| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20200216141104.21477-4-ardb@kernel.org>
Date: Sun, 16 Feb 2020 15:11:04 +0100
From: Ard Biesheuvel <ardb@...nel.org>
To: linux-efi@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, Ard Biesheuvel <ardb@...nel.org>,
lersek@...hat.com, leif@...iainc.com, pjones@...hat.com,
mjg59@...gle.com, agraf@...raf.de, ilias.apalodimas@...aro.org,
xypron.glpk@....de, daniel.kiper@...cle.com, nivedita@...m.mit.edu,
James.Bottomley@...senpartnership.com, lukas@...ner.de
Subject: [PATCH v2 3/3] efi/libstub: Take noinitrd cmdline argument into account for devpath initrd
One of the advantages of using what basically amounts to a callback
interface into the bootloader for loading the initrd is that it provides
a natural place for the bootloader or firmware to measure the initrd
contents while they are being passed to the kernel.
Unfortunately, this is not a guarantee that the initrd will in fact be
loaded and its /init invoked by the kernel, since the command line may
contain the 'noinitrd' option, in which case the initrd is ignored, but
this will not be reflected in the PCR that covers the initrd measurement.
This could be addressed by measuring the command line as well, and
including that PCR in the attestation policy, but this locks down the
command line completely, which may be too restrictive.
So let's take the noinitrd argument into account in the stub, too. This
forces any PCR that covers the initrd to assume a different value when
noinitrd is passed, allowing an attestation policy to disregard the
command line if there is no need to take its measurement into account
for other reasons.
As Peter points out, this would still require the agent that takes the
measurements to measure a separator event into the PCR in question at
ExitBootServices() time, to prevent replay attacks using the known
measurement from the TPM log.
Cc: Peter Jones <pjones@...hat.com>
Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
---
drivers/firmware/efi/libstub/arm-stub.c | 25 +++++-----
drivers/firmware/efi/libstub/efi-stub-helper.c | 7 +++
drivers/firmware/efi/libstub/efistub.h | 1 +
drivers/firmware/efi/libstub/x86-stub.c | 52 +++++++++++---------
4 files changed, 51 insertions(+), 34 deletions(-)
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index 4bae620b95b9..56e475c1aa55 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -259,18 +259,21 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table_arg,
if (!fdt_addr)
pr_efi("Generating empty DTB\n");
- max_addr = efi_get_max_initrd_addr(dram_base, *image_addr);
- status = efi_load_initrd_dev_path(&initrd_addr, &initrd_size, max_addr);
- if (status == EFI_SUCCESS) {
- pr_efi("Loaded initrd from LINUX_EFI_INITRD_MEDIA_GUID device path\n");
- } else if (status == EFI_NOT_FOUND) {
- status = efi_load_initrd(image, &initrd_addr, &initrd_size,
- ULONG_MAX, max_addr);
- if (status == EFI_SUCCESS)
- pr_efi("Loaded initrd from command line option\n");
+ if (!noinitrd()) {
+ max_addr = efi_get_max_initrd_addr(dram_base, *image_addr);
+ status = efi_load_initrd_dev_path(&initrd_addr, &initrd_size,
+ max_addr);
+ if (status == EFI_SUCCESS) {
+ pr_efi("Loaded initrd from LINUX_EFI_INITRD_MEDIA_GUID device path\n");
+ } else if (status == EFI_NOT_FOUND) {
+ status = efi_load_initrd(image, &initrd_addr, &initrd_size,
+ ULONG_MAX, max_addr);
+ if (status == EFI_SUCCESS)
+ pr_efi("Loaded initrd from command line option\n");
+ }
+ if (status != EFI_SUCCESS)
+ pr_efi_err("Failed to load initrd!\n");
}
- if (status != EFI_SUCCESS)
- pr_efi_err("Failed to load initrd!\n");
efi_random_get_seed();
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index e37afe2c752e..c5d04147ed17 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -14,6 +14,7 @@
static bool __efistub_global efi_nochunk;
static bool __efistub_global efi_nokaslr;
