From 44cee23d139fe8faaca2622cc09041b1d684265b Mon Sep 17 00:00:00 2001

From: Peter Jones <pjones@redhat.com>

Date: Tue, 5 Jun 2012 09:23:25 -0400

Subject: [PATCH] Support secure boot.

If SecureBoot is enabled, treat all authentications as failure, and also

use shim's verify routine to verify the kernel before loading.

---

 grub-core/loader/i386/linux.c |   26 +++++++++++++

 grub-core/normal/auth.c       |   85 +++++++++++++++++++++++++++++++++++++++++

 grub-core/normal/main.c       |    4 +-

 grub-core/normal/menu_entry.c |    5 ++-

 include/grub/auth.h           |    3 ++

 5 files changed, 121 insertions(+), 2 deletions(-)

diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c

index 6e8238e..090484c 100644

--- a/grub-core/loader/i386/linux.c

+++ b/grub-core/loader/i386/linux.c

@@ -34,6 +34,7 @@

 #include <grub/i386/relocator.h>

 #include <grub/i18n.h>

 #include <grub/lib/cmdline.h>

+#include <grub/auth.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -681,6 +682,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),

   int relocatable;

   grub_uint64_t preffered_address = GRUB_LINUX_BZIMAGE_ADDR;

+  void *buffer;

+  grub_err_t verified;

+

   grub_dl_ref (my_mod);

   if (argc == 0)

@@ -693,6 +697,28 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),

   if (! file)

     goto fail;

+  buffer = grub_malloc(grub_file_size(file));

+  if (!buffer)

+    return grub_errno;

+

+  if (grub_file_read (file, buffer, grub_file_size(file)))

+    {

+      if (!grub_errno)

+	grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),

+		    argv[0]);

+      goto fail;

+    }

+

+  verified = grub_auth_verify_signature(buffer, grub_file_size(file));

+  grub_free(buffer);

+  if (verified != GRUB_ERR_NONE)

+    {

+      grub_errno = verified;

+      goto fail;

+    }

+

+  grub_free(buffer);

+  grub_file_seek(file, 0);

   if (grub_file_read (file, &lh, sizeof (lh)) != sizeof (lh))

     {

       if (!grub_errno)

diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c

index c6bd96e..3e83ee8 100644

--- a/grub-core/normal/auth.c

+++ b/grub-core/normal/auth.c

@@ -24,6 +24,8 @@

 #include <grub/normal.h>

 #include <grub/time.h>

 #include <grub/i18n.h>

+#include <grub/efi/api.h>

+#include <grub/efi/efi.h>

 struct grub_auth_user

 {

@@ -198,6 +200,89 @@ grub_username_get (char buf[], unsigned buf_size)

 }

 grub_err_t

+grub_auth_secure_boot (void)

+{

+#ifdef GRUB_MACHINE_EFI

+  grub_size_t datasize = 0;

+  grub_uint8_t *data;

+  grub_efi_guid_t guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;

+  unsigned int x;

+

+  data = grub_efi_get_variable ("SecureBoot", &guid, &datasize);

+  if (!data)

+    return GRUB_ERR_NONE;

+

+  for (x = 0; x < datasize; x++)

+    if (data[x] == 1)

+      return GRUB_ACCESS_DENIED;

+#endif

+

+  return GRUB_ERR_NONE;

+}

+

+int

+grub_is_secure_boot (void)

+{

+  return grub_auth_secure_boot() == GRUB_ACCESS_DENIED;

+}

+

+#define SHIM_LOCK_GUID \

+  { 0x605dab50, 0xe046, 0x4300, {0xab,0xb6,0x3d,0xd8,0x10,0xdd,0x8b,0x23} }

+

+typedef grub_efi_status_t (*EFI_SHIM_LOCK_VERIFY)(void *buffer, grub_efi_uint32_t size);

+

+typedef struct _SHIM_LOCK {

+    EFI_SHIM_LOCK_VERIFY Verify;

+} SHIM_LOCK;

+

+grub_err_t

+grub_auth_verify_signature (void *buffer, grub_uint32_t size)

+{

+#ifdef GRUB_MACHINE_EFI

+  grub_efi_guid_t shim_guid = SHIM_LOCK_GUID;

+  SHIM_LOCK *shim = NULL;

+  grub_efi_handle_t *handles, shim_handle = NULL;

+  grub_efi_uintn_t num_handles, i;

+  grub_efi_status_t status;

+

+  if (!grub_is_secure_boot())

+    return GRUB_ERR_NONE;

+

+  handles = grub_efi_locate_handle (GRUB_EFI_BY_PROTOCOL, &shim_guid, NULL,

+				    &num_handles);

+  if (!handles || num_handles == 0)

+no_verify:

+    return grub_error (GRUB_ACCESS_DENIED, "Could not find signature verification routine");

+

+  for (i = 0; i < num_handles; i++)

+    {

+      shim_handle = handles[i];

+      shim = grub_efi_open_protocol (shim_handle, &shim_guid,

+				     GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);

+      if (shim)

+	break;

+    }

+

+  if (!shim)

+    {

+      grub_free(handles);

+      goto no_verify;

+    }

+

+  status = shim->Verify(buffer, size);

+

+  grub_free(handles);

+

+  if (status == GRUB_EFI_SUCCESS)

+    return GRUB_ERR_NONE;

+

+  return grub_error (GRUB_ACCESS_DENIED, "Signature verification failed");

+#else

+  return GRUB_ERR_NONE;

+#endif

+}

+

+grub_err_t

 grub_auth_check_authentication (const char *userlist)

 {

   char login[1024];

diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c

index 193d7d3..1e321a4 100644

--- a/grub-core/normal/main.c

+++ b/grub-core/normal/main.c

@@ -455,7 +455,9 @@ grub_cmdline_run (int nested)

 {

   grub_err_t err = GRUB_ERR_NONE;

-  err = grub_auth_check_authentication (NULL);

+  err = grub_auth_secure_boot ();

+  if (err == GRUB_ERR_NONE)

+    err = grub_auth_check_authentication (NULL);

   if (err)

     {

diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c

index 7fc890d..4e7a08c 100644

--- a/grub-core/normal/menu_entry.c

+++ b/grub-core/normal/menu_entry.c

@@ -1287,7 +1287,10 @@ grub_menu_entry_run (grub_menu_entry_t entry)

   unsigned i;

   grub_term_output_t term;

-  err = grub_auth_check_authentication (NULL);

+

+  err = grub_auth_secure_boot ();

+  if (err == GRUB_ERR_NONE)

+    err = grub_auth_check_authentication (NULL);

   if (err)

     {

diff --git a/include/grub/auth.h b/include/grub/auth.h

index 7473344..b933fa1 100644

--- a/include/grub/auth.h

+++ b/include/grub/auth.h

@@ -32,6 +32,9 @@ grub_err_t grub_auth_unregister_authentication (const char *user);

 grub_err_t grub_auth_authenticate (const char *user);

 grub_err_t grub_auth_deauthenticate (const char *user);

+grub_err_t grub_auth_secure_boot (void);

+int grub_is_secure_boot (void);

+grub_err_t grub_auth_verify_signature (void *buffer, grub_uint32_t size);

 grub_err_t grub_auth_check_authentication (const char *userlist);

 #endif /* ! GRUB_AUTH_HEADER */

-- 

1.7.10.2