linux-kernel - ima: efi: modsign: Couldn't get UEFI MokListRT and Couldn't get size: 0x800000000000000e

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 28 Aug 2019 17:54:23 +0200
From:   Sedat Dilek <sedat.dilek@...il.com>
To:     "Lee, Chun-Yi" <jlee@...e.com>
Cc:     linux-integrity@...r.kernel.org, Mimi Zohar <zohar@...ux.ibm.com>,
        Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        David Howells <dhowells@...hat.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>,
        Kees Cook <keescook@...omium.org>,
        Anton Vorontsov <anton@...msg.org>,
        Colin Cross <ccross@...roid.com>,
        Tony Luck <tony.luck@...el.com>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Nayna Jain <nayna@...ux.ibm.com>,
        Josh Boyer <jwboyer@...oraproject.org>,
        linux-kernel@...r.kernel.org
Subject: ima: efi: modsign: Couldn't get UEFI MokListRT and Couldn't get size: 0x800000000000000e

[ Please CC me I am not subscribed to any MLs ]
[ Sorry the CC list is long - I collected all people CCed in the
patches of jlee ]

Hi,

I fell over in my dmesg-log...

[Wed Aug 28 15:31:10 2019] integrity: Loading X.509 certificate: UEFI:db
[Wed Aug 28 15:31:10 2019] integrity: Loaded X.509 cert 'Lenovo Ltd.:
ThinkPad Product CA 2012: secret-hash-1'
[Wed Aug 28 15:31:10 2019] integrity: Loading X.509 certificate: UEFI:db
[Wed Aug 28 15:31:10 2019] integrity: Loaded X.509 cert 'Lenovo UEFI
CA 2014: secret-hash-2'
[Wed Aug 28 15:31:10 2019] integrity: Loading X.509 certificate: UEFI:db
[Wed Aug 28 15:31:10 2019] integrity: Loaded X.509 cert 'Microsoft
Corporation UEFI CA 2011: secret-has-3'
[Wed Aug 28 15:31:10 2019] integrity: Loading X.509 certificate: UEFI:db
[Wed Aug 28 15:31:10 2019] integrity: Loaded X.509 cert 'Microsoft
Windows Production PCA 2011: secret-hash-4'
[Wed Aug 28 15:31:10 2019] Couldn't get size: 0x800000000000000e XXX:
<--- Can you label this with "integrity:"
[Wed Aug 28 15:31:10 2019] Couldn't get UEFI MokListRT XXX: <--- Can
you label this with "integrity:"

...and searched in the sources...

$ git grep "Couldn't get UEFI MokListRT"
security/integrity/platform_certs/load_uefi.c:
pr_info("Couldn't get UEFI MokListRT\n");

Googling pointed me to a thread in [1]...

...and patches from "Lee, Chun-Yi" <jlee@...e.com> [2]...

X.509: Add messages for obsolete OIDs
efi: print appropriate status message when loading certificates
efi: add a function to convert the status value to string

...which seems to "fix" this (these) issue(s).

What is the status of these patches?

NOTE: I have disabled UEFI secure-boot on my Lenovo ThinkPad T470 and
running Debian/buster AMD64 with Linux-v5.3-rc6+.

BTW, are these warnings related to some EFI relicts - variables that
are no more active?
( I played with efivarfs and throw away my windows boot loader all
together with its *.efi by deleting its boot-* file. )
( I have restored my systemd-boot loader as I am a smart guy, so I am
sure I will do so on next Win10 boot and updates procedure. )

I attached my kernel-config and dmesg-log.

Do you need more informations?

Thanks.

Regards,
- Sedat -

P.S.: Be smart to your boot-loader

root# efibootmgr -c -d /dev/nvme0n1 -p 1 -L 'Linux Boot Manager' -l
'EFI\systemd\systemd-bootx64.efi'

XXX: CAUTION: -d <device_name> and -p <partition_number> needs to be adapted.

[1] https://forums.opensuse.org/showthread.php/535324-MODSIGN-Couldn-t-get-UEFI-db-list
[2] https://lore.kernel.org/patchwork/project/lkml/list/?submitter=11305

View attachment "config-5.3.0-rc6-2-amd64-cbl-asmgoto.txt" of type "text/plain" (220532 bytes)

View attachment "dmesg-T_5.3.0-rc6-2-amd64-cbl-asmgoto.txt" of type "text/plain" (86000 bytes)