int __init load_moklist_certs(void)
    static int __init load_uefi_certs(void)
    {
    efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
    - void *db = NULL, *dbx = NULL;
    - unsigned long dbsize = 0, dbxsize = 0;
    + efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
    + void *db = NULL, *dbx = NULL, *mokx = NULL;
    + unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
    efi_status_t status;
    int rc = 0;

    @@ -175,6 +176,21 @@ static int __init load_uefi_certs(void)
    kfree(dbx);
    }

    + mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);
    + if (!mokx) {
    + if (status == EFI_NOT_FOUND)
    + pr_debug("mokx variable wasn't found\n");
    + else
    + pr_info("Couldn't get mokx list\n");
    + } else {
    + rc = parse_efi_signature_list("UEFI:MokListXRT",
    + mokx, mokxsize,
    + get_handler_for_dbx);
    + if (rc)
    + pr_err("Couldn't parse mokx signatures %d\n", rc);
    + kfree(mokx);
    + }
    +
    /* Load the MokListRT certs */
    rc = load_moklist_certs();

    --
    2.30.2
    \
     
     \ /
      Last update: 2021-06-28 16:41    [W:4.057 / U:0.344 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site