Jeremy Cline c8f9da
From b5123d0553f4ed5e734f6457696cdd30228d1eee Mon Sep 17 00:00:00 2001
bbfe8b
From: David Howells <dhowells@redhat.com>
bbfe8b
Date: Tue, 27 Feb 2018 10:04:55 +0000
bbfe8b
Subject: [PATCH 29/31] efi: Add an EFI_SECURE_BOOT flag to indicate secure
bbfe8b
 boot mode
bbfe8b
bbfe8b
UEFI machines can be booted in Secure Boot mode.  Add an EFI_SECURE_BOOT
bbfe8b
flag that can be passed to efi_enabled() to find out whether secure boot is
bbfe8b
enabled.
bbfe8b
bbfe8b
Move the switch-statement in x86's setup_arch() that inteprets the
bbfe8b
secure_boot boot parameter to generic code and set the bit there.
bbfe8b
bbfe8b
Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
bbfe8b
Signed-off-by: David Howells <dhowells@redhat.com>
bbfe8b
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
bbfe8b
cc: linux-efi@vger.kernel.org
Jeremy Cline c8f9da
Signed-off-by: Jeremy Cline <jcline@redhat.com>
bbfe8b
---
Jeremy Cline c8f9da
 arch/x86/kernel/setup.c           | 14 +-----------
bbfe8b
 drivers/firmware/efi/Makefile     |  1 +
Jeremy Cline c8f9da
 drivers/firmware/efi/secureboot.c | 38 +++++++++++++++++++++++++++++++
Jeremy Cline c8f9da
 include/linux/efi.h               | 18 ++++++++++-----
Jeremy Cline c8f9da
 4 files changed, 52 insertions(+), 19 deletions(-)
bbfe8b
 create mode 100644 drivers/firmware/efi/secureboot.c
bbfe8b
bbfe8b
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
Jeremy Cline c8f9da
index b74e7bfed6ab..7da1712c89c9 100644
bbfe8b
--- a/arch/x86/kernel/setup.c
bbfe8b
+++ b/arch/x86/kernel/setup.c
Jeremy Cline c8f9da
@@ -1158,19 +1158,7 @@ void __init setup_arch(char **cmdline_p)
bbfe8b
 	/* Allocate bigger log buffer */
bbfe8b
 	setup_log_buf(1);
Jeremy Cline c8f9da
 
bbfe8b
-	if (efi_enabled(EFI_BOOT)) {
bbfe8b
-		switch (boot_params.secure_boot) {
bbfe8b
-		case efi_secureboot_mode_disabled:
bbfe8b
-			pr_info("Secure boot disabled\n");
bbfe8b
-			break;
bbfe8b
-		case efi_secureboot_mode_enabled:
bbfe8b
-			pr_info("Secure boot enabled\n");
bbfe8b
-			break;
bbfe8b
-		default:
bbfe8b
-			pr_info("Secure boot could not be determined\n");
bbfe8b
-			break;
bbfe8b
-		}
bbfe8b
-	}
bbfe8b
+	efi_set_secure_boot(boot_params.secure_boot);
Jeremy Cline c8f9da
 
bbfe8b
 	reserve_initrd();
Jeremy Cline c8f9da
 
bbfe8b
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
Jeremy Cline c8f9da
index 5f9f5039de50..7a0a6378203e 100644
bbfe8b
--- a/drivers/firmware/efi/Makefile
bbfe8b
+++ b/drivers/firmware/efi/Makefile
bbfe8b
@@ -24,6 +24,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP)		+= fake_mem.o
bbfe8b
 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o
bbfe8b
 obj-$(CONFIG_EFI_TEST)			+= test/
bbfe8b
 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o
bbfe8b
+obj-$(CONFIG_EFI)			+= secureboot.o
bbfe8b
 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o
Jeremy Cline c8f9da
 
