LM
/
u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

efi_loader: don't load signature database from file 

The UEFI specification requires that the signature database may only be
stored in tamper-resistant storage. So these variable may not be read
from an unsigned file.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
This commit is contained in:
Heinrich Schuchardt 2021-08-25 19:13:24 +02:00 committed by Heinrich Schuchardt
parent f3a343d733
commit 9ef82e2947
4 changed files with 29 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/efi_variable.h
View File

@ -161,10 +161,13 @@ efi_status_t __maybe_unused efi_var_collect(struct efi_var_file **bufp, loff_t *
/** /**
* efi_var_restore() - restore EFI variables from buffer * efi_var_restore() - restore EFI variables from buffer
* *
* Only if @safe is set secure boot related variables will be restored.
*
* @buf: buffer * @buf: buffer
* @safe: restoring from tamper-resistant storage
* Return: status code * Return: status code
*/ */
efi_status_t efi_var_restore(struct efi_var_file *buf); efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe);
/** /**
* efi_var_from_file() - read variables from file * efi_var_from_file() - read variables from file

2
lib/efi_loader/efi_var_common.c
View File

@ -32,10 +32,8 @@ static const struct efi_auth_var_name_type name_type[] = {
{u"KEK", &efi_global_variable_guid, EFI_AUTH_VAR_KEK}, {u"KEK", &efi_global_variable_guid, EFI_AUTH_VAR_KEK},
{u"db", &efi_guid_image_security_database, EFI_AUTH_VAR_DB}, {u"db", &efi_guid_image_security_database, EFI_AUTH_VAR_DB},
{u"dbx", &efi_guid_image_security_database, EFI_AUTH_VAR_DBX}, {u"dbx", &efi_guid_image_security_database, EFI_AUTH_VAR_DBX},
/* not used yet
{u"dbt", &efi_guid_image_security_database, EFI_AUTH_VAR_DBT}, {u"dbt", &efi_guid_image_security_database, EFI_AUTH_VAR_DBT},
{u"dbr", &efi_guid_image_security_database, EFI_AUTH_VAR_DBR}, {u"dbr", &efi_guid_image_security_database, EFI_AUTH_VAR_DBR},
*/
}; };
static bool efi_secure_boot; static bool efi_secure_boot;

39
lib/efi_loader/efi_var_file.c
View File

@ -148,9 +148,10 @@ error:
#endif #endif
} }
efi_status_t efi_var_restore(struct efi_var_file *buf) efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe)
{ {
struct efi_var_entry *var, *last_var; struct efi_var_entry *var, *last_var;
u16 *data;
efi_status_t ret; efi_status_t ret;
if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC || if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC ||
@ -160,21 +161,29 @@ efi_status_t efi_var_restore(struct efi_var_file *buf)
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
var = buf->var;
last_var = (struct efi_var_entry *)((u8 *)buf + buf->length); last_var = (struct efi_var_entry *)((u8 *)buf + buf->length);
while (var < last_var) { for (var = buf->var; var < last_var;
u16 *data = var->name + u16_strlen(var->name) + 1; var = (struct efi_var_entry *)
ALIGN((uintptr_t)data + var->length, 8)) {
if (var->attr & EFI_VARIABLE_NON_VOLATILE && var->length) { data = var->name + u16_strlen(var->name) + 1;
ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
var->length, data, 0, NULL, /*
var->time); * Secure boot related and non-volatile variables shall only be
if (ret != EFI_SUCCESS) * restored from U-Boot's preseed.
log_err("Failed to set EFI variable %ls\n", */
var->name); if (!safe &&
} (efi_auth_var_get_type(var->name, &var->guid) !=
var = (struct efi_var_entry *) EFI_AUTH_VAR_NONE ||
ALIGN((uintptr_t)data + var->length, 8); !(var->attr & EFI_VARIABLE_NON_VOLATILE)))
continue;
if (!var->length)
continue;
ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
var->length, data, 0, NULL,
var->time);
if (ret != EFI_SUCCESS)
log_err("Failed to set EFI variable %ls\n", var->name);
} }
return EFI_SUCCESS; return EFI_SUCCESS;
} }
@ -213,7 +222,7 @@ efi_status_t efi_var_from_file(void)
log_err("Failed to load EFI variables\n"); log_err("Failed to load EFI variables\n");
goto error; goto error;
} }
if (buf->length != len || efi_var_restore(buf) != EFI_SUCCESS) if (buf->length != len || efi_var_restore(buf, false) != EFI_SUCCESS)
log_err("Invalid EFI variables file\n"); log_err("Invalid EFI variables file\n");
error: error:
free(buf); free(buf);

2
lib/efi_loader/efi_variable.c
View File

@ -426,7 +426,7 @@ efi_status_t efi_init_variables(void)
if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) { if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
ret = efi_var_restore((struct efi_var_file *) ret = efi_var_restore((struct efi_var_file *)
__efi_var_file_begin); __efi_var_file_begin, true);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
log_err("Invalid EFI variable seed\n"); log_err("Invalid EFI variable seed\n");
} }