+static bool __efistub_global efi_noinitrd;
static bool __efistub_global efi_quiet;
static bool __efistub_global efi_novamap;
static bool __efistub_global efi_nosoftreserve;
@@ -28,6 +29,10 @@ bool __pure nokaslr(void)
{
return efi_nokaslr;
}
+bool __pure noinitrd(void)
+{
+ return efi_noinitrd;
+}
bool __pure is_quiet(void)
{
return efi_quiet;
@@ -87,6 +92,8 @@ efi_status_t efi_parse_options(char const *cmdline)
efi_nokaslr = true;
} else if (!strcmp(param, "quiet")) {
efi_quiet = true;
+ } else if (!strcmp(param, "noinitrd")) {
+ efi_noinitrd = true;
} else if (!strcmp(param, "efi") && val) {
efi_nochunk = parse_option_str(val, "nochunk");
efi_novamap = parse_option_str(val, "novamap");
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index b58cb2c4474e..2e5e79edb4d7 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -33,6 +33,7 @@
extern bool __pure nochunk(void);
extern bool __pure nokaslr(void);
+extern bool __pure noinitrd(void);
extern bool __pure is_quiet(void);
extern bool __pure novamap(void);
diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
index 16bf4ed21f1f..7d4866471f86 100644
--- a/drivers/firmware/efi/libstub/x86-stub.c
+++ b/drivers/firmware/efi/libstub/x86-stub.c
@@ -421,15 +421,18 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
if (status != EFI_SUCCESS)
goto fail2;
- status = efi_load_initrd(image, &ramdisk_addr, &ramdisk_size,
- hdr->initrd_addr_max,
- above4g ? ULONG_MAX : hdr->initrd_addr_max);
- if (status != EFI_SUCCESS)
- goto fail2;
- hdr->ramdisk_image = ramdisk_addr & 0xffffffff;
- hdr->ramdisk_size = ramdisk_size & 0xffffffff;
- boot_params->ext_ramdisk_image = (u64)ramdisk_addr >> 32;
- boot_params->ext_ramdisk_size = (u64)ramdisk_size >> 32;
+ if (!noinitrd()) {
+ status = efi_load_initrd(image, &ramdisk_addr, &ramdisk_size,
+ hdr->initrd_addr_max,
+ above4g ? ULONG_MAX
+ : hdr->initrd_addr_max);
+ if (status != EFI_SUCCESS)
+ goto fail2;
+ hdr->ramdisk_image = ramdisk_addr & 0xffffffff;
+ hdr->ramdisk_size = ramdisk_size & 0xffffffff;
+ boot_params->ext_ramdisk_image = (u64)ramdisk_addr >> 32;
+ boot_params->ext_ramdisk_size = (u64)ramdisk_size >> 32;
+ }
efi_stub_entry(handle, sys_table, boot_params);
/* not reached */
@@ -699,14 +702,9 @@ struct boot_params *efi_main(efi_handle_t handle,
{
unsigned long bzimage_addr = (unsigned long)startup_32;
struct setup_header *hdr = &boot_params->hdr;
- unsigned long max_addr = hdr->initrd_addr_max;
- unsigned long initrd_addr, initrd_size;
efi_status_t status;
unsigned long cmdline_paddr;
- if (hdr->xloadflags & XLF_CAN_BE_LOADED_ABOVE_4G)
- max_addr = ULONG_MAX;
-
sys_table = sys_table_arg;
/* Check if we were booted by the EFI firmware */
@@ -746,15 +744,23 @@ struct boot_params *efi_main(efi_handle_t handle,
* permit an initrd loaded from the LINUX_EFI_INITRD_MEDIA_GUID device
* path to supersede it.
*/
- status = efi_load_initrd_dev_path(&initrd_addr, &initrd_size, max_addr);
- if (status == EFI_SUCCESS) {
- hdr->ramdisk_image = (u32)initrd_addr;
- hdr->ramdisk_size = (u32)initrd_size;
- boot_params->ext_ramdisk_image = (u64)initrd_addr >> 32;
- boot_params->ext_ramdisk_size = (u64)initrd_size >> 32;
- } else if (status != EFI_NOT_FOUND) {
- efi_printk("efi_load_initrd_dev_path() failed!\n");
- goto fail;
+ if (!noinitrd()) {
+ unsigned long addr, size;
+ unsigned long max_addr = hdr->initrd_addr_max;
+
+ if (hdr->xloadflags & XLF_CAN_BE_LOADED_ABOVE_4G)
+ max_addr = ULONG_MAX;
+
+ status = efi_load_initrd_dev_path(&addr, &size, max_addr);
+ if (status == EFI_SUCCESS) {
+ hdr->ramdisk_image = (u32)addr;
+ hdr->ramdisk_size = (u32)size;
+ boot_params->ext_ramdisk_image = (u64)addr >> 32;
+ boot_params->ext_ramdisk_size = (u64)size >> 32;
+ } else if (status != EFI_NOT_FOUND) {
+ efi_printk("efi_load_initrd_dev_path() failed!\n");
+ goto fail;
+ }
}
/*
--
2.17.1
Powered by blists - more mailing lists