From patchwork Sun Jun 19 05:20:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahisa Kojima X-Patchwork-Id: 583001 Delivered-To: patch@linaro.org Received: by 2002:a05:7000:7814:0:0:0:0 with SMTP id b20csp757976mav; Sat, 18 Jun 2022 22:19:40 -0700 (PDT) X-Google-Smtp-Source: AGRyM1tVepNB9lhM5sZO6h1SyivHn4FqbhD3O5sRYYSy62X8iJouG7ckS1zbbLGEDhsno5bNKkD2 X-Received: by 2002:a17:907:6d8b:b0:71d:9537:38f8 with SMTP id sb11-20020a1709076d8b00b0071d953738f8mr8374625ejc.72.1655615980547; Sat, 18 Jun 2022 22:19:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1655615980; cv=none; d=google.com; s=arc-20160816; b=jol+2W9YM/+hDXVmiomJzqaf0wGKLtSLMQT4Nf4XJF5kFR1dQ9fyHZl5MHkg4ocv5N Ix8D6pmF/Pyxmi8GwzNEtew0RZ0GMITxerFBxHC+nxC38i7RnqDKzF7yCr3fHbf+1UZe F3nNrhsyGbVM0yZIRvwmDOLi2hekhIfyQy8fIJ4oW835BjgWxHKx/DMC7crMcvpkbHCD PfPJQF0eqjeKUC5kL3uiohNv4bYdpPKTcdLsluQ0hXBwJSYEk2o+eqQJc6ivw04XA1wh D1x2xegetB3HqHEL+IOtO20vluEqFQGHe+cHCT1mEGzW/o02Drit2Z0nZ9KUb96LHj9f UujQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=dwnBaRDWZ+z+GDBjL2MTtNIZfaKdj5ScUsTmuHYzZow=; b=ppWIoqLl0kWMBdK73vENQSygfpVAMlHo8z7T9jI2+ZfeCRAJ4A1KA0IND6oAoH9+K+ FUbP6MoMO8XsAwiQZPbfJ2Yi6O5PtA1KfWfnnN1iZy4VXV9wtiNQlwEB1v5UbGm4FNci qd4ulWJokZuH62w4mryLeKVVAYl1kaQhisiyvbDqYRSu2HH9FZZIqviL1/gWLu88YbBT akFODMAhuMHC5qb5E8vSr7nGK8fH+zp28/aL/Y3OekLuTUxNH1kfvF+mjrHEYxs6N1wf A+Rg2r+5kHdqbBymil68IMJi499lb7xHVhQPo6FvoDQmZtyumhkAPGQl2W51wbqipfGp ydUg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=GvFratSV; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id 25-20020a170906015900b006fea2b8ed8dsi9008786ejh.297.2022.06.18.22.19.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jun 2022 22:19:40 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=GvFratSV; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id D9B2384407; Sun, 19 Jun 2022 07:19:35 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="GvFratSV"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id E4A2C843EA; Sun, 19 Jun 2022 07:19:34 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 26786843D4 for ; Sun, 19 Jun 2022 07:19:32 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-pg1-x530.google.com with SMTP id 31so7439746pgv.11 for ; Sat, 18 Jun 2022 22:19:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=dwnBaRDWZ+z+GDBjL2MTtNIZfaKdj5ScUsTmuHYzZow=; b=GvFratSVw/XLQYkln96IvJ0kykM/ZQy/8K1ekRgvLfICEaFk3s0jHu3Q+wb1uvDXvF FJ/mZtyuQY1c7dSS7DPeHBY+JpeXMKcYlqG7kX+JfI4Ze9pQRzLxYhAEEV1M2T5jF10+ FlmdF9VkoUB1JjBtwak3xDd+2lbL0CnKA8criQ5klnT4JDsc7jLa9IE+vM3KzYsAUUVL 3aTcCkJjX2P5DD+DpjtBzGWWtJ+1rYLPWof/1Y4BfCh6lNMmYS8qLqXmnWSCV8xrM23F FYwRqM0Bvj+a7Zk6AjL5+Q0vLmxtoXmXENxF40MmYWN748UukVcTKpDH/mf8rhmAVjYS CoWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=dwnBaRDWZ+z+GDBjL2MTtNIZfaKdj5ScUsTmuHYzZow=; b=uy9m28q4Sp9tw4RW1xHDyJERSknpZsQm2iccwYIZkDTGurtgOjx73a4fZqqPYBztgR Fkkzk5li8FOX7I1RSpurZFrQ5Za8/k3llcKnb9ornqkUETqKC7WxuYttG1SCLEIJ0mtM IdxulohUtPznlt8I3qSDgTpIBj5OSHqrvPcp9VlcBF1h4kxlyvgNXl1xh7uWu10wImeN 4jzNYazXzIdcN8EdlMocl18VXEzQW4b3nqDTj1h+cZn3wN4KtangCJpara2Act/E6uBi rjscywPByITm5FJIRf3K4t/sGmp+WWoUvnYGfALgvE2chYlqRF9xvKDYTomLMfcNWJIt R9NA== X-Gm-Message-State: AJIora8QibOZtrrsOeofRer4wbCECU6VTlLn6T26HEaXzfMZcp465GVl Pw2nNozXqQjN8lLxqVtqe46LsBYNuj/jtA== X-Received: by 2002:a63:2160:0:b0:3fc:b8ac:1976 with SMTP id s32-20020a632160000000b003fcb8ac1976mr16293734pgm.453.1655615970191; Sat, 18 Jun 2022 22:19:30 -0700 (PDT) Received: from localhost.localdomain ([240d:1a:cf7:5800:82fa:5bff:fe4b:26b1]) by smtp.gmail.com with ESMTPSA id j3-20020a170903024300b001636c0b98a7sm6087243plh.226.2022.06.18.22.19.