| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <c0b173d2-a7b8-41e3-ae5a-deafba2ba598@csgroup.eu>
Date: Thu, 23 Nov 2023 06:33:45 +0000
From: Christophe Leroy <christophe.leroy@...roup.eu>
To: Daniel Walker <danielwa@...co.com>, Will Deacon <will@...nel.org>,
Rob Herring <robh@...nel.org>,
Daniel Gimpelevich <daniel@...pelevich.san-francisco.ca.us>,
Andrew Morton <akpm@...ux-foundation.org>,
Pratyush Brahma <quic_pbrahma@...cinc.com>,
Tomas Mudrunka <tomas.mudrunka@...il.com>,
Sean Anderson <sean.anderson@...o.com>,
"x86@...nel.org" <x86@...nel.org>,
"linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
"linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>
CC: "xe-linux-external@...co.com" <xe-linux-external@...co.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/8] scripts: insert-sys-cert: add command line insert
capability
Le 10/11/2023 à 02:38, Daniel Walker a écrit :
> This adds changes to the insert-sys-cert tool to allow updating
> the cmdline_prepend and cmdline_append symbols in addition to
> adding certificates.
Nice feature.
>
> Updating the cmdline symbols was tested on a PVH virtual machine
> with a vmlinux, and with a bzImage which was repackaged on x86.
Can it also work with Uimages from uboot/ppc ?
>
> This commit intentionally keeps the tool filename the same to allow
> the changes to be seen more easily. The next commit will change
> the name of the tool.
Not sure what you mean.
If I understand correctly, git format-patch -M should do what you want.
>
> Cc: xe-linux-external@...co.com
> Signed-off-by: Daniel Walker <danielwa@...co.com>
> ---
> scripts/insert-sys-cert.c | 241 +++++++++++++++++++++++++++-----------
> 1 file changed, 170 insertions(+), 71 deletions(-)
>
> diff --git a/scripts/insert-sys-cert.c b/scripts/insert-sys-cert.c
> index 8902836c2342..77d3306cfbfb 100644
> --- a/scripts/insert-sys-cert.c
> +++ b/scripts/insert-sys-cert.c
> @@ -30,6 +30,9 @@
> #define USED_SYM "system_extra_cert_used"
> #define LSIZE_SYM "system_certificate_list_size"
>
> +#define CMDLINE_APPEND "cmdline_append"
> +#define CMDLINE_PREPEND "cmdline_prepend"
> +
> #define info(format, args...) fprintf(stderr, "INFO: " format, ## args)
> #define warn(format, args...) fprintf(stdout, "WARNING: " format, ## args)
> #define err(format, args...) fprintf(stderr, "ERROR: " format, ## args)
> @@ -267,95 +270,46 @@ static void print_sym(Elf_Ehdr *hdr, struct sym *s)
>
> static void print_usage(char *e)
> {
> - printf("Usage %s [-s <System.map>] -b <vmlinux> -c <certfile>\n", e);
> + printf("Usage %s [-s <System.map>] -b <vmlinux> [ -c <certfile> | -p <command line prepend> | -a <command line append> ]-\n", e);
> }
>
> -int main(int argc, char **argv)
> +static char *cmdline_prepend, *cmdline_append;
> +static char *system_map_file;
> +static char *cert_file;
> +static char *cli_name;
> +
> +static int insert_certificate(Elf_Ehdr *hdr)
> {
> - char *system_map_file = NULL;
> - char *vmlinux_file = NULL;
> - char *cert_file = NULL;
> - int vmlinux_size;
> + struct sym cert_sym, lsize_sym, used_sym;
> + Elf_Shdr *symtab = NULL;
> + unsigned long *lsize;
> + FILE *system_map;
> int cert_size;
> - Elf_Ehdr *hdr;
> char *cert;
> - FILE *system_map;
> - unsigned long *lsize;
> int *used;
> - int opt;
> - Elf_Shdr *symtab = NULL;
> - struct sym cert_sym, lsize_sym, used_sym;
> -
