Alpaquita Linux shim-15.7 x64 #325

akodanev · 2023-03-10T11:04:48Z

Confirm the following are included in your repo, checking each box:

completed README.md file with the necessary information
shim.efi to be signed
public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
any extra patches to shim via your own git tree or as files
any extra patches to grub via your own git tree or as files
build logs
a Dockerfile to reproduce the build of the provided shim EFI binaries

What is the link to your tag in a repo cloned from rhboot/shim-review?

https://github.com/akodanev/shim-review/tree/alpaquita-shim-x64-20231012

What is the SHA256 hash of your final SHIM binary?

e8995c52597b49639b12f6d954141280c2d2fc2ba1e1e7761c0af65e44e1a102

What is the link to your previous shim review request (if any, otherwise N/A)?

N/A

The text was updated successfully, but these errors were encountered:

dennis-tseng99 · 2023-03-16T06:48:57Z

I'm not an authorized reviewer. I just want to help.
reproducible is okay by using 'docker build .' in host, but may I suggest you to let this command also work in an independent container ? So that the final output (*.efi) would not occupy host's memory.

GoogleDNS:/shim-review# docker build .
bash: docker: command not found

In host:
objcopy -D -j .text -j .sdata -j .data -j .data.ident \
        -j .dynamic -j .rodata -j .rel* \
        -j .rela* -j .dyn -j .reloc -j .eh_frame \
        -j .vendor_cert -j .sbat -j .sbatlevel \
        --target efi-app-x86_64 shimx64.so shimx64.efi
./post-process-pe -vv  shimx64.efi
set_dll_characteristics():358: Updating DLL Characteristics from 0x0000 to 0x0100
ms_validation():373: NX-Compat-Flag: PASS
ms_validation():378:   4K-Alignment: PASS
ms_validation():392: Section-Wr-Exe: PASS
fix_checksum():444: Updating checksum from 0x000e7d77 to 0x000e7e77

Step 10/11 : RUN sha256sum /shim-review/shimx64.efi apk/boot/efi/EFI/alpaquita/shimx64.efi
 ---> Running in 459e58f1b4ac
53cc37462109fab5fc78bf01e0b3f1721f41f3cfccb748aa707914fdb7a50be8  /shim-review/shimx64.efi
53cc37462109fab5fc78bf01e0b3f1721f41f3cfccb748aa707914fdb7a50be8  apk/boot/efi/EFI/alpaquita/shimx64.efi
Removing intermediate container 459e58f1b4ac
 ---> fc116e588398
Step 11/11 : RUN hexdump -Cv apk/boot/efi/EFI/alpaquita/shimx64.efi > build &&     hexdump -Cv /shim-review/shimx64.efi > orig &&     diff -u orig build
 ---> Running in c083bb933b91
Removing intermediate container c083bb933b91
 ---> 83777c250459
Successfully built 83777c250459

Hash value is matched:

53cc37462109fab5fc78bf01e0b3f1721f41f3cfccb748aa707914fdb7a50be8

sbat seems okay:

.sbat section：
 d0000 73626174 2c312c53 42415420 56657273  sbat,1,SBAT Vers
 d0010 696f6e2c 73626174 2c312c68 74747073  ion,sbat,1,https
 d0020 3a2f2f67 69746875 622e636f 6d2f7268  ://github.com/rh
 d0030 626f6f74 2f736869 6d2f626c 6f622f6d  boot/shim/blob/m
 d0040 61696e2f 53424154 2e6d640a 7368696d  ain/SBAT.md.shim
 d0050 2c332c55 45464920 7368696d 2c736869  ,3,UEFI shim,shi
 d0060 6d2c312c 68747470 733a2f2f 67697468  m,1,https://gith
 d0070 75622e63 6f6d2f72 68626f6f 742f7368  ub.com/rhboot/sh
 d0080 696d0a73 68696d2e 616c7061 71756974  im.shim.alpaquit
 d0090 612c312c 416c7061 71756974 61204c69  a,1,Alpaquita Li
 d00a0 6e75782c 7368696d 2c31352e 372d7232  nux,shim,15.7-r2
 d00b0 2c687474 70733a2f 2f62656c 6c2d7377  ,https://bell-sw
 d00c0 2e636f6d 2f737570 706f7274 2f0a      .com/support/.