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jun 2022 22:19:29 -0700 (PDT) From: Masahisa Kojima To: u-boot@lists.denx.de Cc: Heinrich Schuchardt , Ilias Apalodimas , Simon Glass , Takahiro Akashi , Francois Ozog , Mark Kettenis , Masahisa Kojima , Chris Morgan , Roland Gaudig , Huang Jianan , Ashok Reddy Soma , Ovidiu Panait Subject: [RFC PATCH 1/3] eficonfig: add UEFI Secure Boot Key enrollment interface Date: Sun, 19 Jun 2022 14:20:20 +0900 Message-Id: <20220619052022.2694-2-masahisa.kojima@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220619052022.2694-1-masahisa.kojima@linaro.org> References: <20220619052022.2694-1-masahisa.kojima@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean This commit adds the menu-driven UEFI Secure Boot Key enrollment interface. User can enroll the PK, KEK, db and dbx by selecting EFI Signature Lists file. After the PK is enrolled, UEFI Secure Boot is enabled and EFI Signature Lists file must be signed by KEK or PK. Signed-off-by: Masahisa Kojima --- cmd/Makefile | 3 + cmd/eficonfig.c | 3 + cmd/eficonfig_sbkey.c | 202 ++++++++++++++++++++++++++++++++++++++++++ include/efi_config.h | 3 + 4 files changed, 211 insertions(+) create mode 100644 cmd/eficonfig_sbkey.c diff --git a/cmd/Makefile b/cmd/Makefile index 0afa687e94..9d87b639fc 100644 --- a/cmd/Makefile +++ b/cmd/Makefile @@ -64,6 +64,9 @@ obj-$(CONFIG_CMD_EEPROM) += eeprom.o obj-$(CONFIG_EFI) += efi.o obj-$(CONFIG_CMD_EFIDEBUG) += efidebug.o obj-$(CONFIG_CMD_EFICONFIG) += eficonfig.o +ifdef CONFIG_CMD_EFICONFIG +obj-$(CONFIG_EFI_SECURE_BOOT) += eficonfig_sbkey.o +endif obj-$(CONFIG_CMD_ELF) += elf.o obj-$(CONFIG_CMD_EROFS) += erofs.o obj-$(CONFIG_HUSH_PARSER) += exit.o diff --git a/cmd/eficonfig.c b/cmd/eficonfig.c index e62f5e41a4..e6d2cba9c5 100644 --- a/cmd/eficonfig.c +++ b/cmd/eficonfig.c @@ -1832,6 +1832,9 @@ static const struct eficonfig_item maintenance_menu_items[] = { {"Edit Boot Option", eficonfig_process_edit_boot_option}, {"Change Boot Order", eficonfig_process_change_boot_order}, {"Delete Boot Option", eficonfig_process_delete_boot_option}, +#if (CONFIG_IS_ENABLED(EFI_SECURE_BOOT)) + {"Secure Boot Configuration", eficonfig_process_secure_boot_config}, +#endif {"Quit", eficonfig_process_quit}, }; diff --git a/cmd/eficonfig_sbkey.c b/cmd/eficonfig_sbkey.c new file mode 100644 index 0000000000..a5c0dbe9b3 --- /dev/null +++ b/cmd/eficonfig_sbkey.c @@ -0,0 +1,202 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Menu-driven UEFI Secure Boot key maintenance + * + * Copyright (c) 2022 Masahisa Kojima, Linaro Limited + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static bool is_secureboot_enabled(void) +{ + efi_status_t ret; + u8 secure_boot; + efi_uintn_t size; + + size = sizeof(secure_boot); + ret = efi_get_variable_int(u"SecureBoot", &efi_global_variable_guid, + NULL, &size, &secure_boot, NULL); + + return secure_boot == 1; +} + +static efi_status_t eficonfig_process_enroll_key(void *data) +{ + u32 attr; + char *buf = NULL; + efi_uintn_t size; + efi_status_t ret; + struct efi_file_handle *f; + struct efi_file_handle *root; + struct eficonfig_select_file_info