bbfe8b
 arm-obj-$(CONFIG_EFI)			:= arm-init.o arm-runtime.o
bbfe8b
diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c
bbfe8b
new file mode 100644
bbfe8b
index 000000000000..9070055de0a1
bbfe8b
--- /dev/null
bbfe8b
+++ b/drivers/firmware/efi/secureboot.c
bbfe8b
@@ -0,0 +1,38 @@
bbfe8b
+/* Core kernel secure boot support.
bbfe8b
+ *
bbfe8b
+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
bbfe8b
+ * Written by David Howells (dhowells@redhat.com)
bbfe8b
+ *
bbfe8b
+ * This program is free software; you can redistribute it and/or
bbfe8b
+ * modify it under the terms of the GNU General Public Licence
bbfe8b
+ * as published by the Free Software Foundation; either version
bbfe8b
+ * 2 of the Licence, or (at your option) any later version.
bbfe8b
+ */
bbfe8b
+
bbfe8b
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
bbfe8b
+
bbfe8b
+#include <linux efi.h="">
bbfe8b
+#include <linux kernel.h="">
bbfe8b
+#include <linux printk.h="">
bbfe8b
+
bbfe8b
+/*
bbfe8b
+ * Decide what to do when UEFI secure boot mode is enabled.
bbfe8b
+ */
bbfe8b
+void __init efi_set_secure_boot(enum efi_secureboot_mode mode)
bbfe8b
+{
bbfe8b
+	if (efi_enabled(EFI_BOOT)) {
bbfe8b
+		switch (mode) {
bbfe8b
+		case efi_secureboot_mode_disabled:
bbfe8b
+			pr_info("Secure boot disabled\n");
bbfe8b
+			break;
bbfe8b
+		case efi_secureboot_mode_enabled:
bbfe8b
+			set_bit(EFI_SECURE_BOOT, &efi.flags);
bbfe8b
+			pr_info("Secure boot enabled\n");
bbfe8b
+			break;
bbfe8b
+		default:
bbfe8b
+			pr_warning("Secure boot could not be determined (mode %u)\n",
bbfe8b
+				   mode);
bbfe8b
+			break;
bbfe8b
+		}
bbfe8b
+	}
bbfe8b
+}
bbfe8b
diff --git a/include/linux/efi.h b/include/linux/efi.h
Jeremy Cline c8f9da
index 100ce4a4aff6..62361b647a75 100644
bbfe8b
--- a/include/linux/efi.h
bbfe8b
+++ b/include/linux/efi.h
Jeremy Cline c8f9da
@@ -1155,6 +1155,14 @@ extern int __init efi_setup_pcdp_console(char *);
bbfe8b
 #define EFI_DBG			8	/* Print additional debug info at runtime */
bbfe8b
 #define EFI_NX_PE_DATA		9	/* Can runtime data regions be mapped non-executable? */
bbfe8b
 #define EFI_MEM_ATTR		10	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
bbfe8b
+#define EFI_SECURE_BOOT		11	/* Are we in Secure Boot mode? */
bbfe8b
+
bbfe8b
+enum efi_secureboot_mode {
bbfe8b
+	efi_secureboot_mode_unset,
bbfe8b
+	efi_secureboot_mode_unknown,
bbfe8b
+	efi_secureboot_mode_disabled,
bbfe8b
+	efi_secureboot_mode_enabled,
bbfe8b
+};
Jeremy Cline c8f9da
 
bbfe8b
 #ifdef CONFIG_EFI
bbfe8b
 /*
16332a
@@ -1198,6 +1206,8 @@ static inline bool efi_enabled(int feature)
16332a
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
16332a
bbfe8b
 extern bool efi_is_table_address(unsigned long phys_addr);
Jeremy Cline c8f9da
+
bbfe8b
+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode);
bbfe8b
 #else
bbfe8b
 static inline bool efi_enabled(int feature)
bbfe8b
 {
16332a
@@ -1216,6 +1226,8 @@ static inline bool efi_is_table_address(unsigned long phys_addr)
bbfe8b
 {
16332a
 	return false;
bbfe8b
 }
Jeremy Cline c8f9da
+
bbfe8b
+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {}
bbfe8b
 #endif
Jeremy Cline c8f9da
 
