dbc4a9
From: Matthew Garrett <matthew.garrett@nebula.com>
dbc4a9
Date: Fri, 9 Aug 2013 18:36:30 -0400
dbc4a9
Subject: [PATCH] Add option to automatically enforce module signatures when in
dbc4a9
 Secure Boot mode
dbc4a9
dbc4a9
UEFI Secure Boot provides a mechanism for ensuring that the firmware will
dbc4a9
only load signed bootloaders and kernels. Certain use cases may also
dbc4a9
require that all kernel modules also be signed. Add a configuration option
dbc4a9
that enforces this automatically when enabled.
dbc4a9
dbc4a9
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
dbc4a9
---
dbc4a9
 Documentation/x86/zero-page.txt       |  2 ++
dbc4a9
 arch/x86/Kconfig                      | 10 ++++++++++
dbc4a9
 arch/x86/boot/compressed/eboot.c      | 36 +++++++++++++++++++++++++++++++++++
dbc4a9
 arch/x86/include/uapi/asm/bootparam.h |  3 ++-
dbc4a9
 arch/x86/kernel/setup.c               |  6 ++++++
dbc4a9
 include/linux/module.h                |  6 ++++++
dbc4a9
 kernel/module.c                       |  7 +++++++
dbc4a9
 7 files changed, 69 insertions(+), 1 deletion(-)
dbc4a9
dbc4a9
diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
dbc4a9
index 199f453cb4de..ec38acf00b40 100644
dbc4a9
--- a/Documentation/x86/zero-page.txt
dbc4a9
+++ b/Documentation/x86/zero-page.txt
dbc4a9
@@ -30,6 +30,8 @@ Offset	Proto	Name		Meaning
dbc4a9
 1E9/001	ALL	eddbuf_entries	Number of entries in eddbuf (below)
dbc4a9
 1EA/001	ALL	edd_mbr_sig_buf_entries	Number of entries in edd_mbr_sig_buffer
dbc4a9
 				(below)
dbc4a9
+1EB/001	ALL     kbd_status      Numlock is enabled
dbc4a9
+1EC/001	ALL     secure_boot	Secure boot is enabled in the firmware
dbc4a9
 1EF/001	ALL	sentinel	Used to detect broken bootloaders
dbc4a9
 290/040	ALL	edd_mbr_sig_buffer EDD MBR signatures
dbc4a9
 2D0/A00	ALL	e820_map	E820 memory map table
dbc4a9
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
f692dd
index 0dc9d0144a27..58273956750d 100644
dbc4a9
--- a/arch/x86/Kconfig
dbc4a9
+++ b/arch/x86/Kconfig
f692dd
@@ -1660,6 +1660,16 @@ config EFI_MIXED
dbc4a9
 
dbc4a9
 	   If unsure, say N.
dbc4a9
 
dbc4a9
+config EFI_SECURE_BOOT_SIG_ENFORCE
dbc4a9
+        def_bool n
dbc4a9
+	prompt "Force module signing when UEFI Secure Boot is enabled"
dbc4a9
+	---help---
dbc4a9
+	  UEFI Secure Boot provides a mechanism for ensuring that the
dbc4a9
+	  firmware will only load signed bootloaders and kernels. Certain
dbc4a9
+	  use cases may also require that all kernel modules also be signed.
dbc4a9
+	  Say Y here to automatically enable module signature enforcement
dbc4a9
+	  when a system boots with UEFI Secure Boot enabled.
dbc4a9
+
dbc4a9
 config SECCOMP
dbc4a9
 	def_bool y
dbc4a9
 	prompt "Enable seccomp to safely compute untrusted bytecode"
dbc4a9
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
f692dd
index 92b9a5f2aed6..2192da755e34 100644
dbc4a9
--- a/arch/x86/boot/compressed/eboot.c
dbc4a9
+++ b/arch/x86/boot/compressed/eboot.c
dbc4a9
@@ -12,6 +12,7 @@
dbc4a9
 #include <asm efi.h="">
dbc4a9
 #include <asm setup.h="">
dbc4a9
 #include <asm desc.h="">
dbc4a9
+#include <asm bootparam_utils.h="">
dbc4a9
 
