linux-kernel - Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 22 Mar 2016 21:36:25 -0500
From:	Mario Limonciello <mario_limonciello@...l.com>
To:	LKML <linux-kernel@...r.kernel.org>
Cc:	"matt@...eblueprint.co.uk" <matt@...eblueprint.co.uk>,
	"mjg59@...eos.com" <mjg59@...eos.com>,
	"pjones@...hat.com" <pjones@...hat.com>
Subject: Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable
 whitelist



On 03/22/2016 04:37 PM, Limonciello, Mario wrote:
> ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 caused all variables to be
> immutable by default.  This causes problems with userspace applications
> mokutil and fwupdate.
> ---
>  drivers/firmware/efi/vars.c | 2 ++
>  include/linux/efi.h         | 8 ++++++++
>  2 files changed, 10 insertions(+)
>
> diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
> index 0ac594c..16bd2a9 100644
> --- a/drivers/firmware/efi/vars.c
> +++ b/drivers/firmware/efi/vars.c
> @@ -199,6 +199,8 @@ static const struct variable_validate variable_validate[] = {
>  	{ EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
>  	{ EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
>  	{ LINUX_EFI_CRASH_GUID, "*", NULL },
> +	{ FWUPDATE_GUID, "fwupdate*", NULL },
> +	{ MOK_GUID, "Mok*", NULL },
>  	{ NULL_GUID, "", NULL },
>  };
>  
> diff --git a/include/linux/efi.h b/include/linux/efi.h
> index 1626474..c882cb0 100644
> --- a/include/linux/efi.h
> +++ b/include/linux/efi.h
> @@ -575,6 +575,14 @@ void efi_native_runtime_setup(void);
>  	EFI_GUID(0x8be4df61, 0x93ca, 0x11d2, \
>  		 0xaa, 0x0d, 0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c)
>  
> +#define FWUPDATE_GUID \
> +	EFI_GUID(0x0abba7dc, 0xe516, 0x4167, \
> +		 0xbb, 0xf5, 0x4d, 0x9d, 0x1c, 0x73, 0x94, 0x16)
> +
> +#define MOK_GUID \
> +	EFI_GUID(0x605dab50, 0xe046, 0x4300, \
> +		 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
> +
>  #define UV_SYSTEM_TABLE_GUID \
>  	EFI_GUID(0x3b13a7d4, 0x633e, 0x11dd, \
>  		 0x93, 0xec, 0xda, 0x25, 0x56, 0xd8, 0x95, 0x93)
Actually, I think this patch should be discarded unless there is a
desire to make the kernel work with older userspace tools. 

I later realized that efivar 0.22 will actually handle working with
immutable variables properly.  This means that mokutil 0.2 won't work
with this kernel commit, but mokutil 0.3 which uses efivar
(https://github.com/lcp/mokutil/commit/7b49e834284659527c9f7cf554f223748c00564b)
should work properly.

fwupdate works properly in most instances except for an install time
cleanup script that removes stale variables.  This is fixed with a
trivial change:
https://github.com/rhinstaller/fwupdate/pull/50/commits/535d3a0f9c096d452cc7e2b5be79cf964e2d6d5b