d6d145b71a
- Power guest secure boot with static keys: GRUB2 signing portion (jsc#SLE-18271) (bsc#1192764) * grub2.spec - Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144) (bsc#1192686) * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch * 0002-ieee1275-claim-more-memory.patch * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch * 0005-docs-grub-Document-signing-grub-under-UEFI.patch * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch * 0008-pgp-factor-out-rsa_pad.patch * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch * 0011-libtasn1-import-libtasn1-4.18.0.patch * 0012-libtasn1-disable-code-not-needed-in-grub.patch * 0013-libtasn1-changes-for-grub-compatibility.patch * 0014-libtasn1-compile-into-asn1-module.patch * 0015-test_asn1-test-module-for-libtasn1.patch * 0016-grub-install-support-embedding-x509-certificates.patch * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch * 0019-appended-signatures-support-verifying-appended-signa.patch * 0020-appended-signatures-verification-tests.patch * 0021-appended-signatures-documentation.patch * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch - Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090) OBS-URL: https://build.opensuse.org/request/show/945751 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=401
113 lines
3.4 KiB
Diff
113 lines
3.4 KiB
Diff
From 806bb18c3493537530b6b0387143752478078f5b Mon Sep 17 00:00:00 2001
|
|
From: Daniel Axtens <dja@axtens.net>
|
|
Date: Mon, 28 Sep 2020 11:11:17 +1000
|
|
Subject: [PATCH 22/23] ieee1275: enter lockdown based on /ibm,secure-boot
|
|
|
|
If the 'ibm,secure-boot' property of the root node is 2 or greater,
|
|
enter lockdown.
|
|
|
|
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
---
|
|
docs/grub.texi | 4 ++--
|
|
grub-core/Makefile.core.def | 1 +
|
|
grub-core/kern/ieee1275/init.c | 27 +++++++++++++++++++++++++++
|
|
include/grub/lockdown.h | 3 ++-
|
|
4 files changed, 32 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/docs/grub.texi b/docs/grub.texi
|
|
index 988ef8ddc..f4794fdda 100644
|
|
--- a/docs/grub.texi
|
|
+++ b/docs/grub.texi
|
|
@@ -6208,8 +6208,8 @@ Measured boot is currently only supported on EFI platforms.
|
|
@section Lockdown when booting on a secure setup
|
|
|
|
The GRUB can be locked down when booted on a secure boot environment, for example
|
|
-if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
|
|
-be restricted and some operations/commands cannot be executed.
|
|
+if UEFI or Power secure boot is enabled. On a locked down configuration, the
|
|
+GRUB will be restricted and some operations/commands cannot be executed.
|
|
|
|
The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
|
|
Otherwise it does not exit.
|
|
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
|
|
index 88eedd16d..49bdb63b6 100644
|
|
--- a/grub-core/Makefile.core.def
|
|
+++ b/grub-core/Makefile.core.def
|
|
@@ -317,6 +317,7 @@ kernel = {
|
|
powerpc_ieee1275 = kern/powerpc/cache.S;
|
|
powerpc_ieee1275 = kern/powerpc/dl.c;
|
|
powerpc_ieee1275 = kern/powerpc/compiler-rt.S;
|
|
+ powerpc_ieee1275 = kern/lockdown.c;
|
|
|
|
sparc64_ieee1275 = kern/sparc64/cache.S;
|
|
sparc64_ieee1275 = kern/sparc64/dl.c;
|
|
diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
|
|
index 446201165..d77d89604 100644
|
|
--- a/grub-core/kern/ieee1275/init.c
|
|
+++ b/grub-core/kern/ieee1275/init.c
|
|
@@ -44,6 +44,7 @@
|
|
#ifdef __sparc__
|
|
#include <grub/machine/kernel.h>
|
|
#endif
|
|
+#include <grub/lockdown.h>
|
|
|
|
/* The maximum heap size we're going to claim. Not used by sparc.
|
|
We allocate 1/4 of the available memory under 4G, up to this limit. */
|
|
@@ -440,6 +441,30 @@ grub_parse_cmdline (void)
|
|
}
|
|
}
|
|
|
|
+static void
|
|
+grub_get_ieee1275_secure_boot (void)
|
|
+{
|
|
+ grub_ieee1275_phandle_t root;
|
|
+ int rc;
|
|
+ grub_uint32_t is_sb;
|
|
+
|
|
+ grub_ieee1275_finddevice ("/", &root);
|
|
+
|
|
+ rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", &is_sb,
|
|
+ sizeof (is_sb), 0);
|
|
+
|
|
+ /* ibm,secure-boot:
|
|
+ * 0 - disabled
|
|
+ * 1 - audit
|
|
+ * 2 - enforce
|
|
+ * 3 - enforce + OS-specific behaviour
|
|
+ *
|
|
+ * We only support enforce.
|
|
+ */
|
|
+ if (rc >= 0 && is_sb >= 2)
|
|
+ grub_lockdown ();
|
|
+}
|
|
+
|
|
grub_addr_t grub_modbase;
|
|
|
|
void
|
|
@@ -465,6 +490,8 @@ grub_machine_init (void)
|
|
#else
|
|
grub_install_get_time_ms (grub_rtc_get_time_ms);
|
|
#endif
|
|
+
|
|
+ grub_get_ieee1275_secure_boot ();
|
|
}
|
|
|
|
void
|
|
diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
|
|
index 40531fa82..ebfee4bf0 100644
|
|
--- a/include/grub/lockdown.h
|
|
+++ b/include/grub/lockdown.h
|
|
@@ -24,7 +24,8 @@
|
|
#define GRUB_LOCKDOWN_DISABLED 0
|
|
#define GRUB_LOCKDOWN_ENABLED 1
|
|
|
|
-#ifdef GRUB_MACHINE_EFI
|
|
+#if defined(GRUB_MACHINE_EFI) || \
|
|
+ (defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275))
|
|
extern void
|
|
EXPORT_FUNC (grub_lockdown) (void);
|
|
extern int
|
|
--
|
|
2.31.1
|
|
|