6a91557
From: Matthew Garrett <matthew.garrett@nebula.com>
6a91557
Date: Fri, 9 Aug 2013 18:36:30 -0400
6a91557
Subject: [PATCH] Add option to automatically enforce module signatures when in
6a91557
 Secure Boot mode
6a91557
6a91557
UEFI Secure Boot provides a mechanism for ensuring that the firmware will
6a91557
only load signed bootloaders and kernels. Certain use cases may also
6a91557
require that all kernel modules also be signed. Add a configuration option
6a91557
that enforces this automatically when enabled.
6a91557
6a91557
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
6a91557
---
6a91557
 Documentation/x86/zero-page.txt       |  2 ++
6a91557
 arch/x86/Kconfig                      | 10 ++++++++++
6a91557
 arch/x86/boot/compressed/eboot.c      | 36 +++++++++++++++++++++++++++++++++++
6a91557
 arch/x86/include/uapi/asm/bootparam.h |  3 ++-
6a91557
 arch/x86/kernel/setup.c               |  6 ++++++
6a91557
 include/linux/module.h                |  6 ++++++
6a91557
 kernel/module.c                       |  7 +++++++
6a91557
 7 files changed, 69 insertions(+), 1 deletion(-)
6a91557
6a91557
diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
d729332
index 82fbdbc1e0b0..a811210ad486 100644
6a91557
--- a/Documentation/x86/zero-page.txt
6a91557
+++ b/Documentation/x86/zero-page.txt
6a91557
@@ -30,6 +30,8 @@ Offset	Proto	Name		Meaning
6a91557
 1E9/001	ALL	eddbuf_entries	Number of entries in eddbuf (below)
6a91557
 1EA/001	ALL	edd_mbr_sig_buf_entries	Number of entries in edd_mbr_sig_buffer
6a91557
 				(below)
6a91557
+1EB/001	ALL     kbd_status      Numlock is enabled
6a91557
+1EC/001	ALL     secure_boot	Secure boot is enabled in the firmware
6a91557
 1EF/001	ALL	sentinel	Used to detect broken bootloaders
6a91557
 290/040	ALL	edd_mbr_sig_buffer EDD MBR signatures
6a91557
 2D0/A00	ALL	e820_map	E820 memory map table
6a91557
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
6a7da49
index 226d5696e1d1..6a8f880e213f 100644
6a91557
--- a/arch/x86/Kconfig
6a91557
+++ b/arch/x86/Kconfig
6a7da49
@@ -1697,6 +1697,16 @@ config EFI_MIXED
6a91557
 
6a91557
 	   If unsure, say N.
6a91557
 
6a91557
+config EFI_SECURE_BOOT_SIG_ENFORCE
6a91557
+        def_bool n
6a91557
+	prompt "Force module signing when UEFI Secure Boot is enabled"
6a91557
+	---help---
6a91557
+	  UEFI Secure Boot provides a mechanism for ensuring that the
6a91557
+	  firmware will only load signed bootloaders and kernels. Certain
6a91557
+	  use cases may also require that all kernel modules also be signed.
6a91557
+	  Say Y here to automatically enable module signature enforcement
6a91557
+	  when a system boots with UEFI Secure Boot enabled.
6a91557
+
6a91557
 config SECCOMP
6a91557
 	def_bool y
6a91557
 	prompt "Enable seccomp to safely compute untrusted bytecode"
6a91557
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
5f94435
index 48304b89b601..2ff19014117a 100644
6a91557
--- a/arch/x86/boot/compressed/eboot.c
6a91557
+++ b/arch/x86/boot/compressed/eboot.c
6a91557
@@ -12,6 +12,7 @@
6a91557
 #include <asm/efi.h>
6a91557
 #include <asm/setup.h>
6a91557
 #include <asm/desc.h>
6a91557
+#include <asm/bootparam_utils.h>
6a91557
 
f1193f2
 #include "../string.h"
f1193f2
 #include "eboot.h"
f1193f2
@@ -827,6 +828,37 @@ out:
6a91557
 	return status;
6a91557
 }
6a91557
 
