linux-kernel - Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sat, 12 Feb 2022 05:53:47 +0000
From:   Aditya Garg <gargaditya08@...e.com>
To:     Matthew Garrett <mjg59@...f.ucam.org>
CC:     Ard Biesheuvel <ardb@...nel.org>, Jeremy Kerr <jk@...abs.org>,
        "joeyli.kernel@...il.com" <joeyli.kernel@...il.com>,
        "zohar@...ux.ibm.com" <zohar@...ux.ibm.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "eric.snowberg@...cle.com" <eric.snowberg@...cle.com>,
        "dhowells@...hat.com" <dhowells@...hat.com>,
        "jlee@...e.com" <jlee@...e.com>,
        "James.Bottomley@...senpartnership.com" 
        <James.Bottomley@...senPartnership.com>,
        "jarkko@...nel.org" <jarkko@...nel.org>,
        "mic@...ikod.net" <mic@...ikod.net>,
        "dmitry.kasatkin@...il.com" <dmitry.kasatkin@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        Orlando Chamberlain <redecorating@...tonmail.com>,
        Aun-Ali Zaidi <admin@...eit.net>
Subject: Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for
 T2 Macs



> 
> Oh gosh I'm an idiot. Please try this one instead.
> 

Looks like EFI variable MokIgnoreDB-605dab50-e046-4300-abb6-3dd810dd8b23 and EFI variable db-d719b2cb-3d3a-4596-a3bc-dad00e67656f are causing issues