> - while ((opt = getopt(argc, argv, "b:c:s:")) != -1) {
> - switch (opt) {
> - case 's':
> - system_map_file = optarg;
> - break;
> - case 'b':
> - vmlinux_file = optarg;
> - break;
> - case 'c':
> - cert_file = optarg;
> - break;
> - default:
> - break;
> - }
> - }
>
> - if (!vmlinux_file || !cert_file) {
> - print_usage(argv[0]);
> - exit(EXIT_FAILURE);
> + if (!cert_file) {
> + print_usage(cli_name);
> + return EXIT_FAILURE;
> }
>
> cert = read_file(cert_file, &cert_size);
> if (!cert)
> - exit(EXIT_FAILURE);
> -
> - hdr = map_file(vmlinux_file, &vmlinux_size);
> - if (!hdr)
> - exit(EXIT_FAILURE);
> -
> - if (vmlinux_size < sizeof(*hdr)) {
> - err("Invalid ELF file.\n");
> - exit(EXIT_FAILURE);
> - }
> -
> - if ((hdr->e_ident[EI_MAG0] != ELFMAG0) ||
> - (hdr->e_ident[EI_MAG1] != ELFMAG1) ||
> - (hdr->e_ident[EI_MAG2] != ELFMAG2) ||
> - (hdr->e_ident[EI_MAG3] != ELFMAG3)) {
> - err("Invalid ELF magic.\n");
> - exit(EXIT_FAILURE);
> - }
> -
> - if (hdr->e_ident[EI_CLASS] != CURRENT_ELFCLASS) {
> - err("ELF class mismatch.\n");
> - exit(EXIT_FAILURE);
> - }
> -
> - if (hdr->e_ident[EI_DATA] != endianness()) {
> - err("ELF endian mismatch.\n");
> - exit(EXIT_FAILURE);
> - }
> -
> - if (hdr->e_shoff > vmlinux_size) {
> - err("Could not find section header.\n");
> - exit(EXIT_FAILURE);
> - }
> + return EXIT_FAILURE;
>
> symtab = get_symbol_table(hdr);
> if (!symtab) {
> warn("Could not find the symbol table.\n");
> if (!system_map_file) {
> err("Please provide a System.map file.\n");
> - print_usage(argv[0]);
> - exit(EXIT_FAILURE);
> + print_usage(cli_name);
> + return EXIT_FAILURE;
> }
>
> system_map = fopen(system_map_file, "r");
> if (!system_map) {
> perror(system_map_file);
> - exit(EXIT_FAILURE);
> + return EXIT_FAILURE;
> }
> get_symbol_from_map(hdr, system_map, CERT_SYM, &cert_sym);
> get_symbol_from_map(hdr, system_map, USED_SYM, &used_sym);
> @@ -371,7 +325,7 @@ int main(int argc, char **argv)
> }
>
> if (!cert_sym.offset || !lsize_sym.offset || !used_sym.offset)
> - exit(EXIT_FAILURE);
> + return EXIT_FAILURE;
>
> print_sym(hdr, &cert_sym);
> print_sym(hdr, &used_sym);
> @@ -382,14 +336,14 @@ int main(int argc, char **argv)
>
> if (cert_sym.size < cert_size) {
> err("Certificate is larger than the reserved area!\n");
> - exit(EXIT_FAILURE);
> + return EXIT_FAILURE;
> }
>
> /* If the existing cert is the same, don't overwrite */
> if (cert_size == *used &&
> strncmp(cert_sym.content, cert, cert_size) == 0) {
> warn("Certificate was already inserted.\n");
> - exit(EXIT_SUCCESS);
> + return EXIT_SUCCESS;
> }
>
> if (*used > 0)
> @@ -406,5 +360,150 @@ int main(int argc, char **argv)
> cert_sym.address);
> info("Used %d bytes out of %d bytes reserved.\n", *used,
> cert_sym.size);
> - exit(EXIT_SUCCESS);
> + return EXIT_SUCCESS;
> +}
> +
> +static int insert_cmdline(Elf_Ehdr *hdr)
> +{
> + struct sym cmdline_prepend_sym, cmdline_append_sym;
> + Elf_Shdr *symtab = NULL;
> + FILE *system_map;
> +
> + symtab = get_symbol_table(hdr);
> + if (!symtab) {
> + warn("Could not find the symbol table.\n");
> + if (!system_map_file) {
> + err("Please provide a System.map file.\n");
> + print_usage(cli_name);
> + return EXIT_FAILURE;
> + }
> +
> + system_map = fopen(system_map_file, "r");
> + if (!system_map) {
> + perror(system_map_file);
> + return EXIT_FAILURE;
> + }