The validity date of CA key is 2033; it is okay

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:18:90:85:d6:c0:de:28:e7:09:06:4e:02:d4:46:05:db:cd:97:9e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = BellSoft, CN = BellSoft Secure Boot CA, emailAddress = [email protected]
        Validity
            Not Before: Mar  2 13:00:01 2023 GMT
            Not After : Feb 27 13:00:01 2033 GMT
        Subject: O = BellSoft, CN = BellSoft Secure Boot CA, emailAddress = [email protected]

akodanev · 2023-03-16T16:27:45Z

Updated the tag in the dockerfile hopefully this will make the build reproducible in the future.

@dennis-tseng99 Thanks for checking!

GoogleDNS:/shim-review# docker build .
bash: docker: command not found

Am I missing something or does it seem like there is no docker or podman installed?

akodanev · 2023-03-23T08:18:51Z

Switched from Alpaquita to Debian container to build the shim. Updated the currently used grub version.

The new shim sha256 hash: e8995c52597b49639b12f6d954141280c2d2fc2ba1e1e7761c0af65e44e1a102
Tag: https://github.com/akodanev/shim-review/tree/alpaquita-shim-x64-20230322

akodanev · 2023-04-12T09:37:23Z

Updated grub and kernel versions in use. grub now has NX support.
New tag: https://github.com/akodanev/shim-review/tree/alpaquita-shim-x64-20230412

THS-on · 2023-10-01T08:00:40Z

Review for `alpaquita-shim-x64-20230412`

First submission from BellSoft
Shim is required due to providing custom kernel flavours
Shim is reproducible using Dockerfile

HASHES

#19 [15/16] RUN sha256sum /shim-review/shimx64.efi /pkg/boot/efi/EFI/alpaquita/shimx64.efi
#19 0.316 e8995c52597b49639b12f6d954141280c2d2fc2ba1e1e7761c0af65e44e1a102  /shim-review/shimx64.efi
#19 0.321 e8995c52597b49639b12f6d954141280c2d2fc2ba1e1e7761c0af65e44e1a102  /pkg/boot/efi/EFI/alpaquita/shimx64.efi
#19 DONE 0.4s

SBAT

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.alpaquita,1,Alpaquita Linux,shim,15.7,https://bell-sw.com/support/

Shim is based on 15.7 with NX enabled
- 0001-Make-sbat_var.S-parse-right-with-buggy-gcc-binutils.patch matches rhboot/shim@657b248
- 0002-Enable-the-NX-compatibility-flag-by-default.patch matches rhboot/shim@7c76425
- 0003-Add-validation-function-for-Microsoft-signing.patch matches Add validation function for Microsoft signing shim#531 (modulo some diff context)
  - This patch is not upstream
  - Note that this patch is now superseded by Add validation function for Microsoft signing(supersede #531) shim#567
Certificate matches the organization
- Serial: 45:18:90:85:d6:c0:de:28:e7:09:06:4e:02:d4:46:05:db:cd:97:9e
- Subject: O = BellSoft, CN = BellSoft Secure Boot CA, emailAddress = [email protected]
- Valid till Feb 27 13:00:01 2033 GMT (10 years)
- Certificate is an CA certificate, KeyUsage/DigitalSignature and ExtKeyUsage/CodeSigning are set
Key is stored in a FIPS-140-2 level 2 compliant HSM
GRUB2 based on 2.06
- Takes a combination of patches from Fedora and Apline with the needed CVE patches
- Uses Fedora's implementation of SecureBoot
- SBAT looks good (vendor prefix grub.alpaquita)
- 1023-build-force-no-pie.patch disables PIE, is there a reason for that?
- List of modules all_video at_keyboard backtrace boot btrfs cat chain configfile cryptodisk disk echo efifwsetup efi_gop efinet efi_uga ext2 f2fs fat font gcry_rijndael gcry_rsa gcry_serpent gcry_sha256 gcry_sha512 gcry_twofish gcry_whirlpool gfxmenu gfxterm gzio halt help hfsplus http iso9660 jpeg keylayouts linux loadenv loopback ls lsefi lsefimmap luks luks2 lvm mdraid09 mdraid1x minicmd multiboot2 net normal part_apple part_gpt part_msdos password_pbkdf2 png reboot regexp search search_fs_file search_fs_uuid search_label serial sleep syslinuxcfg test tftp tpm true usb usbserial_common usbserial_ftdi usbserial_pl2303 usbserial_usbdebug video xfs zfsinfo zstd
  - I haven't seen multiboot2 in other EFI GRUB2 module lists, are you actually using it for something?
Kernel is based on v6.1
- Lockdown patches + Debian lockdown patch for SecureBoot
- Other pulled patches are mainly from Debian