Feb 12 11:01:52 MacBook kernel: Reading EFI variable MokIgnoreDB-605dab50-e046-4300-abb6-3dd810dd8b23
Feb 12 11:01:52 MacBook kernel: Reading EFI variable db-d719b2cb-3d3a-4596-a3bc-dad00e67656f
Feb 12 11:01:52 MacBook kernel: ------------[ cut here ]------------
Feb 12 11:01:52 MacBook kernel: [Firmware Bug]: Page fault caused by firmware at PA: 0xffffbc34c0068000
Feb 12 11:01:52 MacBook kernel: WARNING: CPU: 7 PID: 98 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xf0
Feb 12 11:01:52 MacBook kernel: Modules linked in:
Feb 12 11:01:52 MacBook kernel: CPU: 7 PID: 98 Comm: kworker/u24:1 Not tainted 5.16.8-t2 #2
Feb 12 11:01:52 MacBook kernel: Hardware name: Apple Inc. MacBookPro16,1/Mac-E1008331FDC96864, BIOS 1715.81.2.0.0 (iBridge: 19.16.10744.0.0,0) 01/06/2022
Feb 12 11:01:52 MacBook kernel: Workqueue: efi_rts_wq efi_call_rts
Feb 12 11:01:52 MacBook kernel: RIP: 0010:efi_crash_gracefully_on_page_fault+0x50/0xf0
Feb 12 11:01:52 MacBook kernel: Code: fc e8 44 30 03 00 49 81 fc ff 0f 00 00 76 08 48 3d 50 04 3c 9b 74 04 41 5c 5d c3 4c 89 e6 48 c7 c7 c0 00 7c 9a e8 69 71 be 00 <0f> 0b 83 3d 87 62 11 02 0a 0f 84 0a 62 be 00 e8 bc 1b 00 00 48 8b
Feb 12 11:01:52 MacBook kernel: RSP: 0000:ffffbc34c03f29d8 EFLAGS: 00010086
Feb 12 11:01:52 MacBook kernel: RAX: 0000000000000000 RBX: ffffbc34c03f2a18 RCX: 0000000000000000
Feb 12 11:01:52 MacBook kernel: RDX: 0000000000000003 RSI: ffffbc34c03f2820 RDI: 00000000ffffffff
Feb 12 11:01:52 MacBook kernel: RBP: ffffbc34c03f29e0 R08: 0000000000000003 R09: 0000000000000001
Feb 12 11:01:52 MacBook kernel: R10: ffff9f6801685640 R11: 0000000000000001 R12: ffffbc34c0068000
Feb 12 11:01:52 MacBook kernel: R13: 0000000000000000 R14: ffffbc34c03f2b68 R15: ffff9f6801233380
Feb 12 11:01:52 MacBook kernel: FS:  0000000000000000(0000) GS:ffff9f6b6ebc0000(0000) knlGS:0000000000000000
Feb 12 11:01:52 MacBook kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Feb 12 11:01:52 MacBook kernel: CR2: ffffbc34c0068000 CR3: 00000001001ec002 CR4: 00000000003706e0
Feb 12 11:01:52 MacBook kernel: Call Trace:
Feb 12 11:01:52 MacBook kernel:  <TASK>
Feb 12 11:01:52 MacBook kernel:  page_fault_oops+0x4f/0x2c0
Feb 12 11:01:52 MacBook kernel:  ? search_bpf_extables+0x6b/0x80
Feb 12 11:01:52 MacBook kernel:  ? search_module_extables+0x50/0x80
Feb 12 11:01:52 MacBook kernel:  ? search_exception_tables+0x5b/0x60
Feb 12 11:01:52 MacBook kernel:  kernelmode_fixup_or_oops+0x9e/0x110
Feb 12 11:01:52 MacBook kernel:  __bad_area_nosemaphore+0x155/0x190
Feb 12 11:01:52 MacBook kernel:  bad_area_nosemaphore+0x16/0x20
Feb 12 11:01:52 MacBook kernel:  do_kern_addr_fault+0x8c/0xa0
Feb 12 11:01:52 MacBook kernel:  exc_page_fault+0xd8/0x180
Feb 12 11:01:52 MacBook kernel:  asm_exc_page_fault+0x1e/0x30
Feb 12 11:01:52 MacBook kernel: RIP: 0010:0xfffffffeefc440c5
Feb 12 11:01:52 MacBook kernel: Code: 31 c9 48 29 f9 48 83 e1 0f 74 0c 4c 39 c1 49 0f 47 c8 49 29 c8 f3 a4 4c 89 c1 49 83 e0 0f 48 c1 e9 04 74 2c f3 0f 7f 44 24 18 <f3> 0f 6f 06 66 0f e7 07 48 83 c6 10 48 83 c7 10 e2 ee 0f ae f0 66
Feb 12 11:01:52 MacBook kernel: RSP: 0000:ffffbc34c03f2c18 EFLAGS: 00010286
Feb 12 11:01:52 MacBook kernel: RAX: fffffffeefc9205a RBX: ffffffff9a81787a RCX: 0000000000000033
Feb 12 11:01:52 MacBook kernel: RDX: ffffbc34c0067d20 RSI: ffffbc34c0067ff6 RDI: fffffffeefc92330
Feb 12 11:01:52 MacBook kernel: RBP: ffffbc34c03f2ca0 R08: 0000000000000001 R09: ffffbc34c0068326
Feb 12 11:01:52 MacBook kernel: R10: fffffffeefc8e018 R11: 000000000019f2a5 R12: 0000000000000000
Feb 12 11:01:52 MacBook kernel: R13: ffffbc34c0067db0 R14: ffffbc34c0067d01 R15: 0000000000000607
Feb 12 11:01:52 MacBook kernel:  ? __efi_call+0x28/0x30
Feb 12 11:01:52 MacBook kernel:  ? switch_mm+0x20/0x30
Feb 12 11:01:52 MacBook kernel:  ? efi_call_rts+0x20d/0x970
Feb 12 11:01:52 MacBook kernel:  ? process_one_work+0x222/0x3f0
Feb 12 11:01:52 MacBook kernel:  ? worker_thread+0x4a/0x3d0
Feb 12 11:01:52 MacBook kernel:  ? kthread+0x17a/0x1a0
Feb 12 11:01:52 MacBook kernel:  ? process_one_work+0x3f0/0x3f0
Feb 12 11:01:52 MacBook kernel:  ? set_kthread_struct+0x40/0x40
Feb 12 11:01:52 MacBook kernel:  ? ret_from_fork+0x22/0x30
Feb 12 11:01:52 MacBook kernel:  </TASK>
Feb 12 11:01:52 MacBook kernel: ---[ end trace c81d89c8fdfe87c4 ]---
Feb 12 11:01:52 MacBook kernel: efi: Froze efi_rts_wq and disabled EFI Runtime Services
Feb 12 11:01:52 MacBook kernel: integrity: Couldn't get size: 0x8000000000000015
Feb 12 11:01:52 MacBook kernel: integrity: MODSIGN: Couldn't get UEFI db list
Feb 12 11:01:52 MacBook kernel: efi: EFI Runtime Services are disabled!
Feb 12 11:01:52 MacBook kernel: integrity: Couldn't get size: 0x8000000000000015
Feb 12 11:01:52 MacBook kernel: integrity: Couldn't get UEFI dbx list
Feb 12 11:01:52 MacBook kernel: integrity: Couldn't get size: 0x8000000000000015
Feb 12 11:01:52 MacBook kernel: integrity: Couldn't get mokx list
Feb 12 11:01:52 MacBook kernel: integrity: Couldn't get size: 0x8000000000000015
Feb 12 11:01:52 MacBook kernel: integrity: Couldn't get UEFI MokListRT


The full journalctl log is here on https://gist.githubusercontent.com/AdityaGarg8/8e820c2724a65fb4bbb5deae2b358dc8/raw/c71e13036426211cbd590fdfabe5f88531bac645/log.log


With CONFIG_LOAD_UEFI_KEYS=n, these variables are not seen and EFI Runtime Services work.