bbfe8b
 extern int efi_status_to_err(efi_status_t status);
Jeremy Cline c8f9da
@@ -1577,12 +1589,6 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg,
Jeremy Cline 10301b
 #endif
7407e2
 
bbfe8b
 extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
Jeremy Cline 10301b
 extern unsigned long efi_call_virt_save_flags(void);
Jeremy Cline c8f9da
 
bbfe8b
-enum efi_secureboot_mode {
bbfe8b
-	efi_secureboot_mode_unset,
bbfe8b
-	efi_secureboot_mode_unknown,
bbfe8b
-	efi_secureboot_mode_disabled,
bbfe8b
-	efi_secureboot_mode_enabled,
bbfe8b
-};
bbfe8b
 enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table);
Jeremy Cline c8f9da
 
bbfe8b
 #ifdef CONFIG_RESET_ATTACK_MITIGATION
bbfe8b
-- 
Jeremy Cline c8f9da
2.19.1
bbfe8b
bbfe8b
From d78bf678059f83e22bec8ada1a448e22b9b90203 Mon Sep 17 00:00:00 2001
bbfe8b
From: David Howells <dhowells@redhat.com>
bbfe8b
Date: Tue, 27 Feb 2018 10:04:55 +0000
bbfe8b
Subject: [PATCH 30/31] efi: Lock down the kernel if booted in secure boot mode
bbfe8b
bbfe8b
UEFI Secure Boot provides a mechanism for ensuring that the firmware will
bbfe8b
only load signed bootloaders and kernels.  Certain use cases may also
bbfe8b
require that all kernel modules also be signed.  Add a configuration option
bbfe8b
that to lock down the kernel - which includes requiring validly signed
bbfe8b
modules - if the kernel is secure-booted.
bbfe8b
bbfe8b
Signed-off-by: David Howells <dhowells@redhat.com>
bbfe8b
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
bbfe8b
cc: linux-efi@vger.kernel.org
bbfe8b
---
bbfe8b
 arch/x86/kernel/setup.c |  6 ++++--
bbfe8b
 fs/debugfs/inode.c      |  2 +-
bbfe8b
 security/Kconfig        | 14 ++++++++++++++
bbfe8b
 security/lock_down.c    |  5 +++++
bbfe8b
 4 files changed, 20 insertions(+), 3 deletions(-)
bbfe8b
bbfe8b
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
Jeremy Cline 10301b
index adeee6329f55..27a54ec878bd 100644
bbfe8b
--- a/arch/x86/kernel/setup.c
bbfe8b
+++ b/arch/x86/kernel/setup.c
Jeremy Cline 10301b
@@ -65,6 +65,7 @@
bbfe8b
 #include <linux dma-mapping.h="">
bbfe8b
 #include <linux ctype.h="">
bbfe8b
 #include <linux uaccess.h="">
bbfe8b
+#include <linux security.h="">
Jeremy Cline 10301b
 
bbfe8b
 #include <linux percpu.h="">
bbfe8b
 #include <linux crash_dump.h="">
Jeremy Cline 10301b
@@ -1005,6 +1006,10 @@ void __init setup_arch(char **cmdline_p)
bbfe8b
 	if (efi_enabled(EFI_BOOT))
bbfe8b
 		efi_init();
Jeremy Cline 10301b
 
bbfe8b
+	efi_set_secure_boot(boot_params.secure_boot);
bbfe8b
+
Jeremy Cline 10301b
+	init_lockdown();
Jeremy Cline 10301b
+
324e59
 	dmi_setup();
324e59
 
