94 lines
2.8 KiB
Diff
94 lines
2.8 KiB
Diff
From 139dc1c2590683cb8c0c1c13424d2436b81bffb7 Mon Sep 17 00:00:00 2001
|
|
From: Gary Lin <glin@suse.com>
|
|
Date: Mon, 18 Mar 2024 14:53:11 +0800
|
|
Subject: [PATCH] key_protector: implement the blocklist
|
|
|
|
Some architectures may need to do the additional check to avoid leaking
|
|
the recovered key. This commit adds an additional check for the EFI
|
|
system to detect the deprecated SystemdOptions variable. Once the
|
|
variable is spotted, key_protector just returns without the further
|
|
action for the key recovery.
|
|
|
|
Signed-off-by: Gary Lin <glin@suse.com>
|
|
---
|
|
grub-core/kern/protectors.c | 31 +++++++++++++++++++++++++++++++
|
|
include/grub/efi/api.h | 5 +++++
|
|
2 files changed, 36 insertions(+)
|
|
|
|
Index: grub-2.12/grub-core/kern/protectors.c
|
|
===================================================================
|
|
--- grub-2.12.orig/grub-core/kern/protectors.c
|
|
+++ grub-2.12/grub-core/kern/protectors.c
|
|
@@ -21,6 +21,10 @@
|
|
#include <grub/mm.h>
|
|
#include <grub/protector.h>
|
|
|
|
+#ifdef GRUB_MACHINE_EFI
|
|
+#include <grub/efi/efi.h>
|
|
+#endif
|
|
+
|
|
struct grub_key_protector *grub_key_protectors = NULL;
|
|
|
|
grub_err_t
|
|
@@ -51,11 +55,34 @@ grub_key_protector_unregister (struct gr
|
|
return GRUB_ERR_NONE;
|
|
}
|
|
|
|
+static grub_err_t
|
|
+grub_key_protector_check_blocklist (void)
|
|
+{
|
|
+#ifdef GRUB_MACHINE_EFI
|
|
+ static grub_guid_t systemd_guid = GRUB_EFI_SYSTEMD_GUID;
|
|
+ grub_efi_status_t status;
|
|
+ grub_size_t size = 0;
|
|
+ grub_uint8_t *systemdoptions = NULL;
|
|
+
|
|
+ /* SystemdOptions may contain malicious kernel command lines. */
|
|
+ status = grub_efi_get_variable ("SystemdOptions", &systemd_guid,
|
|
+ &size, (void **) &systemdoptions);
|
|
+ if (status != GRUB_EFI_NOT_FOUND)
|
|
+ {
|
|
+ grub_free (systemdoptions);
|
|
+ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("SystemdOptions detected"));
|
|
+ }
|
|
+#endif
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
grub_err_t
|
|
grub_key_protector_recover_key (const char *protector, grub_uint8_t **key,
|
|
grub_size_t *key_size)
|
|
{
|
|
struct grub_key_protector *kp = NULL;
|
|
+ grub_err_t err;
|
|
|
|
if (grub_key_protectors == NULL)
|
|
return GRUB_ERR_OUT_OF_RANGE;
|
|
@@ -71,5 +98,9 @@ grub_key_protector_recover_key (const ch
|
|
"Is the name spelled correctly and is the "
|
|
"corresponding module loaded?"), protector);
|
|
|
|
+ err = grub_key_protector_check_blocklist ();
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ return err;
|
|
+
|
|
return kp->recover_key (key, key_size);
|
|
}
|
|
Index: grub-2.12/include/grub/efi/api.h
|
|
===================================================================
|
|
--- grub-2.12.orig/include/grub/efi/api.h
|
|
+++ grub-2.12/include/grub/efi/api.h
|
|
@@ -389,6 +389,11 @@
|
|
{ 0x89, 0x29, 0x48, 0xbc, 0xd9, 0x0a, 0xd3, 0x1a } \
|
|
}
|
|
|
|
+#define GRUB_EFI_SYSTEMD_GUID \
|
|
+ { 0x8cf2644b, 0x4b0b, 0x428f, \
|
|
+ { 0x93, 0x87, 0x6d, 0x87, 0x60, 0x50, 0xdc, 0x67 } \
|
|
+ }
|
|
+
|
|
struct grub_efi_sal_system_table
|
|
{
|
|
grub_uint32_t signature;
|