From patchwork Mon Feb 6 11:22:44 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 93407 Delivered-To: patch@linaro.org Received: by 10.140.20.99 with SMTP id 90csp1660995qgi; Mon, 6 Feb 2017 03:24:01 -0800 (PST) X-Received: by 10.99.217.17 with SMTP id r17mr12820064pgg.140.1486380241731; Mon, 06 Feb 2017 03:24:01 -0800 (PST) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 1si422082plk.2.2017.02.06.03.24.01; Mon, 06 Feb 2017 03:24:01 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-efi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of linux-efi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-efi-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751795AbdBFLXv (ORCPT + 2 others); Mon, 6 Feb 2017 06:23:51 -0500 Received: from mail-wm0-f50.google.com ([74.125.82.50]:38035 "EHLO mail-wm0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751807AbdBFLXu (ORCPT ); Mon, 6 Feb 2017 06:23:50 -0500 Received: by mail-wm0-f50.google.com with SMTP id r141so109555018wmg.1 for ; Mon, 06 Feb 2017 03:23:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=lDQ2OaigcAMTMQ5VbkvX/iwztMxUUK1a1KJQ6rOZmPI=; b=iJJ3dKOr2eA75VL1FqT8mu8Okhzg6ImFWKbwXXMPStWVsSTi7ia0twaoYySZt/bya4 BlL1gW+JeGRxmfBdw7CTZoPF4bZzOu0P6HNMsHCP3AKtECmV72owWSFiKZ8iM2ZpDYGf rxfB3Ga1odTNIc1mOX8q1xFDW4RsfsrnjuYSo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=lDQ2OaigcAMTMQ5VbkvX/iwztMxUUK1a1KJQ6rOZmPI=; b=A6ms0nCrG0ZhfPSIapdNhVGkktkvwCaCAGQiMyueCgCmwPEegprBWtOivXibuRbOZZ J0BzdFIC0CFHLR0fiiaPJX+JNEbh3i7qw55ocmc6QzEech9CcpAr76ruqkWYutT9v73G XXMzGr4BiCPLX/gw8Lh/pvf80RUCpu6O28zNdT/hlXhTzSIk5rpXtA8KDkz87FNoI9Px cClG3WXo4ttz1nGVSYa8nb8GS7/OI+t/eheFhXoVeYaA5TnY6FbjDFFKlQbyJWMh/EA8 1wjD89EdKv9kMf5WMvPE3wF54iwvbav2eqHI8HXx/EbfZakbIQq4EwskYaJ44n6kvdBS COHg== X-Gm-Message-State: AMke39ljSto9AD48FAHigs+l06zitt0LxGXewWLed5L8cdCS0RSHlTgxsnPY4T3vZK/cPsJH X-Received: by 10.28.148.76 with SMTP id w73mr8467246wmd.43.1486380228776; Mon, 06 Feb 2017 03:23:48 -0800 (PST) Received: from localhost.localdomain ([160.169.163.122]) by smtp.gmail.com with ESMTPSA id o70sm903698wrc.20.2017.02.06.03.23.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 06 Feb 2017 03:23:48 -0800 (PST) From: Ard Biesheuvel To: matt@codeblueprint.co.uk, Ingo Molnar , Thomas Gleixner , "H . Peter Anvin" Cc: Josh Boyer , Ard Biesheuvel , linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, David Howells Subject: [PATCH 5/7] efi: Disable secure boot if shim is in insecure mode Date: Mon, 6 Feb 2017 11:22:44 +0000 Message-Id: <1486380166-31868-6-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1486380166-31868-1-git-send-email-ard.biesheuvel@linaro.org> References: <1486380166-31868-1-git-send-email-ard.biesheuvel@linaro.org> Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org From: Josh Boyer A user can manually tell the shim boot loader to disable validation of images it loads. When a user does this, it creates a UEFI variable called MokSBState that does not have the runtime attribute set. Given that the user explicitly disabled validation, we can honor that and not enable secure boot mode if that variable is set. Signed-off-by: Josh Boyer Signed-off-by: David Howells Cc: Matt Fleming Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/libstub/secureboot.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c index 62d6904da800..766ac06dac84 100644 --- a/drivers/firmware/efi/libstub/secureboot.c +++ b/drivers/firmware/efi/libstub/secureboot.c @@ -23,6 +23,12 @@ static const efi_char16_t const efi_SetupMode_name[] = { 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 }; +/* SHIM variables */ +static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; +static efi_char16_t const shim_MokSBState_name[] = { + 'M', 'o', 'k', 'S', 'B', 'S', 't', 'a', 't', 'e', 0 +}; + #define get_efi_var(name, vendor, ...) \ efi_call_runtime(get_variable, \ (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ @@ -33,7 +39,8 @@ static const efi_char16_t const efi_SetupMode_name[] = { */ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) { - u8 secboot, setupmode; + u32 attr; + u8 secboot, setupmode, moksbstate; unsigned long size; efi_status_t status; @@ -52,6 +59,22 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) if (secboot == 0 || setupmode == 1) return efi_secureboot_mode_disabled; + /* + * See if a user has put shim into insecure mode. If so, and if the + * variable doesn't have the runtime attribute set, we might as well + * honor that. + */ + size = sizeof(moksbstate); + status = get_efi_var(shim_MokSBState_name, &shim_guid, + &attr, &size, &moksbstate); + + /* If it fails, we don't care why. Default to secure */ + if (status != EFI_SUCCESS) + goto secure_boot_enabled; + if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1) + return efi_secureboot_mode_disabled; + +secure_boot_enabled: pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); return efi_secureboot_mode_enabled;