linux-kernel - Re: [PATCH V2 10/10] Add option to automatically enforce module signatures when in Secure Boot mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <522104A6.5000700@zytor.com>
Date:	Fri, 30 Aug 2013 13:46:30 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Josh Boyer <jwboyer@...hat.com>
CC:	Matthew Garrett <matthew.garrett@...ula.com>,
	linux-kernel@...r.kernel.org, linux-efi@...r.kernel.org,
	keescook@...omium.org
Subject: Re: [PATCH V2 10/10] Add option to automatically enforce module signatures
 when in Secure Boot mode

On 08/29/2013 11:37 AM, Josh Boyer wrote:
>>  	setup_efi_pci(boot_params);
>> diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
>> index c15ddaf..d35da96 100644
>> --- a/arch/x86/include/uapi/asm/bootparam.h
>> +++ b/arch/x86/include/uapi/asm/bootparam.h
>> @@ -131,7 +131,8 @@ struct boot_params {
>>  	__u8  eddbuf_entries;				/* 0x1e9 */
>>  	__u8  edd_mbr_sig_buf_entries;			/* 0x1ea */
>>  	__u8  kbd_status;				/* 0x1eb */
>> -	__u8  _pad5[3];					/* 0x1ec */
>> +	__u8  secure_boot;				/* 0x1ec */
>> +	__u8  _pad5[2];					/* 0x1ec */
>>  	/*
>>  	 * The sentinel is set to a nonzero value (0xff) in header.S.
>>  	 *
> 
> You need to include the following chunk of code with this, otherwise the
> secure_boot variable gets cleared.
> 

Not really.

There are three cases:

1. Boot stub only.  Here we do the right thing with the bootparams.
2. Boot loader bypasses the boot stub completely.  Here we MUST NOT do
   what you suggest above.
3. Boot stub with a boot_params structure passed in.  Here we should
   run sanitize_boot_params() (an inline for a reason) in the boot
   stub, before we set the secure_boot field.  Once that is done, we
   again don't need that modification.

	-hpa

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/