file_info; + + file_info.current_path = calloc(1, EFICONFIG_FILE_PATH_BUF_SIZE); + if (!file_info.current_path) + goto out; + + ret = eficonfig_select_file_handler(&file_info); + if (ret != EFI_SUCCESS) + goto out; + + ret = efi_open_volume_int(file_info.current_volume, &root); + if (ret != EFI_SUCCESS) + goto out; + + ret = efi_file_open_int(root, &f, file_info.current_path, EFI_FILE_MODE_READ, 0); + if (ret != EFI_SUCCESS) + goto out; + + size = 0; + ret = EFI_CALL(f->getinfo(f, &efi_file_info_guid, &size, NULL)); + if (ret != EFI_BUFFER_TOO_SMALL) + goto out; + + buf = calloc(1, size); + if (!buf) { + ret = EFI_OUT_OF_RESOURCES; + goto out; + } + ret = EFI_CALL(f->getinfo(f, &efi_file_info_guid, &size, buf)); + if (ret != EFI_SUCCESS) + goto out; + + size = ((struct efi_file_info *)buf)->file_size; + free(buf); + + buf = calloc(1, size); + if (!buf) + goto out; + + ret = efi_file_read_int(f, &size, buf); + if (ret != EFI_SUCCESS || size == 0) + goto out; + + attr = EFI_VARIABLE_NON_VOLATILE | + EFI_VARIABLE_BOOTSERVICE_ACCESS | + EFI_VARIABLE_RUNTIME_ACCESS | + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS; + /* PK can enroll only one certificate */ + if (u16_strcmp(data, u"PK")) { + efi_uintn_t db_size = 0; + + /* check the variable exists. If exists, add APPEND_WRITE attribute */ + ret = efi_get_variable_int(data, efi_auth_var_get_guid(data), NULL, + &db_size, NULL, NULL); + if (ret == EFI_BUFFER_TOO_SMALL) + attr |= EFI_VARIABLE_APPEND_WRITE; + } + + ret = efi_set_variable_int((u16 *)data, efi_auth_var_get_guid((u16 *)data), + attr, size, buf, false); + if (ret != EFI_SUCCESS) { + eficonfig_print_msg("ERROR! Fail to update signature database"); + goto out; + } + +out: + free(file_info.current_path); + free(buf); + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} + +static struct eficonfig_item key_config_pk_menu_items[] = { + {"Enroll New Key", eficonfig_process_enroll_key}, + {"Quit", eficonfig_process_quit}, +}; + +static struct eficonfig_item key_config_menu_items[] = { + {"Enroll New Key", eficonfig_process_enroll_key}, + {"Quit", eficonfig_process_quit}, +}; + +static efi_status_t eficonfig_process_set_secure_boot_pk(void *data) +{ + u32 i; + efi_status_t ret; + + for (i = 0; i < ARRAY_SIZE(key_config_pk_menu_items); i++) + key_config_pk_menu_items[i].data = data; + + while (1) { + ret = eficonfig_process_common(key_config_pk_menu_items, + ARRAY_SIZE(key_config_pk_menu_items), + " ** Configure PK **"); + if (ret == EFI_ABORTED) + break; + } + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} + +static efi_status_t eficonfig_process_set_secure_boot_key(void *data) +{ + u32 i; + efi_status_t ret; + char header_str[32]; + + for (i = 0; i < ARRAY_SIZE(key_config_menu_items); i++) + key_config_menu_items[i].data = data; + + snprintf(header_str, sizeof(header_str), " ** Configure %ls **", (u16 *)data); + + while (1) { + ret = eficonfig_process_common(key_config_menu_items, + ARRAY_SIZE(key_config_menu_items), + header_str); + if (ret == EFI_ABORTED) + break; + } + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} + +static const struct eficonfig_item secure_boot_menu_items[] = { + {"PK", eficonfig_process_set_secure_boot_pk, u"PK"}, + {"KEK", eficonfig_process_set_secure_boot_key, u"KEK"}, + {"db", eficonfig_process_set_secure_boot_key, u"db"}, + {"dbx", eficonfig_process_set_secure_boot_key, u"dbx"}, + {"Quit", eficonfig_process_quit}, +}; + +efi_status_t