Questions

We recently introduced a question about kernel module signing:
Do you use an ephemeral key for signing kernel modules?
If not, please describe how you ensure that one kernel build does not load modules built for another kernel.
Do you require all the GRUB2 modules (e.g. multiboot2)?
What is the reason that PIE is disabled for GRUB2 build?

Once those questions are clarified this LGTM!

akodanev · 2023-10-03T16:30:16Z

@THS-on Thank you for the thorough review! Here are the answers to the questions:

We recently introduced a question about kernel module signing:
Do you use an ephemeral key for signing kernel modules?
If not, please describe how you ensure that one kernel build does not load modules built for another kernel.

Yes, we use build time generated key.

Do you require all the GRUB2 modules (e.g. multiboot2)?

multiboot2 is used to support loading Xen, but in addition we also apply "0008-Make-any-of-the-loaders-that-link-in-efi-mode-honor-.patch", which makes it unusable when Secure Boot is enabled. I understand that we should keep the list as minimal as possible, will take another look at the list and see what we can get rid of.

What is the reason that PIE is disabled for GRUB2 build?

The patch was originally added back in 2016 to fix some sort of gcc build issue while having --enable-default-pie in gcc spec. It also only adds -no-pie for efiemu module, therefore not used in grub-efi build. Moreover, the module itself is built with the -static option, which implicitly enables -no-pie, so there should be no real difference with or without this patch. I did a test build without it, and it works just fine with our current gcc/binutils/grub, so I think this workaround is safe to remove.

Considering the above, I will make the changes to the GRUB package and update the tag.

akodanev · 2023-10-10T13:43:49Z

@THS-on Added the changes to GRUB, which include the following:

reduced module list in a unified image
removed the old patch with -no-pie
applied the latest security fixes to GRUB (CVE-2023-4693, CVE-2023-4692), so the global generation number is now 4.

Tag: https://github.com/akodanev/shim-review/tree/alpaquita-shim-x64-20231010

THS-on · 2023-10-10T14:12:27Z

Tag alpaquita-shim-x64-20231010 now LGTM! I've sent out emails for contact verification.

@dennis-tseng99 can you have another look at it?

THS-on · 2023-10-10T14:20:40Z

@akodanev just a small comment regarding SBAT for GRUB. You include mostly the patches from Fedora, but not all of them. It might still make sense to include their SBAT entry, to make revocation easier if there is an issue with one of their patches.

voitylov · 2023-10-10T14:31:30Z

milligrams soupiest truck's fashion divider's specialising preferring northward spinoffs torsos

akodanev · 2023-10-10T14:35:32Z

convertibility's ignitions undelivered loan's nutmeg's brush undone sliding poltergeist phonograph

THS-on · 2023-10-10T14:50:26Z

Phrases are correct, contact verification is complete!

akodanev · 2023-10-12T12:52:19Z

@akodanev just a small comment regarding SBAT for GRUB. You include mostly the patches from Fedora, but not all of them. It might still make sense to include their SBAT entry, to make revocation easier if there is an issue with one of their patches.

