94 lines
3.5 KiB
Diff
94 lines
3.5 KiB
Diff
From 89d72301aa67c82f00fe7fa4f42d7f6eb6045538 Mon Sep 17 00:00:00 2001
|
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
Date: Tue, 18 Feb 2020 12:03:28 +0100
|
|
Subject: [PATCH 45/62] shim: Update EFI_LOADED_IMAGE with the second stage
|
|
loader file path
|
|
|
|
When shim loads the second stage loader (e.g: GRUB) the FilePath field of
|
|
the EFI_LOADED_IMAGE structure isn't updated with the path of the loaded
|
|
binary. So it still contains the file path of the shim binary.
|
|
|
|
This isn't a problem since the file path is currently not used. But should
|
|
be used to set the DevicePath field of the EFI_IMAGE_LOAD_EVENT structure
|
|
that is logged when measuring the PE/COFF binaries. In that case the TPM
|
|
Event Log will have an incorrect file path for the measured binary, i.e:
|
|
|
|
$ hexdump -Cv /sys/kernel/security/tpm0/binary_bios_measurements
|
|
...
|
|
00000a50 00 00 00 00 00 00 04 04 34 00 5c 00 45 00 46 00 |........4.\.E.F.|
|
|
00000a60 49 00 5c 00 72 00 65 00 64 00 68 00 61 00 74 00 |I.\.r.e.d.h.a.t.|
|
|
00000a70 5c 00 73 00 68 00 69 00 6d 00 78 00 36 00 34 00 |\.s.h.i.m.x.6.4.|
|
|
00000a80 2e 00 65 00 66 00 69 00 00 00 7f ff 04 00 00 00 |..e.f.i.........|
|
|
00000a90 00 00 00 00 00 00 af 08 00 00 00 0d 00 00 00 b5 |................|
|
|
00000aa0 cd d0 8f bb 16 31 e2 80 8b e8 58 75 c9 89 18 95 |.....1....Xu....|
|
|
00000ab0 d2 de 15 15 00 00 00 67 72 75 62 5f 63 6d 64 20 |.......grub_cmd |
|
|
00000ac0 73 65 74 20 70 61 67 65 72 3d 31 00 08 00 00 00 |set pager=1.....|
|
|
...
|
|
|
|
So update the EFI_LOADED_IMAGE structure with the second stage loader file
|
|
path to have the correct value in the log, i.e:
|
|
|
|
$ hexdump -Cv /sys/kernel/security/tpm0/binary_bios_measurements
|
|
...
|
|
00000a50 00 00 00 00 00 00 04 04 34 00 5c 00 45 00 46 00 |........4.\.E.F.|
|
|
00000a60 49 00 5c 00 72 00 65 00 64 00 68 00 61 00 74 00 |I.\.r.e.d.h.a.t.|
|
|
00000a70 5c 00 67 00 72 00 75 00 62 00 78 00 36 00 34 00 |\.g.r.u.b.x.6.4.|
|
|
00000a80 2e 00 65 00 66 00 69 00 00 00 7f ff 04 00 00 00 |..e.f.i.........|
|
|
00000a90 00 00 00 00 00 00 af 08 00 00 00 0d 00 00 00 b5 |................|
|
|
00000aa0 cd d0 8f bb 16 31 e2 80 8b e8 58 75 c9 89 18 95 |.....1....Xu....|
|
|
00000ab0 d2 de 15 15 00 00 00 67 72 75 62 5f 63 6d 64 20 |.......grub_cmd |
|
|
00000ac0 73 65 74 20 70 61 67 65 72 3d 31 00 08 00 00 00 |set pager=1.....|
|
|
...
|
|
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
Upstream-commit-id: cd7d42d493d
|
|
---
|
|
shim.c | 17 +++++++++++++++--
|
|
1 file changed, 15 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/shim.c b/shim.c
|
|
index 5329795c333..a4f7769b38b 100644
|
|
--- a/shim.c
|
|
+++ b/shim.c
|
|
@@ -1925,6 +1925,16 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath)
|
|
*/
|
|
CopyMem(&li_bak, li, sizeof(li_bak));
|
|
|
|
+ /*
|
|
+ * Update the loaded image with the second stage loader file path
|
|
+ */
|
|
+ li->FilePath = FileDevicePath(NULL, PathName);
|
|
+ if (!li->FilePath) {
|
|
+ perror(L"Unable to update loaded image file path\n");
|
|
+ efi_status = EFI_OUT_OF_RESOURCES;
|
|
+ goto restore;
|
|
+ }
|
|
+
|
|
/*
|
|
* Verify and, if appropriate, relocate and execute the executable
|
|
*/
|
|
@@ -1934,8 +1944,7 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath)
|
|
perror(L"Failed to load image: %r\n", efi_status);
|
|
PrintErrors();
|
|
ClearErrors();
|
|
- CopyMem(li, &li_bak, sizeof(li_bak));
|
|
- goto done;
|
|
+ goto restore;
|
|
}
|
|
|
|
loader_is_participating = 0;
|
|
@@ -1945,6 +1954,10 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath)
|
|
*/
|
|
efi_status = entry_point(image_handle, systab);
|
|
|
|
+restore:
|
|
+ if (li->FilePath)
|
|
+ FreePool(li->FilePath);
|
|
+
|
|
/*
|
|
* Restore our original loaded image values
|
|
*/
|
|
--
|
|
2.26.2
|
|
|