rpms/kernel
9
2
Fork 4
Code Issues Pull Requests Releases Activity

Updates for secure boot

Browse Source
This commit is contained in:
Justin M. Forbes 2019-01-07 15:09:43 -06:00
parent 27b219978f
commit cc1db7f347
8 changed files with 34 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
0001-Make-get_cert_list-not-complain-about-cert-lists-tha.patch
View File

@ -6,14 +6,14 @@ Subject: [PATCH 1/3] Make get_cert_list() not complain about cert lists that
Signed-off-by: Peter Jones <pjones@redhat.com> Signed-off-by: Peter Jones <pjones@redhat.com>
--- ---
certs/load_uefi.c | 37 ++++++++++++++++++++++--------------- security/integrity/platform_certs/load_uefi.c | 37 ++++++++++++++++++++++---------------
1 file changed, 22 insertions(+), 15 deletions(-) 1 file changed, 22 insertions(+), 15 deletions(-)
diff --git a/certs/load_uefi.c b/certs/load_uefi.c diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index 3d884598601..9ef34c44fd1 100644 index 81b19c52832b..e188f3ecbce3 100644
--- a/certs/load_uefi.c --- a/security/integrity/platform_certs/load_uefi.c
+++ b/certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c
@@ -35,8 +35,8 @@ static __init bool uefi_check_ignore_db(void) @@ -38,8 +38,8 @@ static __init bool uefi_check_ignore_db(void)
/* /*
* Get a certificate list blob from the named EFI variable. * Get a certificate list blob from the named EFI variable.
*/ */
@ -24,7 +24,7 @@ index 3d884598601..9ef34c44fd1 100644
{ {
efi_status_t status; efi_status_t status;
unsigned long lsize = 4; unsigned long lsize = 4;
@@ -44,26 +44,33 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, @@ -47,24 +47,31 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
void *db; void *db;
status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
@ -41,11 +41,9 @@ index 3d884598601..9ef34c44fd1 100644
} }
db = kmalloc(lsize, GFP_KERNEL); db = kmalloc(lsize, GFP_KERNEL);
if (!db) { if (!db)
pr_err("Couldn't allocate memory for uefi cert list\n");
- return NULL; - return NULL;
+ return -ENOMEM; + return -ENOMEM;
}
status = efi.get_variable(name, guid, NULL, &lsize, db); status = efi.get_variable(name, guid, NULL, &lsize, db);
if (status != EFI_SUCCESS) { if (status != EFI_SUCCESS) {
@ -62,7 +60,7 @@ index 3d884598601..9ef34c44fd1 100644
} }
/* /*
@@ -152,10 +159,10 @@ static int __init load_uefi_certs(void) @@ -153,10 +160,10 @@ static int __init load_uefi_certs(void)
* an error if we can't get them. * an error if we can't get them.
*/ */
if (!uefi_check_ignore_db()) { if (!uefi_check_ignore_db()) {
@ -76,7 +74,7 @@ index 3d884598601..9ef34c44fd1 100644
rc = parse_efi_signature_list("UEFI:db", rc = parse_efi_signature_list("UEFI:db",
db, dbsize, get_handler_for_db); db, dbsize, get_handler_for_db);
if (rc) if (rc)
@@ -164,10 +171,10 @@ static int __init load_uefi_certs(void) @@ -166,10 +173,10 @@ static int __init load_uefi_certs(void)
} }
} }
@ -84,13 +82,13 @@ index 3d884598601..9ef34c44fd1 100644
- if (!mok) { - if (!mok) {
+ rc = get_cert_list(L"MokListRT", &mok_var, &moksize, &mok); + rc = get_cert_list(L"MokListRT", &mok_var, &moksize, &mok);
+ if (rc < 0) { + if (rc < 0) {
pr_info("MODSIGN: Couldn't get UEFI MokListRT\n"); pr_info("Couldn't get UEFI MokListRT\n");
- } else { - } else {
+ } else if (moksize != 0) { + } else if (moksize != 0) {
rc = parse_efi_signature_list("UEFI:MokListRT", rc = parse_efi_signature_list("UEFI:MokListRT",
mok, moksize, get_handler_for_db); mok, moksize, get_handler_for_db);
if (rc) if (rc)
@@ -175,10 +182,10 @@ static int __init load_uefi_certs(void) @@ -177,10 +184,10 @@ static int __init load_uefi_certs(void)
kfree(mok); kfree(mok);
} }
@ -98,12 +96,9 @@ index 3d884598601..9ef34c44fd1 100644
- if (!dbx) { - if (!dbx) {
+ rc = get_cert_list(L"dbx", &secure_var, &dbxsize, &dbx); + rc = get_cert_list(L"dbx", &secure_var, &dbxsize, &dbx);
+ if (rc < 0) { + if (rc < 0) {
pr_info("MODSIGN: Couldn't get UEFI dbx list\n"); pr_info("Couldn't get UEFI dbx list\n");
- } else { - } else {
+ } else if (dbxsize != 0) { + } else if (dbxsize != 0) {
rc = parse_efi_signature_list("UEFI:dbx", rc = parse_efi_signature_list("UEFI:dbx",
dbx, dbxsize, dbx, dbxsize,
get_handler_for_dbx); get_handler_for_dbx);
--
2.15.0