That's right. It does make sense to add the Fedora SBAT entry to our GRUB. Here is the new tag with the update: alpaquita-shim-x64-20231012

dennis-tseng99 · 2023-10-18T06:27:07Z

@THS-on Sorry for the late reply. I just reviewed the x64-20231012 tag, and got:

Be reproducible (shimx64.efi, mmx64.efi, and fbx64.efi can be found in /var/lib/docker/btrfs/subvolumes/xxxx/shim-review/shim-15.7)
All efi files pass the NX, 4k, and WR-Exec checking
set_dll_characteristics():358: Updating DLL Characteristics from 0x0000 to 0x0100
ms_validation():373: NX-Compat-Flag: PASS
ms_validation():378: 4K-Alignment: PASS
ms_validation():392: Section-Wr-Exe: PASS
Hash values are matched:
Step 15/16 : RUN sha256sum /shim-review/shimx64.efi /pkg/boot/efi/EFI/alpaquita/shimx64.efi
---> Running in 8832fba05c56
e8995c52597b49639b12f6d954141280c2d2fc2ba1e1e7761c0af65e44e1a102 /shim-review/shimx64.efi
e8995c52597b49639b12f6d954141280c2d2fc2ba1e1e7761c0af65e44e1a102 /pkg/boot/efi/EFI/alpaquita/shimx64.efi
SBAT seems good (also follow shim 15.7 .sbatlevel section format is not compatible with binutils older than v2.36 shim#533)
objdump -s -j .sbatlevel shimx64.efi
.sbatlevel section：
84000 00000000 08000000 22000000 73626174 ........"...sbat
84010 2c312c32 30323230 35323430 300a6772 ,1,2022052400.gr
84020 75622c32 0a007362 61742c31 2c323032 ub,2..sbat,1,202
84030 32313131 3530300a 7368696d 2c320a67 2111500.shim,2.g
84040 7275622c 330a00 rub,3..
objdump -s -j .sbat shimx64.efi
.sbat section：
d0000 73626174 2c312c53 42415420 56657273 sbat,1,SBAT Vers
d0010 696f6e2c 73626174 2c312c68 74747073 ion,sbat,1,https
d0020 3a2f2f67 69746875 622e636f 6d2f7268 ://github.com/rh
d0030 626f6f74 2f736869 6d2f626c 6f622f6d boot/shim/blob/m
d0040 61696e2f 53424154 2e6d640a 7368696d ain/SBAT.md.shim
d0050 2c332c55 45464920 7368696d 2c736869 ,3,UEFI shim,shi
d0060 6d2c312c 68747470 733a2f2f 67697468 m,1,https://gith
d0070 75622e63 6f6d2f72 68626f6f 742f7368 ub.com/rhboot/sh
d0080 696d0a73 68696d2e 616c7061 71756974 im.shim.alpaquit
d0090 612c312c 416c7061 71756974 61204c69 a,1,Alpaquita Li
d00a0 6e75782c 7368696d 2c31352e 372c6874 nux,shim,15.7,ht
d00b0 7470733a 2f2f6265 6c6c2d73 772e636f tps://bell-sw.co
d00c0 6d2f7375 70706f72 742f0a m/support/.

sbat, 1, SBAT Version, sbat, 1, https://github.com/rhboot/shim/blob/main/SBAT.md
shim, 3, UEFI shim, shim, 1, https://github.com/rhboot/shim
shim.alpaquita,1,Alpaquita Linux,shim,15.7,https://bell-sw.com/support/

The validity during of CA key is 10 years. It is good.
Conclusion: it is acceptable for me.

