[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 19/19] ieee1275: enter lockdown based on /ibm,secure-boot
From: |
Daniel Axtens |
Subject: |
[PATCH 19/19] ieee1275: enter lockdown based on /ibm,secure-boot |
Date: |
Wed, 31 Mar 2021 01:07:44 +1100 |
If the 'ibm,secure-boot' property of the root node is 2 or greater,
enter lockdown.
Signed-off-by: Daniel Axtens <dja@axtens.net>
---
docs/grub.texi | 4 ++--
grub-core/Makefile.core.def | 1 +
grub-core/kern/ieee1275/init.c | 27 +++++++++++++++++++++++++++
include/grub/lockdown.h | 3 ++-
4 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/docs/grub.texi b/docs/grub.texi
index 9a737683e64f..7cd45f5c5255 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -6184,8 +6184,8 @@ Measured boot is currently only supported on EFI
platforms.
@section Lockdown when booting on a secure setup
The GRUB can be locked down when booted on a secure boot environment, for
example
-if the UEFI secure boot is enabled. On a locked down configuration, the GRUB
will
-be restricted and some operations/commands cannot be executed.
+if UEFI or Power secure boot is enabled. On a locked down configuration, the
+GRUB will be restricted and some operations/commands cannot be executed.
The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
Otherwise it does not exit.
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index 4bef6dd0b99e..3f8194fcd43d 100644
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -317,6 +317,7 @@ kernel = {
powerpc_ieee1275 = kern/powerpc/cache.S;
powerpc_ieee1275 = kern/powerpc/dl.c;
powerpc_ieee1275 = kern/powerpc/compiler-rt.S;
+ powerpc_ieee1275 = kern/lockdown.c;
sparc64_ieee1275 = kern/sparc64/cache.S;
sparc64_ieee1275 = kern/sparc64/dl.c;
diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
index d483e35eed2b..7a1ebdf94e06 100644
--- a/grub-core/kern/ieee1275/init.c
+++ b/grub-core/kern/ieee1275/init.c
@@ -44,6 +44,7 @@
#ifdef __sparc__
#include <grub/machine/kernel.h>
#endif
+#include <grub/lockdown.h>
/* The minimal heap size we can live with. */
#define HEAP_MIN_SIZE (unsigned long) (2 * 1024 * 1024)
@@ -270,6 +271,30 @@ grub_parse_cmdline (void)
}
}
+static void
+grub_get_ieee1275_secure_boot (void)
+{
+ grub_ieee1275_phandle_t root;
+ int rc;
+ grub_uint32_t is_sb;
+
+ grub_ieee1275_finddevice ("/", &root);
+
+ rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", &is_sb,
+ sizeof (is_sb), 0);
+
+ /* ibm,secure-boot:
+ * 0 - disabled
+ * 1 - audit
+ * 2 - enforce
+ * 3 - enforce + OS-specific behaviour
+ *
+ * We only support enforce.
+ */
+ if (rc >= 0 && is_sb >= 2)
+ grub_lockdown ();
+}
+
grub_addr_t grub_modbase;
void
@@ -295,6 +320,8 @@ grub_machine_init (void)
#else
grub_install_get_time_ms (grub_rtc_get_time_ms);
#endif
+
+ grub_get_ieee1275_secure_boot ();
}
void
diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
index 40531fa823bf..ebfee4bf06e7 100644
--- a/include/grub/lockdown.h
+++ b/include/grub/lockdown.h
@@ -24,7 +24,8 @@
#define GRUB_LOCKDOWN_DISABLED 0
#define GRUB_LOCKDOWN_ENABLED 1
-#ifdef GRUB_MACHINE_EFI
+#if defined(GRUB_MACHINE_EFI) || \
+ (defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275))
extern void
EXPORT_FUNC (grub_lockdown) (void);
extern int
--
2.27.0
- [PATCH 08/19] libtasn1: import libtasn1-4.16.0, (continued)
- [PATCH 08/19] libtasn1: import libtasn1-4.16.0, Daniel Axtens, 2021/03/30
- [PATCH 10/19] libtasn1: changes for grub compatibility, Daniel Axtens, 2021/03/30
- [PATCH 11/19] libtasn1: compile into asn1 module, Daniel Axtens, 2021/03/30
- [PATCH 12/19] test_asn1: test module for libtasn1, Daniel Axtens, 2021/03/30
- [PATCH 13/19] grub-install: support embedding x509 certificates, Daniel Axtens, 2021/03/30
- [PATCH 14/19] appended signatures: import GNUTLS's ASN.1 description files, Daniel Axtens, 2021/03/30
- [PATCH 15/19] appended signatures: parse PKCS#7 signedData and X.509 certificates, Daniel Axtens, 2021/03/30
- [PATCH 16/19] appended signatures: support verifying appended signatures, Daniel Axtens, 2021/03/30
- [PATCH 18/19] appended signatures: documentation, Daniel Axtens, 2021/03/30
- [PATCH 17/19] appended signatures: verification tests, Daniel Axtens, 2021/03/30
- [PATCH 19/19] ieee1275: enter lockdown based on /ibm,secure-boot,
Daniel Axtens <=