8
0003-Make-get_cert_list-use-efi_status_to_str-to-print-er.patch
View File

@ -6,13 +6,13 @@ Subject: [PATCH 3/3] Make get_cert_list() use efi_status_to_str() to print
Signed-off-by: Peter Jones <pjones@redhat.com> Signed-off-by: Peter Jones <pjones@redhat.com>
--- ---
certs/load_uefi.c | 6 ++++-- security/integrity/platform_certs/load_uefi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-) 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/certs/load_uefi.c b/certs/load_uefi.c diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index 9ef34c44fd1..13a2826715d 100644 index 9ef34c44fd1..13a2826715d 100644
--- a/certs/load_uefi.c --- a/security/integrity/platform_certs/load_uefi.c
+++ b/certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c
@@ -51,7 +51,8 @@ static __init int get_cert_list(efi_char16_t *name, efi_guid_t *guid, @@ -51,7 +51,8 @@ static __init int get_cert_list(efi_char16_t *name, efi_guid_t *guid,
} }

1
configs/fedora/generic/x86/CONFIG_INTEGRITY_PLATFORM_KEYRING Normal file
View File

@ -0,0 +1 @@
CONFIG_INTEGRITY_PLATFORM_KEYRING=y

2
kernel-i686-debug.config
View File

@ -2335,7 +2335,7 @@ CONFIG_INT3406_THERMAL=m
CONFIG_INT340X_THERMAL=m CONFIG_INT340X_THERMAL=m
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_AUDIT=y CONFIG_INTEGRITY_AUDIT=y
# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY=y CONFIG_INTEGRITY=y
CONFIG_INTEL_ATOMISP2_PM=m CONFIG_INTEL_ATOMISP2_PM=m

2
kernel-i686.config
View File

@ -2317,7 +2317,7 @@ CONFIG_INT3406_THERMAL=m
CONFIG_INT340X_THERMAL=m CONFIG_INT340X_THERMAL=m
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_AUDIT=y CONFIG_INTEGRITY_AUDIT=y
# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY=y CONFIG_INTEGRITY=y
CONFIG_INTEL_ATOMISP2_PM=m CONFIG_INTEL_ATOMISP2_PM=m

2
kernel-x86_64-debug.config
View File

@ -2380,7 +2380,7 @@ CONFIG_INT3406_THERMAL=m
CONFIG_INT340X_THERMAL=m CONFIG_INT340X_THERMAL=m
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_AUDIT=y CONFIG_INTEGRITY_AUDIT=y
# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY=y CONFIG_INTEGRITY=y
CONFIG_INTEL_ATOMISP2_PM=m CONFIG_INTEL_ATOMISP2_PM=m

2
kernel-x86_64.config
View File

@ -2362,7 +2362,7 @@ CONFIG_INT3406_THERMAL=m
CONFIG_INT340X_THERMAL=m CONFIG_INT340X_THERMAL=m
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_AUDIT=y CONFIG_INTEGRITY_AUDIT=y
# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY=y CONFIG_INTEGRITY=y
CONFIG_INTEL_ATOMISP2_PM=m CONFIG_INTEL_ATOMISP2_PM=m

9
kernel.spec
View File

@ -544,12 +544,6 @@ Patch201: efi-lockdown.patch
Patch202: KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch Patch202: KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
Patch204: Add-an-EFI-signature-blob-parser-and-key-loader.patch
Patch205: MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
Patch206: MODSIGN-Support-not-importing-certs-from-db.patch
# bz 1497559 - Make kernel MODSIGN code not error on missing variables # bz 1497559 - Make kernel MODSIGN code not error on missing variables
Patch207: 0001-Make-get_cert_list-not-complain-about-cert-lists-tha.patch Patch207: 0001-Make-get_cert_list-not-complain-about-cert-lists-tha.patch
Patch208: 0002-Add-efi_status_to_str-and-rework-efi_status_to_err.patch Patch208: 0002-Add-efi_status_to_str-and-rework-efi_status_to_err.patch
@ -1878,6 +1872,9 @@ fi
# #
# #
%changelog %changelog
* Mon Jan 07 2019 Justin M. Forbes <jforbes@fedoraproject.org>
- Updates for secure boot
* Mon Jan 07 2019 Laura Abbott <labbott@redhat.com> - 5.0.0-0.rc1.git0.1 * Mon Jan 07 2019 Laura Abbott <labbott@redhat.com> - 5.0.0-0.rc1.git0.1
- Linux v5.0-rc1 - Linux v5.0-rc1