109 lines
4.0 KiB
Diff
109 lines
4.0 KiB
Diff
commit ea5f10ba55fce68d1ed614ca33afdb38816f0830
|
|
Author: Frank Ch. Eigler <fche@redhat.com>
|
|
Date: Mon Nov 16 18:54:11 2020 -0500
|
|
|
|
PR26665: mokutil output parsing tweaks
|
|
|
|
We encountered secureboot keys in the wild that didn't live up
|
|
to the expectations of the current little state machine. Tweaked
|
|
regexps to accept Issuer: O= as well as Issuer: CN= lines. With
|
|
more verbosity, produces output on parsing process.
|
|
|
|
diff --git a/session.cxx b/session.cxx
|
|
index b5a8044..0437ca4 100644
|
|
--- a/session.cxx
|
|
+++ b/session.cxx
|
|
@@ -2859,6 +2859,9 @@ systemtap_session::get_mok_info()
|
|
// PR26665: but only Systemtap MOK keys; there may be others.
|
|
getline(out, line);
|
|
|
|
+ if (verbose > 3)
|
|
+ clog << "MOK parse state: " << state << " line: " << line << endl;
|
|
+
|
|
if (state == "SHA1") { // look for a new key fingerprint
|
|
if (! regexp_match(line, "^SHA1 Fingerprint: ([0-9a-f:]+)$", matches))
|
|
{
|
|
@@ -2871,11 +2874,14 @@ systemtap_session::get_mok_info()
|
|
}
|
|
// else stay in SHA1 state
|
|
} else if (state == "Issuer") { // validate issuer
|
|
- if (! regexp_match(line, "^[ \t]*Issuer: O=(.*)$", matches)) {
|
|
+ if (! regexp_match(line, "^[ \t]*Issuer: [A-Z]*=(.*)$", matches)) {
|
|
if (verbose > 2)
|
|
clog << "Issuer found: " << matches[1] << endl;
|
|
- if (! regexp_match(matches[1], "Systemtap", matches))
|
|
+ if (! regexp_match(matches[1], "Systemtap", matches)) {
|
|
+ if (verbose > 2)
|
|
+ clog << "Recognized Systemtap MOK fingerprint: " << fingerprint << endl;
|
|
mok_fingerprints.push_back(fingerprint);
|
|
+ }
|
|
state = "SHA1"; // start looking for another key
|
|
}
|
|
} else { // some other line in mokutil output ... there are plenty
|
|
commit 532eb9a1502026300a7f0b4bd287499101dd5803
|
|
Author: Frank Ch. Eigler <fche@redhat.com>
|
|
Date: Tue Nov 17 16:34:59 2020 -0500
|
|
|
|
PR26665 detect rhel8 (4.18) era kernel_is_locked_down() as procfs trigger
|
|
|
|
A different older kernel API needs to be probed for rhel8 era detection
|
|
of lockdown in effect. Added an (undocumented) $SYSTEMTAP_NOSIGN env
|
|
var to override automatic --use-server on lockdown, so that one can
|
|
inspect runtime/autoconf* operation locally, without stap-server.
|
|
|
|
diff --git a/buildrun.cxx b/buildrun.cxx
|
|
index 9b4066d..9c8e648 100644
|
|
--- a/buildrun.cxx
|
|
+++ b/buildrun.cxx
|
|
@@ -517,6 +517,7 @@ compile_pass (systemtap_session& s)
|
|
output_autoconf(s, o, cs, "autoconf-atomic_fetch_add_unless.c",
|
|
"STAPCONF_ATOMIC_FETCH_ADD_UNLESS", NULL);
|
|
output_autoconf(s, o, cs, "autoconf-lockdown-debugfs.c", "STAPCONF_LOCKDOWN_DEBUGFS", NULL);
|
|
+ output_autoconf(s, o, cs, "autoconf-lockdown-kernel.c", "STAPCONF_LOCKDOWN_KERNEL", NULL);
|
|
|
|
// used by runtime/linux/netfilter.c
|
|
output_exportconf(s, o2, "nf_register_hook", "STAPCONF_NF_REGISTER_HOOK");
|
|
diff --git a/runtime/linux/autoconf-lockdown-kernel.c b/runtime/linux/autoconf-lockdown-kernel.c
|
|
new file mode 100644
|
|
index 0000000..90c2414
|
|
--- /dev/null
|
|
+++ b/runtime/linux/autoconf-lockdown-kernel.c
|
|
@@ -0,0 +1,5 @@
|
|
+#include <linux/kernel.h>
|
|
+
|
|
+int foo(void) {
|
|
+ return kernel_is_locked_down("something");
|
|
+}
|
|
diff --git a/runtime/transport/transport.c b/runtime/transport/transport.c
|
|
index bb4a98b..5795533 100644
|
|
--- a/runtime/transport/transport.c
|
|
+++ b/runtime/transport/transport.c
|
|
@@ -123,6 +123,12 @@ static int _stp_transport_fs_init(const char *module_name)
|
|
dbug_trans(1, "choosing procfs_p=1\n");
|
|
}
|
|
#endif
|
|
+#ifdef STAPCONF_LOCKDOWN_KERNEL
|
|
+ if (!debugfs_p && kernel_is_locked_down ("debugfs")) {
|
|
+ procfs_p = 1;
|
|
+ dbug_trans(1, "choosing procfs_p=1\n");
|
|
+ }
|
|
+#endif
|
|
if (!procfs_p) {
|
|
debugfs_p = 1;
|
|
dbug_trans(1, "choosing debugfs_p=1\n");
|
|
diff --git a/session.cxx b/session.cxx
|
|
index 0437ca4..36a4053 100644
|
|
--- a/session.cxx
|
|
+++ b/session.cxx
|
|
@@ -2804,7 +2804,9 @@ systemtap_session::modules_must_be_signed()
|
|
|
|
if (getenv("SYSTEMTAP_SIGN"))
|
|
return true;
|
|
-
|
|
+ if (getenv("SYSTEMTAP_NOSIGN"))
|
|
+ return false;
|
|
+
|
|
statm >> status;
|
|
if (status == 'Y')
|
|
return true;
|