> + get_symbol_from_map(hdr, system_map, CMDLINE_PREPEND, &cmdline_prepend_sym);
> + get_symbol_from_map(hdr, system_map, CMDLINE_APPEND, &cmdline_append_sym);
> + } else {
> + info("Symbol table found.\n");
> + if (system_map_file)
> + warn("System.map is ignored.\n");
> + get_symbol_from_table(hdr, symtab, CMDLINE_PREPEND, &cmdline_prepend_sym);
> + get_symbol_from_table(hdr, symtab, CMDLINE_APPEND, &cmdline_append_sym);
> + }
> +
> + print_sym(hdr, &cmdline_prepend_sym);
> + print_sym(hdr, &cmdline_append_sym);
> +
> +
> + if (cmdline_prepend) {
> + if ((strlen(cmdline_prepend) + 1) > cmdline_prepend_sym.size) {
> + err("cmdline prepend is larger than the reserved area!\n");
> + return EXIT_FAILURE;
> + }
> +
> + memcpy(cmdline_prepend_sym.content, cmdline_prepend, strlen(cmdline_prepend) + 1);
> + if ((strlen(cmdline_prepend) + 1) < cmdline_prepend_sym.size)
> + memset(cmdline_prepend_sym.content + strlen(cmdline_prepend) + 1,
> + 0, cmdline_prepend_sym.size - (strlen(cmdline_prepend) + 1));
> +
> + info("Inserted cmdline prepend of \"%s\" into vmlinux.\n", cmdline_prepend);
> +
> + }
> + if (cmdline_append) {
> + if ((strlen(cmdline_append) + 1) > cmdline_append_sym.size) {
> + err("cmdline append is larger than the reserved area!\n");
> + return EXIT_FAILURE;
> + }
> +
> + memcpy(cmdline_append_sym.content, cmdline_append, strlen(cmdline_append) + 1);
> + if ((strlen(cmdline_append) + 1) < cmdline_append_sym.size)
> + memset(cmdline_append_sym.content + strlen(cmdline_append) + 1,
> + 0, cmdline_append_sym.size - (strlen(cmdline_append) + 1));
> +
> + info("Inserted cmdline append of \"%s\" into vmlinux.\n", cmdline_append);
> +
> + }
> + return EXIT_SUCCESS;
> +}
> +
> +int main(int argc, char **argv)
> +{
> + char *vmlinux_file = NULL;
> + int vmlinux_size;
> + Elf_Ehdr *hdr;
> + int opt;
> + int ret = EXIT_SUCCESS;
> +
> + while ((opt = getopt(argc, argv, "b:c:s:p:a:")) != -1) {
> + switch (opt) {
> + case 's':
> + system_map_file = optarg;
> + break;
> + case 'b':
> + vmlinux_file = optarg;
> + break;
> + case 'c':
> + cert_file = optarg;
> + break;
> + case 'p':
> + cmdline_prepend = optarg;
> + break;
> + case 'a':
> + cmdline_append = optarg;
> + break;
> + default:
> + break;
> + }
> + }
> +
> + cli_name = argv[0];
> +
> + if (!vmlinux_file) {
> + print_usage(cli_name);
> + exit(EXIT_FAILURE);
> + }
> +
> + hdr = map_file(vmlinux_file, &vmlinux_size);
> + if (!hdr)
> + exit(EXIT_FAILURE);
> +
> + if (vmlinux_size < sizeof(*hdr)) {
> + err("Invalid ELF file.\n");
> + exit(EXIT_FAILURE);
> + }
> +
> + if ((hdr->e_ident[EI_MAG0] != ELFMAG0) ||
> + (hdr->e_ident[EI_MAG1] != ELFMAG1) ||
> + (hdr->e_ident[EI_MAG2] != ELFMAG2) ||
> + (hdr->e_ident[EI_MAG3] != ELFMAG3)) {
> + err("Invalid ELF magic.\n");
> + exit(EXIT_FAILURE);
> + }
> +
> + if (hdr->e_ident[EI_CLASS] != CURRENT_ELFCLASS) {
> + err("ELF class mismatch.\n");
> + exit(EXIT_FAILURE);
> + }
> +
> + if (hdr->e_ident[EI_DATA] != endianness()) {
> + err("ELF endian mismatch.\n");
> + exit(EXIT_FAILURE);
> + }
> +
> + if (hdr->e_shoff > vmlinux_size) {
> + err("Could not find section header.\n");
> + exit(EXIT_FAILURE);
> + }
> +
> + if (cert_file) {
> + ret = insert_certificate(hdr);
> + printf("%s\n", cert_file);
> + }
> +
> + if (cmdline_append || cmdline_prepend)
> + ret = insert_cmdline(hdr);
> +
> + exit(ret);
> }
Powered by blists - more mailing lists