|
 |
8e15ce |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
8e15ce |
From: Daniel Axtens <dja@axtens.net>
|
|
|
8e15ce |
Date: Mon, 28 Sep 2020 11:11:17 +1000
|
|
|
8e15ce |
Subject: [PATCH] ieee1275: enter lockdown based on /ibm,secure-boot
|
|
|
8e15ce |
|
|
|
8e15ce |
If the 'ibm,secure-boot' property of the root node is 2 or greater,
|
|
|
8e15ce |
enter lockdown.
|
|
|
8e15ce |
|
|
|
8e15ce |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
8e15ce |
---
|
|
|
8e15ce |
grub-core/Makefile.core.def | 1 +
|
|
|
8e15ce |
grub-core/kern/ieee1275/init.c | 27 +++++++++++++++++++++++++++
|
|
|
8e15ce |
include/grub/lockdown.h | 3 ++-
|
|
|
8e15ce |
docs/grub.texi | 4 ++--
|
|
|
8e15ce |
4 files changed, 32 insertions(+), 3 deletions(-)
|
|
|
8e15ce |
|
|
|
8e15ce |
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
|
|
|
8e15ce |
index 6bddc841b85..3f3459b2c70 100644
|
|
|
8e15ce |
--- a/grub-core/Makefile.core.def
|
|
|
8e15ce |
+++ b/grub-core/Makefile.core.def
|
|
|
8e15ce |
@@ -323,6 +323,7 @@ kernel = {
|
|
|
8e15ce |
powerpc_ieee1275 = kern/powerpc/cache.S;
|
|
|
8e15ce |
powerpc_ieee1275 = kern/powerpc/dl.c;
|
|
|
8e15ce |
powerpc_ieee1275 = kern/powerpc/compiler-rt.S;
|
|
|
8e15ce |
+ powerpc_ieee1275 = kern/lockdown.c;
|
|
|
8e15ce |
|
|
|
8e15ce |
sparc64_ieee1275 = kern/sparc64/cache.S;
|
|
|
8e15ce |
sparc64_ieee1275 = kern/sparc64/dl.c;
|
|
|
8e15ce |
diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
|
|
|
8e15ce |
index 937c1bc44cb..fc7d9712729 100644
|
|
|
8e15ce |
--- a/grub-core/kern/ieee1275/init.c
|
|
|
8e15ce |
+++ b/grub-core/kern/ieee1275/init.c
|
|
|
8e15ce |
@@ -44,6 +44,7 @@
|
|
|
8e15ce |
#ifdef __sparc__
|
|
|
8e15ce |
#include <grub/machine/kernel.h>
|
|
|
8e15ce |
#endif
|
|
|
8e15ce |
+#include <grub/lockdown.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
/* The minimal heap size we can live with. */
|
|
|
8e15ce |
#define HEAP_MIN_SIZE (unsigned long) (2 * 1024 * 1024)
|
|
|
8e15ce |
@@ -271,6 +272,30 @@ grub_parse_cmdline (void)
|
|
|
8e15ce |
}
|
|
|
8e15ce |
}
|
|
|
8e15ce |
|
|
|
8e15ce |
+static void
|
|
|
8e15ce |
+grub_get_ieee1275_secure_boot (void)
|
|
|
8e15ce |
+{
|
|
|
8e15ce |
+ grub_ieee1275_phandle_t root;
|
|
|
8e15ce |
+ int rc;
|
|
|
8e15ce |
+ grub_uint32_t is_sb;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
+ grub_ieee1275_finddevice ("/", &root);
|
|
|
8e15ce |
+
|
|
|
8e15ce |
+ rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", &is_sb,
|
|
|
8e15ce |
+ sizeof (is_sb), 0);
|
|
|
8e15ce |
+
|
|
|
8e15ce |
+ /* ibm,secure-boot:
|
|
|
8e15ce |
+ * 0 - disabled
|
|
|
8e15ce |
+ * 1 - audit
|
|
|
8e15ce |
+ * 2 - enforce
|
|
|
8e15ce |
+ * 3 - enforce + OS-specific behaviour
|
|
|
8e15ce |
+ *
|
|
|
8e15ce |
+ * We only support enforce.
|
|
|
8e15ce |
+ */
|
|
|
8e15ce |
+ if (rc >= 0 && is_sb >= 2)
|
|
|
8e15ce |
+ grub_lockdown ();
|
|
|
8e15ce |
+}
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_addr_t grub_modbase;
|
|
|
8e15ce |
|
|
|
8e15ce |
void
|
|
|
8e15ce |
@@ -296,6 +321,8 @@ grub_machine_init (void)
|
|
|
8e15ce |
#else
|
|
|
8e15ce |
grub_install_get_time_ms (grub_rtc_get_time_ms);
|
|
|
8e15ce |
#endif
|
|
|
8e15ce |
+
|
|
|
8e15ce |
+ grub_get_ieee1275_secure_boot ();
|
|
|
8e15ce |
}
|
|
|
8e15ce |
|
|
|
8e15ce |
void
|
|
|
8e15ce |
diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
|
|
|
8e15ce |
index 40531fa823b..ebfee4bf06e 100644
|
|
|
8e15ce |
--- a/include/grub/lockdown.h
|
|
|
8e15ce |
+++ b/include/grub/lockdown.h
|
|
|
8e15ce |
@@ -24,7 +24,8 @@
|
|
|
8e15ce |
#define GRUB_LOCKDOWN_DISABLED 0
|
|
|
8e15ce |
#define GRUB_LOCKDOWN_ENABLED 1
|
|
|
8e15ce |
|
|
|
8e15ce |
-#ifdef GRUB_MACHINE_EFI
|
|
|
8e15ce |
+#if defined(GRUB_MACHINE_EFI) || \
|
|
|
8e15ce |
+ (defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275))
|
|
|
8e15ce |
extern void
|
|
|
8e15ce |
EXPORT_FUNC (grub_lockdown) (void);
|
|
|
8e15ce |
extern int
|
|
|
8e15ce |
diff --git a/docs/grub.texi b/docs/grub.texi
|
|
|
8e15ce |
index 4816be85611..a4da9c2a1b9 100644
|
|
|
8e15ce |
--- a/docs/grub.texi
|
|
|
8e15ce |
+++ b/docs/grub.texi
|
|
|
8e15ce |
@@ -6227,8 +6227,8 @@ Measured boot is currently only supported on EFI platforms.
|
|
|
8e15ce |
@section Lockdown when booting on a secure setup
|
|
|
8e15ce |
|
|
|
8e15ce |
The GRUB can be locked down when booted on a secure boot environment, for example
|
|
|
8e15ce |
-if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
|
|
|
8e15ce |
-be restricted and some operations/commands cannot be executed.
|
|
|
8e15ce |
+if UEFI or Power secure boot is enabled. On a locked down configuration, the
|
|
|
8e15ce |
+GRUB will be restricted and some operations/commands cannot be executed.
|
|
|
8e15ce |
|
|
|
8e15ce |
The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
|
|
|
8e15ce |
Otherwise it does not exit.
|