6a91557
+static int get_secure_boot(void)
6a91557
+{
6a91557
+	u8 sb, setup;
6a91557
+	unsigned long datasize = sizeof(sb);
6a91557
+	efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID;
6a91557
+	efi_status_t status;
6a91557
+
6a91557
+	status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
6a91557
+				L"SecureBoot", &var_guid, NULL, &datasize, &sb);
6a91557
+
6a91557
+	if (status != EFI_SUCCESS)
6a91557
+		return 0;
6a91557
+
6a91557
+	if (sb == 0)
6a91557
+		return 0;
6a91557
+
6a91557
+
6a91557
+	status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
6a91557
+				L"SetupMode", &var_guid, NULL, &datasize,
6a91557
+				&setup);
6a91557
+
6a91557
+	if (status != EFI_SUCCESS)
6a91557
+		return 0;
6a91557
+
6a91557
+	if (setup == 1)
6a91557
+		return 0;
6a91557
+
6a91557
+	return 1;
6a91557
+}
6a91557
+
6a91557
+
6a91557
 /*
6a91557
  * See if we have Graphics Output Protocol
6a91557
  */
5f94435
@@ -1408,6 +1440,10 @@ struct boot_params *efi_main(struct efi_config *c,
6a91557
 	else
6a91557
 		setup_boot_services32(efi_early);
6a91557
 
6a91557
+	sanitize_boot_params(boot_params);
6a91557
+
6a91557
+	boot_params->secure_boot = get_secure_boot();
6a91557
+
6a91557
 	setup_graphics(boot_params);
6a91557
 
c33dae8
 	setup_efi_pci(boot_params);
6a91557
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
b18e6e7
index ab456dc233b5..74ba4083e7ce 100644
6a91557
--- a/arch/x86/include/uapi/asm/bootparam.h
6a91557
+++ b/arch/x86/include/uapi/asm/bootparam.h
b18e6e7
@@ -134,7 +134,8 @@ struct boot_params {
6a91557
 	__u8  eddbuf_entries;				/* 0x1e9 */
6a91557
 	__u8  edd_mbr_sig_buf_entries;			/* 0x1ea */
6a91557
 	__u8  kbd_status;				/* 0x1eb */
6a91557
-	__u8  _pad5[3];					/* 0x1ec */
6a91557
+	__u8  secure_boot;				/* 0x1ec */
6a91557
+	__u8  _pad5[2];					/* 0x1ed */
6a91557
 	/*
6a91557
 	 * The sentinel is set to a nonzero value (0xff) in header.S.
6a91557
 	 *
6a91557
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
b18e6e7
index d74ac33290ae..88dad730e858 100644
6a91557
--- a/arch/x86/kernel/setup.c
6a91557
+++ b/arch/x86/kernel/setup.c
b18e6e7
@@ -1156,6 +1156,12 @@ void __init setup_arch(char **cmdline_p)
6a91557
 
6a91557
 	io_delay_init();
6a91557
 
6a91557
+#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE
6a91557
+	if (boot_params.secure_boot) {
6a91557
+		enforce_signed_modules();
6a91557
+	}
6a91557
+#endif
6a91557
+
6a91557
 	/*
6a91557
 	 * Parse the ACPI tables for possible boot-time SMP configuration.
6a91557
 	 */
6a91557
diff --git a/include/linux/module.h b/include/linux/module.h
cc7213f
index cdc46a791b9d..0c1edd33a42c 100644
6a91557
--- a/include/linux/module.h
6a91557
+++ b/include/linux/module.h
6a91557
@@ -188,6 +188,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add);
6a91557
 
6a91557
 struct notifier_block;
6a91557
 
6a91557
+#ifdef CONFIG_MODULE_SIG
6a91557
+extern void enforce_signed_modules(void);
6a91557
+#else
6a91557
+static inline void enforce_signed_modules(void) {};
6a91557
+#endif
6a91557
+
6a91557
 #ifdef CONFIG_MODULES
6a91557
 
6a91557
 extern int modules_disabled; /* for sysctl */
6a91557
diff --git a/kernel/module.c b/kernel/module.c
3a153ad
index f43cbdd52546..feb6736fec91 100644
6a91557
--- a/kernel/module.c
6a91557
+++ b/kernel/module.c
3a153ad
@@ -3913,6 +3913,13 @@ void module_layout(struct module *mod,
6a91557
 EXPORT_SYMBOL(module_layout);
6a91557
 #endif
6a91557
 
6a91557
+#ifdef CONFIG_MODULE_SIG
6a91557
+void enforce_signed_modules(void)
6a91557
+{
6a91557
+	sig_enforce = true;
6a91557
+}
6a91557
+#endif
6a91557
+
6a91557
 bool secure_modules(void)
6a91557
 {
6a91557
 #ifdef CONFIG_MODULE_SIG