130 lines
5.0 KiB
Diff
130 lines
5.0 KiB
Diff
From 8f73052885892bc0dbc01e297f79d7cf4925e491 Mon Sep 17 00:00:00 2001
|
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
Date: Mon, 28 Sep 2020 20:08:33 +0200
|
|
Subject: efi: Use grub_is_lockdown() instead of hardcoding a disabled modules
|
|
list
|
|
|
|
Now the GRUB can check if it has been locked down and this can be used to
|
|
prevent executing commands that can be utilized to circumvent the UEFI
|
|
Secure Boot mechanisms. So, instead of hardcoding a list of modules that
|
|
have to be disabled, prevent the usage of commands that can be dangerous.
|
|
|
|
This not only allows the commands to be disabled on other platforms, but
|
|
also properly separate the concerns. Since the shim_lock verifier logic
|
|
should be only about preventing to run untrusted binaries and not about
|
|
defining these kind of policies.
|
|
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
---
|
|
docs/grub.texi | 15 +++++++-----
|
|
grub-core/commands/i386/wrmsr.c | 5 ++--
|
|
grub-core/commands/iorw.c | 19 +++++++--------
|
|
grub-core/commands/memrw.c | 19 +++++++--------
|
|
4 files changed, 32 insertions(+), 67 deletions(-)
|
|
|
|
diff --git a/grub-core/commands/i386/wrmsr.c b/grub-core/commands/i386/wrmsr.c
|
|
index 9c5e510eb..56a29c29f 100644
|
|
--- a/grub-core/commands/i386/wrmsr.c
|
|
+++ b/grub-core/commands/i386/wrmsr.c
|
|
@@ -24,6 +24,7 @@
|
|
#include <grub/env.h>
|
|
#include <grub/command.h>
|
|
#include <grub/extcmd.h>
|
|
+#include <grub/lockdown.h>
|
|
#include <grub/i18n.h>
|
|
#include <grub/i386/cpuid.h>
|
|
#include <grub/i386/wrmsr.h>
|
|
@@ -83,8 +84,8 @@ grub_cmd_msr_write (grub_command_t cmd __attribute__ ((unused)), int argc, char
|
|
|
|
GRUB_MOD_INIT(wrmsr)
|
|
{
|
|
- cmd_write = grub_register_command ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"),
|
|
- N_("Write a value to a CPU model specific register."));
|
|
+ cmd_write = grub_register_command_lockdown ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"),
|
|
+ N_("Write a value to a CPU model specific register."));
|
|
}
|
|
|
|
GRUB_MOD_FINI(wrmsr)
|
|
diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
|
|
index a0c164e54..584baec8f 100644
|
|
--- a/grub-core/commands/iorw.c
|
|
+++ b/grub-core/commands/iorw.c
|
|
@@ -23,6 +23,7 @@
|
|
#include <grub/cpu/io.h>
|
|
#include <grub/i18n.h>
|
|
#include <grub/efi/sb.h>
|
|
+#include <grub/lockdown.h>
|
|
|
|
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
|
@@ -131,17 +132,17 @@ GRUB_MOD_INIT(memrw)
|
|
N_("PORT"), N_("Read 32-bit value from PORT."),
|
|
options);
|
|
cmd_write_byte =
|
|
- grub_register_command ("outb", grub_cmd_write,
|
|
- N_("PORT VALUE [MASK]"),
|
|
- N_("Write 8-bit VALUE to PORT."));
|
|
+ grub_register_command_lockdown ("outb", grub_cmd_write,
|
|
+ N_("PORT VALUE [MASK]"),
|
|
+ N_("Write 8-bit VALUE to PORT."));
|
|
cmd_write_word =
|
|
- grub_register_command ("outw", grub_cmd_write,
|
|
- N_("PORT VALUE [MASK]"),
|
|
- N_("Write 16-bit VALUE to PORT."));
|
|
+ grub_register_command_lockdown ("outw", grub_cmd_write,
|
|
+ N_("PORT VALUE [MASK]"),
|
|
+ N_("Write 16-bit VALUE to PORT."));
|
|
cmd_write_dword =
|
|
- grub_register_command ("outl", grub_cmd_write,
|
|
- N_("ADDR VALUE [MASK]"),
|
|
- N_("Write 32-bit VALUE to PORT."));
|
|
+ grub_register_command_lockdown ("outl", grub_cmd_write,
|
|
+ N_("ADDR VALUE [MASK]"),
|
|
+ N_("Write 32-bit VALUE to PORT."));
|
|
}
|
|
|
|
GRUB_MOD_FINI(memrw)
|
|
diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
|
|
index 98769eadb..d401a6db0 100644
|
|
--- a/grub-core/commands/memrw.c
|
|
+++ b/grub-core/commands/memrw.c
|
|
@@ -22,6 +22,7 @@
|
|
#include <grub/env.h>
|
|
#include <grub/i18n.h>
|
|
#include <grub/efi/sb.h>
|
|
+#include <grub/lockdown.h>
|
|
|
|
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
|
@@ -133,17 +134,17 @@ GRUB_MOD_INIT(memrw)
|
|
N_("ADDR"), N_("Read 32-bit value from ADDR."),
|
|
options);
|
|
cmd_write_byte =
|
|
- grub_register_command ("write_byte", grub_cmd_write,
|
|
- N_("ADDR VALUE [MASK]"),
|
|
- N_("Write 8-bit VALUE to ADDR."));
|
|
+ grub_register_command_lockdown ("write_byte", grub_cmd_write,
|
|
+ N_("ADDR VALUE [MASK]"),
|
|
+ N_("Write 8-bit VALUE to ADDR."));
|
|
cmd_write_word =
|
|
- grub_register_command ("write_word", grub_cmd_write,
|
|
- N_("ADDR VALUE [MASK]"),
|
|
- N_("Write 16-bit VALUE to ADDR."));
|
|
+ grub_register_command_lockdown ("write_word", grub_cmd_write,
|
|
+ N_("ADDR VALUE [MASK]"),
|
|
+ N_("Write 16-bit VALUE to ADDR."));
|
|
cmd_write_dword =
|
|
- grub_register_command ("write_dword", grub_cmd_write,
|
|
- N_("ADDR VALUE [MASK]"),
|
|
- N_("Write 32-bit VALUE to ADDR."));
|
|
+ grub_register_command_lockdown ("write_dword", grub_cmd_write,
|
|
+ N_("ADDR VALUE [MASK]"),
|
|
+ N_("Write 32-bit VALUE to ADDR."));
|
|
}
|
|
|
|
GRUB_MOD_FINI(memrw)
|
|
--
|
|
2.23.0
|
|
|