linux-kernel - Re: [PATCH V2 10/10] Add option to automatically enforce module signatures when in Secure Boot mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1378300398.6380.76.camel@linux-s257.site>
Date:	Wed, 04 Sep 2013 21:13:18 +0800
From:	joeyli <jlee@...e.com>
To:	Josh Boyer <jwboyer@...oraproject.org>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	Matthew Garrett <matthew.garrett@...ula.com>,
	"Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
	"linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
	Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH V2 10/10] Add option to automatically enforce module
 signatures when in Secure Boot mode

於 三，2013-09-04 於 08:01 -0400，Josh Boyer 提到：
> On Wed, Sep 4, 2013 at 6:51 AM, joeyli <jlee@...e.com> wrote:
> > 於 五，2013-08-30 於 19:41 -0400，Josh Boyer 提到：
> >> On Fri, Aug 30, 2013 at 01:46:30PM -0700, H. Peter Anvin wrote:
> >> > On 08/29/2013 11:37 AM, Josh Boyer wrote:
> >> > >>          setup_efi_pci(boot_params);
> >> > >> diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
> >> > >> index c15ddaf..d35da96 100644
> >> > >> --- a/arch/x86/include/uapi/asm/bootparam.h
> >> > >> +++ b/arch/x86/include/uapi/asm/bootparam.h
> >> > >> @@ -131,7 +131,8 @@ struct boot_params {
> >> > >>          __u8  eddbuf_entries;                           /* 0x1e9 */
> >> > >>          __u8  edd_mbr_sig_buf_entries;                  /* 0x1ea */
> >> > >>          __u8  kbd_status;                               /* 0x1eb */
> >> > >> -        __u8  _pad5[3];                                 /* 0x1ec */
> >> > >> +        __u8  secure_boot;                              /* 0x1ec */
> >> > >> +        __u8  _pad5[2];                                 /* 0x1ec */
> >> > >>          /*
> >> > >>           * The sentinel is set to a nonzero value (0xff) in header.S.
> >> > >>           *
> >> > >
> >> > > You need to include the following chunk of code with this, otherwise the
> >> > > secure_boot variable gets cleared.
> >> > >
> >> >
> >> > Not really.
> >> >
> >> > There are three cases:
> >> >
> >> > 1. Boot stub only.  Here we do the right thing with the bootparams.
> >> > 2. Boot loader bypasses the boot stub completely.  Here we MUST NOT do
> >> >    what you suggest above.
> >> > 3. Boot stub with a boot_params structure passed in.  Here we should
> >> >    run sanitize_boot_params() (an inline for a reason) in the boot
> >> >    stub, before we set the secure_boot field.  Once that is done, we
> >> >    again don't need that modification.
> >>
> >> OK.  If 3 works, then great.  All I know is that Fedora has been
> >> carrying the above hunk for months and it was missing in this patch set.
> >> So when I went to test it, the patches didn't do anything because the
> >> secure_boot field was getting cleared.
> >>
> >> I'm more than happy to try option 3, and I'll poke at it next week
> >> unless someone beats me to it.
> >>
> >> josh
> >
> > The secure_boot field cleaned by sanitize_boot_params() when using grub2
> > linuxefi to load efi stub kernel.
> > I printed the boot_params->sentinel value, confirm this value is NOT 0
> > when running grub2 linuxefi path, the entry point is efi_stub_entry.
> >
> > On the other hand,
> > the sentinel value is 0 when direct run efi stub kernel in UEFI shell,
> > the secure_boot field can keep.
> >
> > Does that mean grub2 should clean the sentinel value? or we move the get
> > secure_boot value to efi_init()?
> 
> See V3 of this patch that Matthew sent yesterday.  It calls
> sanitize_boot_params in efi_main before calling get_secure_boot.  I
> tested that yesterday and it worked fine.
> 
> josh

Ah!
Thanks for you point out, I missed his v3 patch.

Joey Lee

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/