1 // SPDX-License-Identifier: GPL-2.0
2
3 #include <linux/kernel.h>
4 #include <linux/sched.h>
5 #include <linux/cred.h>
6 #include <linux/err.h>
7 #include <linux/efi.h>
8 #include <linux/slab.h>
9 #include <keys/asymmetric-type.h>
10 #include <keys/system_keyring.h>
11 #include "../integrity.h"
12
13 static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID;
14 static efi_guid_t efi_cert_x509_sha256_guid __initdata =
15 EFI_CERT_X509_SHA256_GUID;
16 static efi_guid_t efi_cert_sha256_guid __initdata = EFI_CERT_SHA256_GUID;
17
18 /*
19 * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
20 * it does.
21 *
22 * This UEFI variable is set by the shim if a user tells the shim to not use
23 * the certs/hashes in the UEFI db variable for verification purposes. If it
24 * is set, we should ignore the db variable also and the true return indicates
25 * this.
26 */
uefi_check_ignore_db(void)27 static __init bool uefi_check_ignore_db(void)
28 {
29 efi_status_t status;
30 unsigned int db = 0;
31 unsigned long size = sizeof(db);
32 efi_guid_t guid = EFI_SHIM_LOCK_GUID;
33
34 status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db);
35 return status == EFI_SUCCESS;
36 }
37
38 /*
39 * Get a certificate list blob from the named EFI variable.
40 */
get_cert_list(efi_char16_t * name,efi_guid_t * guid,unsigned long * size)41 static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
42 unsigned long *size)
43 {
44 efi_status_t status;
45 unsigned long lsize = 4;
46 unsigned long tmpdb[4];
47 void *db;
48
49 status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
50 if (status != EFI_BUFFER_TOO_SMALL) {
51 pr_err("Couldn't get size: 0x%lx\n", status);
52 return NULL;
53 }
54
55 db = kmalloc(lsize, GFP_KERNEL);
56 if (!db)
57 return NULL;
58
59 status = efi.get_variable(name, guid, NULL, &lsize, db);
60 if (status != EFI_SUCCESS) {
61 kfree(db);
62 pr_err("Error reading db var: 0x%lx\n", status);
63 return NULL;
64 }
65
66 *size = lsize;
67 return db;
68 }
69
70 /*
71 * Blacklist a hash.
72 */
uefi_blacklist_hash(const char * source,const void * data,size_t len,const char * type,size_t type_len)73 static __init void uefi_blacklist_hash(const char *source, const void *data,
74 size_t len, const char *type,
75 size_t type_len)
76 {
77 char *hash, *p;
78
79 hash = kmalloc(type_len + len * 2 + 1, GFP_KERNEL);
80 if (!hash)
81 return;
82 p = memcpy(hash, type, type_len);
83 p += type_len;
84 bin2hex(p, data, len);
85 p += len * 2;
86 *p = 0;
87
88 mark_hash_blacklisted(hash);
89 kfree(hash);
90 }
91
92 /*
93 * Blacklist an X509 TBS hash.
94 */
uefi_blacklist_x509_tbs(const char * source,const void * data,size_t len)95 static __init void uefi_blacklist_x509_tbs(const char *source,
96 const void *data, size_t len)
97 {
98 uefi_blacklist_hash(source, data, len, "tbs:", 4);
99 }
100
101 /*
102 * Blacklist the hash of an executable.
103 */
uefi_blacklist_binary(const char * source,const void * data,size_t len)104 static __init void uefi_blacklist_binary(const char *source,
105 const void *data, size_t len)
106 {
107 uefi_blacklist_hash(source, data, len, "bin:", 4);
108 }
109
110 /*
111 * Return the appropriate handler for particular signature list types found in
112 * the UEFI db and MokListRT tables.
113 */
get_handler_for_db(const efi_guid_t * sig_type)114 static __init efi_element_handler_t get_handler_for_db(const efi_guid_t *
115 sig_type)
116 {
117 if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0)
118 return add_to_platform_keyring;
119 return 0;
120 }
121
122 /*
123 * Return the appropriate handler for particular signature list types found in
124 * the UEFI dbx and MokListXRT tables.
125 */
get_handler_for_dbx(const efi_guid_t * sig_type)126 static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *
127 sig_type)
128 {
129 if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0)
130 return uefi_blacklist_x509_tbs;
131 if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0)
132 return uefi_blacklist_binary;
133 return 0;
134 }
135
136 /*
137 * Load the certs contained in the UEFI databases into the platform trusted
138 * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist
139 * keyring.
140 */
load_uefi_certs(void)141 static int __init load_uefi_certs(void)
142 {
143 efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
144 efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
145 void *db = NULL, *dbx = NULL, *mok = NULL;
146 unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
147 int rc = 0;
148
149 if (!efi.get_variable)
150 return false;
151
152 /* Get db, MokListRT, and dbx. They might not exist, so it isn't
153 * an error if we can't get them.
154 */
155 if (!uefi_check_ignore_db()) {
156 db = get_cert_list(L"db", &secure_var, &dbsize);
157 if (!db) {
158 pr_err("MODSIGN: Couldn't get UEFI db list\n");
159 } else {
160 rc = parse_efi_signature_list("UEFI:db",
161 db, dbsize, get_handler_for_db);
162 if (rc)
163 pr_err("Couldn't parse db signatures: %d\n",
164 rc);
165 kfree(db);
166 }
167 }
168
169 mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
170 if (!mok) {
171 pr_info("Couldn't get UEFI MokListRT\n");
172 } else {
173 rc = parse_efi_signature_list("UEFI:MokListRT",
174 mok, moksize, get_handler_for_db);
175 if (rc)
176 pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
177 kfree(mok);
178 }
179
180 dbx = get_cert_list(L"dbx", &secure_var, &dbxsize);
181 if (!dbx) {
182 pr_info("Couldn't get UEFI dbx list\n");
183 } else {
184 rc = parse_efi_signature_list("UEFI:dbx",
185 dbx, dbxsize,
186 get_handler_for_dbx);
187 if (rc)
188 pr_err("Couldn't parse dbx signatures: %d\n", rc);
189 kfree(dbx);
190 }
191
192 return rc;
193 }
194 late_initcall(load_uefi_certs);
195
