-
Notifications
You must be signed in to change notification settings - Fork 52
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #2299 from flatcar/jepio+sayan/sboot-lockdown
secure boot: lockdown, grub fallback, CI
- Loading branch information
Showing
13 changed files
with
594 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| - Kernel lockdown in integrity mode is now enabled when secure boot is enabled. This prevents loading unsigned kernel modules and matches the behavior of all major distros. ([scripts#2299](https://github.com/flatcar/scripts/pull/2299)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
166 changes: 166 additions & 0 deletions
166
...coreos-sources/files/6.6/z0004-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,166 @@ | ||
| From 1e2ffbec195c89d887bc088691ebb19c9173ecad Mon Sep 17 00:00:00 2001 | ||
| From: David Howells <[email protected]> | ||
| Date: Mon, 18 Feb 2019 12:45:03 +0000 | ||
| Subject: [PATCH 1/4] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot | ||
| mode | ||
|
|
||
| UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT | ||
| flag that can be passed to efi_enabled() to find out whether secure boot is | ||
| enabled. | ||
|
|
||
| Move the switch-statement in x86's setup_arch() that inteprets the | ||
| secure_boot boot parameter to generic code and set the bit there. | ||
|
|
||
| Suggested-by: Ard Biesheuvel <[email protected]> | ||
| Signed-off-by: David Howells <[email protected]> | ||
| Reviewed-by: Ard Biesheuvel <[email protected]> | ||
| cc: [email protected] | ||
| [rperier: Forward-ported to 5.5: | ||
| - Use pr_warn() | ||
| - Adjust context] | ||
| [bwh: Forward-ported to 5.6: adjust context] | ||
| [bwh: Forward-ported to 5.7: | ||
| - Use the next available bit in efi.flags | ||
| - Adjust context] | ||
| --- | ||
| arch/x86/kernel/setup.c | 14 +---------- | ||
| drivers/firmware/efi/Makefile | 1 + | ||
| drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++ | ||
| include/linux/efi.h | 17 ++++++++------ | ||
| 4 files changed, 51 insertions(+), 20 deletions(-) | ||
| create mode 100644 drivers/firmware/efi/secureboot.c | ||
|
|
||
| diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c | ||
| index eb129277dcdd..7c4a6697e39d 100644 | ||
| --- a/arch/x86/kernel/setup.c | ||
| +++ b/arch/x86/kernel/setup.c | ||
| @@ -1190,19 +1190,7 @@ void __init setup_arch(char **cmdline_p) | ||
| /* Allocate bigger log buffer */ | ||
| setup_log_buf(1); | ||
|
|
||
| - if (efi_enabled(EFI_BOOT)) { | ||
| - switch (boot_params.secure_boot) { | ||
| - case efi_secureboot_mode_disabled: | ||
| - pr_info("Secure boot disabled\n"); | ||
| - break; | ||
| - case efi_secureboot_mode_enabled: | ||
| - pr_info("Secure boot enabled\n"); | ||
| - break; | ||
| - default: | ||
| - pr_info("Secure boot could not be determined\n"); | ||
| - break; | ||
| - } | ||
| - } | ||
| + efi_set_secure_boot(boot_params.secure_boot); | ||
|
|
||
| reserve_initrd(); | ||
|
|
||
| diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile | ||
| index e489fefd23da..f2dfae764fb5 100644 | ||
| --- a/drivers/firmware/efi/Makefile | ||
| +++ b/drivers/firmware/efi/Makefile | ||
| @@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB) += libstub | ||
| obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o | ||
| obj-$(CONFIG_EFI_TEST) += test/ | ||
| obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o | ||
| +obj-$(CONFIG_EFI) += secureboot.o | ||
| obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o | ||
| obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o | ||
| obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o | ||
| diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c | ||
| new file mode 100644 | ||
| index 000000000000..b6620669e32b | ||
| --- /dev/null | ||
| +++ b/drivers/firmware/efi/secureboot.c | ||
| @@ -0,0 +1,39 @@ | ||
| + | ||
| +/* Core kernel secure boot support. | ||
| + * | ||
| + * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. | ||
| + * Written by David Howells ([email protected]) | ||
| + * | ||
| + * This program is free software; you can redistribute it and/or | ||
| + * modify it under the terms of the GNU General Public Licence | ||
| + * as published by the Free Software Foundation; either version | ||
| + * 2 of the Licence, or (at your option) any later version. | ||
| + */ | ||
| + | ||
| +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | ||
| + | ||
| +#include <linux/efi.h> | ||
| +#include <linux/kernel.h> | ||
| +#include <linux/printk.h> | ||
| + | ||
| +/* | ||
| + * Decide what to do when UEFI secure boot mode is enabled. | ||
| + */ | ||
| +void __init efi_set_secure_boot(enum efi_secureboot_mode mode) | ||
| +{ | ||
| + if (efi_enabled(EFI_BOOT)) { | ||
| + switch (mode) { | ||
| + case efi_secureboot_mode_disabled: | ||
| + pr_info("Secure boot disabled\n"); | ||
| + break; | ||
| + case efi_secureboot_mode_enabled: | ||
| + set_bit(EFI_SECURE_BOOT, &efi.flags); | ||
| + pr_info("Secure boot enabled\n"); | ||
| + break; | ||
| + default: | ||
| + pr_warn("Secure boot could not be determined (mode %u)\n", | ||
| + mode); | ||
| + break; | ||
| + } | ||
| + } | ||
| +} | ||
| diff --git a/include/linux/efi.h b/include/linux/efi.h | ||
| index 80b21d1c6eaf..d267ddba8369 100644 | ||
| --- a/include/linux/efi.h | ||
| +++ b/include/linux/efi.h | ||
| @@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console(char *); | ||
| #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ | ||
| #define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */ | ||
| #define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */ | ||
| +#define EFI_SECURE_BOOT 13 /* Are we in Secure Boot mode? */ | ||
| + | ||
| +enum efi_secureboot_mode { | ||
| + efi_secureboot_mode_unset, | ||
| + efi_secureboot_mode_unknown, | ||
| + efi_secureboot_mode_disabled, | ||
| + efi_secureboot_mode_enabled, | ||
| +}; | ||
|
|
||
| #ifdef CONFIG_EFI | ||
| /* | ||
| @@ -895,6 +903,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) | ||
| return (efi.runtime_supported_mask & mask) == mask; | ||
| } | ||
| extern void efi_find_mirror(void); | ||
| +extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); | ||
| #else | ||
| static inline bool efi_enabled(int feature) | ||
| { | ||
| @@ -914,6 +923,7 @@ static inline bool efi_rt_services_supported(unsigned int mask) | ||
| } | ||
|
|
||
| static inline void efi_find_mirror(void) {} | ||
| +static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} | ||
| #endif | ||
|
|
||
| extern int efi_status_to_err(efi_status_t status); | ||
| @@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled(void) { return true; } | ||
| extern void efi_call_virt_check_flags(unsigned long flags, const void *caller); | ||
| extern unsigned long efi_call_virt_save_flags(void); | ||
|
|
||
| -enum efi_secureboot_mode { | ||
| - efi_secureboot_mode_unset, | ||
| - efi_secureboot_mode_unknown, | ||
| - efi_secureboot_mode_disabled, | ||
| - efi_secureboot_mode_enabled, | ||
| -}; | ||
| - | ||
| static inline | ||
| enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var) | ||
| { | ||
| -- | ||
| 2.39.2 | ||
|
|
Oops, something went wrong.