dbc4a9
 #undef memcpy			/* Use memcpy from misc.c */
dbc4a9
 
f046ab
@@ -828,6 +829,37 @@ out:
dbc4a9
 	return status;
dbc4a9
 }
dbc4a9
 
dbc4a9
+static int get_secure_boot(void)
dbc4a9
+{
dbc4a9
+	u8 sb, setup;
dbc4a9
+	unsigned long datasize = sizeof(sb);
dbc4a9
+	efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID;
dbc4a9
+	efi_status_t status;
dbc4a9
+
dbc4a9
+	status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
dbc4a9
+				L"SecureBoot", &var_guid, NULL, &datasize, &sb);
dbc4a9
+
dbc4a9
+	if (status != EFI_SUCCESS)
dbc4a9
+		return 0;
dbc4a9
+
dbc4a9
+	if (sb == 0)
dbc4a9
+		return 0;
dbc4a9
+
dbc4a9
+
dbc4a9
+	status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
dbc4a9
+				L"SetupMode", &var_guid, NULL, &datasize,
dbc4a9
+				&setup);
dbc4a9
+
dbc4a9
+	if (status != EFI_SUCCESS)
dbc4a9
+		return 0;
dbc4a9
+
dbc4a9
+	if (setup == 1)
dbc4a9
+		return 0;
dbc4a9
+
dbc4a9
+	return 1;
dbc4a9
+}
dbc4a9
+
dbc4a9
+
dbc4a9
 /*
dbc4a9
  * See if we have Graphics Output Protocol
dbc4a9
  */
f046ab
@@ -1407,6 +1439,10 @@ struct boot_params *efi_main(struct efi_config *c,
dbc4a9
 	else
dbc4a9
 		setup_boot_services32(efi_early);
dbc4a9
 
dbc4a9
+	sanitize_boot_params(boot_params);
dbc4a9
+
dbc4a9
+	boot_params->secure_boot = get_secure_boot();
dbc4a9
+
dbc4a9
 	setup_graphics(boot_params);
dbc4a9
 
dbc4a9
 	setup_efi_pci(boot_params);
dbc4a9
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
dbc4a9
index 225b0988043a..90dbfb73e11f 100644
dbc4a9
--- a/arch/x86/include/uapi/asm/bootparam.h
dbc4a9
+++ b/arch/x86/include/uapi/asm/bootparam.h
dbc4a9
@@ -133,7 +133,8 @@ struct boot_params {
dbc4a9
 	__u8  eddbuf_entries;				/* 0x1e9 */
dbc4a9
 	__u8  edd_mbr_sig_buf_entries;			/* 0x1ea */
dbc4a9
 	__u8  kbd_status;				/* 0x1eb */
dbc4a9
-	__u8  _pad5[3];					/* 0x1ec */
dbc4a9
+	__u8  secure_boot;				/* 0x1ec */
dbc4a9
+	__u8  _pad5[2];					/* 0x1ed */
dbc4a9
 	/*
dbc4a9
 	 * The sentinel is set to a nonzero value (0xff) in header.S.
dbc4a9
 	 *
dbc4a9
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
f692dd
index ab4734e5411d..5d52d67d5097 100644
dbc4a9
--- a/arch/x86/kernel/setup.c
dbc4a9
+++ b/arch/x86/kernel/setup.c
f692dd
@@ -1152,6 +1152,12 @@ void __init setup_arch(char **cmdline_p)
dbc4a9
 
dbc4a9
 	io_delay_init();
dbc4a9
 
dbc4a9
+#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE
dbc4a9
+	if (boot_params.secure_boot) {
dbc4a9
+		enforce_signed_modules();
dbc4a9
+	}
dbc4a9
+#endif
dbc4a9
+
dbc4a9
 	/*
dbc4a9
 	 * Parse the ACPI tables for possible boot-time SMP configuration.
dbc4a9
 	 */
dbc4a9
diff --git a/include/linux/module.h b/include/linux/module.h
f692dd
index d4b96d6c926a..c47f75720dbd 100644
dbc4a9
--- a/include/linux/module.h
dbc4a9
+++ b/include/linux/module.h
dbc4a9
@@ -188,6 +188,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add);
dbc4a9
 
dbc4a9
 struct notifier_block;
dbc4a9
 
dbc4a9
+#ifdef CONFIG_MODULE_SIG
dbc4a9
+extern void enforce_signed_modules(void);
dbc4a9
+#else
dbc4a9
+static inline void enforce_signed_modules(void) {};
dbc4a9
+#endif
dbc4a9
+
dbc4a9
 #ifdef CONFIG_MODULES
dbc4a9
 
dbc4a9
 extern int modules_disabled; /* for sysctl */
dbc4a9
diff --git a/kernel/module.c b/kernel/module.c
f692dd
index 98c3d7955a51..6244f24abe27 100644
dbc4a9
--- a/kernel/module.c
dbc4a9
+++ b/kernel/module.c
f692dd
@@ -3896,6 +3896,13 @@ void module_layout(struct module *mod,
dbc4a9
 EXPORT_SYMBOL(module_layout);
dbc4a9
 #endif
dbc4a9
 
dbc4a9
+#ifdef CONFIG_MODULE_SIG
dbc4a9
+void enforce_signed_modules(void)
dbc4a9
+{
dbc4a9
+	sig_enforce = true;
dbc4a9
+}
dbc4a9
+#endif
dbc4a9
+
dbc4a9
 bool secure_modules(void)
dbc4a9
 {
dbc4a9
 #ifdef CONFIG_MODULE_SIG
dbc4a9
-- 
c47527
2.1.0
dbc4a9