324e59
 	/*
Jeremy Cline 10301b
@@ -1159,8 +1164,6 @@ void __init setup_arch(char **cmdline_p)
bbfe8b
 	/* Allocate bigger log buffer */
bbfe8b
 	setup_log_buf(1);
Jeremy Cline 10301b
 
bbfe8b
-	efi_set_secure_boot(boot_params.secure_boot);
bbfe8b
-
bbfe8b
 	reserve_initrd();
Jeremy Cline 10301b
 
bbfe8b
 	acpi_table_upgrade();
bbfe8b
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
bbfe8b
index ce261e1765ff..7aff55b309a6 100644
bbfe8b
--- a/fs/debugfs/inode.c
bbfe8b
+++ b/fs/debugfs/inode.c
bbfe8b
@@ -40,7 +40,7 @@ static bool debugfs_registered;
bbfe8b
 static int debugfs_setattr(struct dentry *dentry, struct iattr *ia)
bbfe8b
 {
bbfe8b
 	if ((ia->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) &&
bbfe8b
-	    kernel_is_locked_down("debugfs"))
bbfe8b
+	    kernel_is_locked_down("changing perms in debugfs"))
bbfe8b
 		return -EPERM;
bbfe8b
 	return simple_setattr(dentry, ia);
bbfe8b
 }
bbfe8b
diff --git a/security/Kconfig b/security/Kconfig
Jeremy Cline 10301b
index 9c343f262bdd..30788bc47863 100644
bbfe8b
--- a/security/Kconfig
bbfe8b
+++ b/security/Kconfig
Jeremy Cline 10301b
@@ -244,6 +244,20 @@ config LOCK_DOWN_KERNEL_FORCE
324e59
           Allow the lockdown on a kernel to be lifted, by pressing a SysRq key
324e59
           combination on a wired keyboard.  On x86, this is SysRq+x.
Jeremy Cline 10301b
 
bbfe8b
+config LOCK_DOWN_IN_EFI_SECURE_BOOT
bbfe8b
+	bool "Lock down the kernel in EFI Secure Boot mode"
bbfe8b
+	default n
bbfe8b
+	select LOCK_DOWN_KERNEL
bbfe8b
+	depends on EFI
bbfe8b
+	help
bbfe8b
+	  UEFI Secure Boot provides a mechanism for ensuring that the firmware
bbfe8b
+	  will only load signed bootloaders and kernels.  Secure boot mode may
bbfe8b
+	  be determined from EFI variables provided by the system firmware if
bbfe8b
+	  not indicated by the boot parameters.
bbfe8b
+
bbfe8b
+	  Enabling this option turns on results in kernel lockdown being
bbfe8b
+	  triggered if EFI Secure Boot is set.
bbfe8b
+
c97d3b
 source "security/selinux/Kconfig"
c97d3b
 source "security/smack/Kconfig"
Jeremy Cline 10301b
 source "security/tomoyo/Kconfig"
bbfe8b
diff --git a/security/lock_down.c b/security/lock_down.c
Jeremy Cline 10301b
index ee00ca2677e7..bb4dc7838f3e 100644
bbfe8b
--- a/security/lock_down.c
bbfe8b
+++ b/security/lock_down.c
bbfe8b
@@ -12,6 +12,7 @@
Jeremy Cline 10301b
 
Jeremy Cline 10301b
 #include <linux security.h="">
bbfe8b
 #include <linux export.h="">
bbfe8b
+#include <linux efi.h="">
324e59
 #include <linux sysrq.h="">
324e59
 #include <asm setup.h="">
Jeremy Cline 10301b
 
Jeremy Cline 10301b
@@ -44,6 +45,10 @@ void __init init_lockdown(void)
Jeremy Cline 10301b
 #ifdef CONFIG_LOCK_DOWN_FORCE
Jeremy Cline 10301b
 	lock_kernel_down("Kernel configuration");
bbfe8b
 #endif
bbfe8b
+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
bbfe8b
+	if (efi_enabled(EFI_SECURE_BOOT))
bbfe8b
+		lock_kernel_down("EFI secure boot");
bbfe8b
+#endif
bbfe8b
 }
Jeremy Cline 10301b
 
bbfe8b
 /**
bbfe8b
-- 
bbfe8b
2.14.3