THS-on · 2023-10-20T17:36:22Z

I double checked the kernel config from https://packages.bell-sw.com/alpaquita/sources/stream/linux-aports-stream-latest.tar.gz:

Seems to use ephemeral keys and certs for kernel modules
MODVERSIONS is enabled, which is fine in that case
Debian's lockdown patch set is applied and enabled

Marking the submission with tag alpaquita-shim-x64-20231012 as accepted.

akodanev · 2023-10-23T11:34:48Z

@THS-on @dennis-tseng99 Great! thank you so much!

THS-on · 2024-02-05T14:58:50Z

What is the status of this? Did you get a signed shim back or are creating a new submission for 15.8?

akodanev · 2024-02-15T11:40:16Z

It's not signed yet (submitted but not returned), basically the process was held up by the EV certificate we had to replace to get it uploaded, hence the delay.

Yes, we are going to prepare the new submission for 15.8.

THS-on · 2024-02-20T13:41:35Z

@akodanev thanks for the update. I'll then close this and then please create a new submission for 15.8

akodanev · 2024-06-24T13:53:36Z

This shim was signed by Microsoft (received March 13, 2024).

frozencemetery added new vendor This is a new vendor contact verification needed Contact verification is needed for this review labels Mar 10, 2023

THS-on added the question Reviewer(s) waiting on response label Oct 1, 2023

THS-on added extra review wanted and removed question Reviewer(s) waiting on response labels Oct 10, 2023

THS-on removed the contact verification needed Contact verification is needed for this review label Oct 10, 2023

THS-on added accepted Submission is ready for sysdev and removed extra review wanted labels Oct 20, 2023

THS-on closed this as completed Feb 20, 2024

akodanev mentioned this issue May 31, 2024

Alpaquita Linux shim-15.8 x64 and aarch64 #426

Closed

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Alpaquita Linux shim-15.7 x64 #325

Alpaquita Linux shim-15.7 x64 #325

akodanev commented Mar 10, 2023 •

edited

Loading

dennis-tseng99 commented Mar 16, 2023

akodanev commented Mar 16, 2023

akodanev commented Mar 23, 2023

akodanev commented Apr 12, 2023

THS-on commented Oct 1, 2023

akodanev commented Oct 3, 2023

akodanev commented Oct 10, 2023

THS-on commented Oct 10, 2023

THS-on commented Oct 10, 2023

voitylov commented Oct 10, 2023

akodanev commented Oct 10, 2023

THS-on commented Oct 10, 2023

akodanev commented Oct 12, 2023

dennis-tseng99 commented Oct 18, 2023

THS-on commented Oct 20, 2023

akodanev commented Oct 23, 2023

THS-on commented Feb 5, 2024

akodanev commented Feb 15, 2024

THS-on commented Feb 20, 2024

akodanev commented Jun 24, 2024

Alpaquita Linux shim-15.7 x64 #325

Alpaquita Linux shim-15.7 x64 #325

Comments

akodanev commented Mar 10, 2023 • edited Loading

What is the link to your tag in a repo cloned from rhboot/shim-review?

What is the SHA256 hash of your final SHIM binary?

What is the link to your previous shim review request (if any, otherwise N/A)?

dennis-tseng99 commented Mar 16, 2023

akodanev commented Mar 16, 2023

akodanev commented Mar 23, 2023

akodanev commented Apr 12, 2023

THS-on commented Oct 1, 2023

Review for alpaquita-shim-x64-20230412

Questions

akodanev commented Oct 3, 2023

akodanev commented Oct 10, 2023

THS-on commented Oct 10, 2023

THS-on commented Oct 10, 2023

voitylov commented Oct 10, 2023

akodanev commented Oct 10, 2023

THS-on commented Oct 10, 2023

akodanev commented Oct 12, 2023

dennis-tseng99 commented Oct 18, 2023

THS-on commented Oct 20, 2023

akodanev commented Oct 23, 2023

THS-on commented Feb 5, 2024

akodanev commented Feb 15, 2024

THS-on commented Feb 20, 2024

akodanev commented Jun 24, 2024

akodanev commented Mar 10, 2023 •

edited

Loading

Review for `alpaquita-shim-x64-20230412`