132 lines
5.4 KiB
Diff
132 lines
5.4 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
|
|
Date: Mon, 6 Oct 2025 12:54:49 +0530
|
|
Subject: [PATCH] grub-install: Support embedding x509 certificates
|
|
|
|
To support verification of appended signatures, we need a way to embed the
|
|
necessary public keys. Existing appended signature schemes in the Linux kernel
|
|
use X.509 certificates, so allow certificates to be embedded in the GRUB core
|
|
image in the same way as PGP keys.
|
|
|
|
Signed-off-by: Alastair D'Silva <alastair@d-silva.org>
|
|
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
|
|
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
|
|
Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
---
|
|
include/grub/kernel.h | 2 +-
|
|
include/grub/util/install.h | 4 ++--
|
|
util/grub-install-common.c | 4 ++++
|
|
util/grub-mkimage.c | 6 +++---
|
|
util/mkimage.c | 17 +++++++++++------
|
|
5 files changed, 21 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/include/grub/kernel.h b/include/grub/kernel.h
|
|
index 973cc1c4e4ab..0ada6008c68b 100644
|
|
--- a/include/grub/kernel.h
|
|
+++ b/include/grub/kernel.h
|
|
@@ -29,10 +29,10 @@ enum
|
|
OBJ_TYPE_CONFIG,
|
|
OBJ_TYPE_PREFIX,
|
|
OBJ_TYPE_GPG_PUBKEY,
|
|
+ OBJ_TYPE_X509_PUBKEY,
|
|
OBJ_TYPE_DTB,
|
|
OBJ_TYPE_DISABLE_SHIM_LOCK,
|
|
OBJ_TYPE_GPG_PUBKEY,
|
|
- OBJ_TYPE_X509_PUBKEY,
|
|
OBJ_TYPE_DISABLE_CLI
|
|
};
|
|
|
|
diff --git a/include/grub/util/install.h b/include/grub/util/install.h
|
|
index a0c08813586e..ccf799ff7169 100644
|
|
--- a/include/grub/util/install.h
|
|
+++ b/include/grub/util/install.h
|
|
@@ -67,10 +67,10 @@
|
|
N_("SBAT metadata"), 0 }, \
|
|
{ "disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, \
|
|
N_("disable shim_lock verifier"), 0 }, \
|
|
- { "x509key", 'x', N_("FILE"), 0, \
|
|
- N_("embed FILE as an x509 certificate for signature checking"), 0}, \
|
|
{ "disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, \
|
|
N_("disabled command line interface access"), 0 }, \
|
|
+ { "x509key", 'x', N_("FILE"), 0, \
|
|
+ N_("embed FILE as an x509 certificate for appended signature checking"), 0}, \
|
|
{ "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE, \
|
|
"SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), 1}, \
|
|
{ "verbose", 'v', 0, 0, \
|
|
diff --git a/util/grub-install-common.c b/util/grub-install-common.c
|
|
index 608b8bc64a2b..7f0aedb0582c 100644
|
|
--- a/util/grub-install-common.c
|
|
+++ b/util/grub-install-common.c
|
|
@@ -514,6 +514,10 @@ grub_install_parse (int key, char *arg)
|
|
case GRUB_INSTALL_OPTIONS_DISABLE_CLI:
|
|
disable_cli = 1;
|
|
return 1;
|
|
+ case 'x':
|
|
+ x509keys = xrealloc (x509keys, sizeof (x509keys[0]) * (nx509keys + 1));
|
|
+ x509keys[nx509keys++] = xstrdup (arg);
|
|
+ return 1;
|
|
|
|
case GRUB_INSTALL_OPTIONS_VERBOSITY:
|
|
verbosity++;
|
|
diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c
|
|
index 1871ef3a114c..55f3eaa49f78 100644
|
|
--- a/util/grub-mkimage.c
|
|
+++ b/util/grub-mkimage.c
|
|
@@ -76,7 +76,7 @@ static struct argp_option options[] = {
|
|
{"config", 'c', N_("FILE"), 0, N_("embed FILE as an early config"), 0},
|
|
/* TRANSLATORS: "embed" is a verb (command description). "*/
|
|
{"pubkey", 'k', N_("FILE"), 0, N_("embed FILE as public key for PGP signature checking"), 0},
|
|
- {"x509", 'x', N_("FILE"), 0, N_("embed FILE as an x509 certificate for appended signature checking"), 0},
|
|
+ {"x509key", 'x', N_("FILE"), 0, N_("embed FILE as an x509 certificate for appended signature checking"), 0},
|
|
/* TRANSLATORS: NOTE is a name of segment. */
|
|
{"note", 'n', 0, 0, N_("add NOTE segment for CHRP IEEE1275"), 0},
|
|
{"output", 'o', N_("FILE"), 0, N_("output a generated image to FILE [default=stdout]"), 0},
|
|
@@ -221,11 +221,11 @@ argp_parser (int key, char *arg, struct argp_state *state)
|
|
|
|
case 'x':
|
|
arguments->x509keys = xrealloc (arguments->x509keys,
|
|
- sizeof (arguments->x509keys[0])
|
|
- * (arguments->nx509keys + 1));
|
|
+ sizeof (arguments->x509keys[0]) * (arguments->nx509keys + 1));
|
|
arguments->x509keys[arguments->nx509keys++] = xstrdup (arg);
|
|
break;
|
|
|
|
+
|
|
case 'c':
|
|
if (arguments->config)
|
|
free (arguments->config);
|
|
diff --git a/util/mkimage.c b/util/mkimage.c
|
|
index 96f0c82a09e9..004e71182afb 100644
|
|
--- a/util/mkimage.c
|
|
+++ b/util/mkimage.c
|
|
@@ -914,16 +914,21 @@ grub_install_generate_image (const char *dir, const char *prefix,
|
|
}
|
|
}
|
|
|
|
+ if (nx509keys != 0 && image_target->id != IMAGE_PPC)
|
|
+ grub_util_error (_("x509 public key can be support only to appended signature"
|
|
+ " with powerpc-ieee1275 images"));
|
|
+
|
|
{
|
|
size_t i;
|
|
+
|
|
for (i = 0; i < nx509keys; i++)
|
|
{
|
|
- size_t curs;
|
|
- curs = ALIGN_ADDR (grub_util_get_image_size (x509key_paths[i]));
|
|
- grub_util_info ("the size of x509 public key %u is 0x%"
|
|
- GRUB_HOST_PRIxLONG_LONG,
|
|
- (unsigned) i, (unsigned long long) curs);
|
|
- total_module_size += curs + sizeof (struct grub_module_header);
|
|
+ size_t curs;
|
|
+
|
|
+ curs = ALIGN_ADDR (grub_util_get_image_size (x509key_paths[i]));
|
|
+ grub_util_info ("the size of x509 public key %u is 0x%" GRUB_HOST_PRIxLONG_LONG,
|
|
+ (unsigned) i, (unsigned long long) curs);
|
|
+ total_module_size += curs + sizeof (struct grub_module_header);
|
|
}
|
|
}
|
|
|