1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/kernel.h> 4 #include <linux/sched.h> 5 #include <linux/cred.h> 6 #include <linux/err.h> 7 #include <linux/efi.h> 8 #include <linux/slab.h> 9 #include <keys/asymmetric-type.h> 10 #include <keys/system_keyring.h> 11 #include "../integrity.h" 12 13 static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID; 14 static efi_guid_t efi_cert_x509_sha256_guid __initdata = 15 EFI_CERT_X509_SHA256_GUID; 16 static efi_guid_t efi_cert_sha256_guid __initdata = EFI_CERT_SHA256_GUID; 17 18 /* 19 * Look to see if a UEFI variable called MokIgnoreDB exists and return true if 20 * it does. 21 * 22 * This UEFI variable is set by the shim if a user tells the shim to not use 23 * the certs/hashes in the UEFI db variable for verification purposes. If it 24 * is set, we should ignore the db variable also and the true return indicates 25 * this. 26 */ 27 static __init bool uefi_check_ignore_db(void) 28 { 29 efi_status_t status; 30 unsigned int db = 0; 31 unsigned long size = sizeof(db); 32 efi_guid_t guid = EFI_SHIM_LOCK_GUID; 33 34 status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db); 35 return status == EFI_SUCCESS; 36 } 37 38 /* 39 * Get a certificate list blob from the named EFI variable. 40 */ 41 static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, 42 unsigned long *size) 43 { 44 efi_status_t status; 45 unsigned long lsize = 4; 46 unsigned long tmpdb[4]; 47 void *db; 48 49 status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); 50 if (status != EFI_BUFFER_TOO_SMALL) { 51 pr_err("Couldn't get size: 0x%lx\n", status); 52 return NULL; 53 } 54 55 db = kmalloc(lsize, GFP_KERNEL); 56 if (!db) 57 return NULL; 58 59 status = efi.get_variable(name, guid, NULL, &lsize, db); 60 if (status != EFI_SUCCESS) { 61 kfree(db); 62 pr_err("Error reading db var: 0x%lx\n", status); 63 return NULL; 64 } 65 66 *size = lsize; 67 return db; 68 } 69 70 /* 71 * Blacklist a hash. 72 */ 73 static __init void uefi_blacklist_hash(const char *source, const void *data, 74 size_t len, const char *type, 75 size_t type_len) 76 { 77 char *hash, *p; 78 79 hash = kmalloc(type_len + len * 2 + 1, GFP_KERNEL); 80 if (!hash) 81 return; 82 p = memcpy(hash, type, type_len); 83 p += type_len; 84 bin2hex(p, data, len); 85 p += len * 2; 86 *p = 0; 87 88 mark_hash_blacklisted(hash); 89 kfree(hash); 90 } 91 92 /* 93 * Blacklist an X509 TBS hash. 94 */ 95 static __init void uefi_blacklist_x509_tbs(const char *source, 96 const void *data, size_t len) 97 { 98 uefi_blacklist_hash(source, data, len, "tbs:", 4); 99 } 100 101 /* 102 * Blacklist the hash of an executable. 103 */ 104 static __init void uefi_blacklist_binary(const char *source, 105 const void *data, size_t len) 106 { 107 uefi_blacklist_hash(source, data, len, "bin:", 4); 108 } 109 110 /* 111 * Return the appropriate handler for particular signature list types found in 112 * the UEFI db and MokListRT tables. 113 */ 114 static __init efi_element_handler_t get_handler_for_db(const efi_guid_t * 115 sig_type) 116 { 117 if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) 118 return add_to_platform_keyring; 119 return 0; 120 } 121 122 /* 123 * Return the appropriate handler for particular signature list types found in 124 * the UEFI dbx and MokListXRT tables. 125 */ 126 static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t * 127 sig_type) 128 { 129 if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0) 130 return uefi_blacklist_x509_tbs; 131 if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0) 132 return uefi_blacklist_binary; 133 return 0; 134 } 135 136 /* 137 * Load the certs contained in the UEFI databases into the platform trusted 138 * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist 139 * keyring. 140 */ 141 static int __init load_uefi_certs(void) 142 { 143 efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; 144 efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; 145 void *db = NULL, *dbx = NULL, *mok = NULL; 146 unsigned long dbsize = 0, dbxsize = 0, moksize = 0; 147 int rc = 0; 148 149 if (!efi.get_variable) 150 return false; 151 152 /* Get db, MokListRT, and dbx. They might not exist, so it isn't 153 * an error if we can't get them. 154 */ 155 if (!uefi_check_ignore_db()) { 156 db = get_cert_list(L"db", &secure_var, &dbsize); 157 if (!db) { 158 pr_err("MODSIGN: Couldn't get UEFI db list\n"); 159 } else { 160 rc = parse_efi_signature_list("UEFI:db", 161 db, dbsize, get_handler_for_db); 162 if (rc) 163 pr_err("Couldn't parse db signatures: %d\n", 164 rc); 165 kfree(db); 166 } 167 } 168 169 mok = get_cert_list(L"MokListRT", &mok_var, &moksize); 170 if (!mok) { 171 pr_info("Couldn't get UEFI MokListRT\n"); 172 } else { 173 rc = parse_efi_signature_list("UEFI:MokListRT", 174 mok, moksize, get_handler_for_db); 175 if (rc) 176 pr_err("Couldn't parse MokListRT signatures: %d\n", rc); 177 kfree(mok); 178 } 179 180 dbx = get_cert_list(L"dbx", &secure_var, &dbxsize); 181 if (!dbx) { 182 pr_info("Couldn't get UEFI dbx list\n"); 183 } else { 184 rc = parse_efi_signature_list("UEFI:dbx", 185 dbx, dbxsize, 186 get_handler_for_dbx); 187 if (rc) 188 pr_err("Couldn't parse dbx signatures: %d\n", rc); 189 kfree(dbx); 190 } 191 192 return rc; 193 } 194 late_initcall(load_uefi_certs); 195