eficonfig_process_secure_boot_config(void *data) +{ + efi_status_t ret; + + while (1) { + char header_str[64]; + + snprintf(header_str, sizeof(header_str), + " ** UEFI Secure Boot Key Configuration (SecureBoot : %s) **", + (is_secureboot_enabled() ? "ON" : "OFF")); + ret = eficonfig_process_common(secure_boot_menu_items, + ARRAY_SIZE(secure_boot_menu_items), + header_str); + if (ret == EFI_ABORTED) + break; + } + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} diff --git a/include/efi_config.h b/include/efi_config.h index 1b48e47c48..c6c7a7ae6e 100644 --- a/include/efi_config.h +++ b/include/efi_config.h @@ -87,5 +87,8 @@ efi_status_t eficonfig_process_quit(void *data); efi_status_t eficonfig_process_common(const struct eficonfig_item *items, int count, char *menu_header); efi_status_t eficonfig_select_file_handler(void *data); +#ifdef CONFIG_EFI_SECURE_BOOT +efi_status_t eficonfig_process_secure_boot_config(void *data); +#endif #endif From patchwork Sun Jun 19 05:20:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahisa Kojima X-Patchwork-Id: 583002 Delivered-To: patch@linaro.org Received: by 2002:a05:7000:7814:0:0:0:0 with SMTP id b20csp758029mav; Sat, 18 Jun 2022 22:19:49 -0700 (PDT) X-Google-Smtp-Source: AGRyM1uDvIL5iuMepnt4e0X+i9Xn2wP2phvE2kYBEl6kGzW2TkczNC5guDd26PsA9Fsytyy8aJJW X-Received: by 2002:a17:907:8a20:b0:71e:bc93:4968 with SMTP id sc32-20020a1709078a2000b0071ebc934968mr7415356ejc.573.1655615989204; Sat, 18 Jun 2022 22:19:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1655615989; cv=none; d=google.com; s=arc-20160816; b=CIUg8SFb5wxiudBSgnHpL7MP4oMepeBwHEWYiUrUTp0MYWvyEji0dzR3jXFC52f3oM aKVvzGKfol50Lt706DDkbazCrnG8fzZ/TQJJ+dUTXJRqJz8p1jv7DnouAo8WF/Kup5ak IK3FJe2qg+reoFhVKDYfE/5ZDiuabDD9kNyFN+0H71zMlDKCzuDA5ctARXJCrjl2IQbA 21F4x86PaE4vwEMr/Us/4QBhv6DCrVb8ZJGUBR40BQgDPfJVK/coRgpswimb96lW82zA NlGxJFeVJU4dqXQhTRoGIPZsY2XMqpF8FY+nsq2t1zJx+jKRkAUoAuZovx7wrMO+7vjg pJXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=+XbspnOs8i3+68OKypf3qfPJwXGJSXobwfO9fw8UUf4=; b=S4xS2o4TJyFC9Eq8AClgRKH2Gy8aq34knCQzzyOsmMvp2qWoH7De5E6CC7S1gwHVP7 VZcEmFlkawL19yyWG6gghpNTaCx5/NFfTOBLZqxElB6f5wYqQQLSF/8docjWTK409wyw 6Tu2rUMGN1w+USUhhMQeJ7FXNISGTGoqWOillraKy4BNbIOZARaPm0YEc7K/yOZF7Kls ZxSGV9i6vZJcSWWLEBfqVeZ68d1GSjqMzXMzuMeSvoCtFTsaxU15zW1sC5P4dZEBYa+g f3SsU3Jodm/lscI52w2WzjsKobeQi7JdTc7LjzCg0FARmlzTiCl+Ag98dzvDHRb7b7Gz JiYQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=uMexGUs6; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id g17-20020aa7dc51000000b0043565c9afb3si5096731edu.93.2022.06.18.22.19.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jun 2022 22:19:49 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=uMexGUs6; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id D1B38843F2; Sun, 19 Jun 2022 07:19:40 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="uMexGUs6"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 3A74A843F2; Sun, 19 Jun 2022 07:19:40 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 3AA56843D4 for ; Sun, 19 Jun 2022 07:19:35 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-pj1-x1032.google.com with SMTP id m4so4198954pjv.5 for ; Sat, 18 Jun 2022 22:19:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=+XbspnOs8i3+68OKypf3qfPJwXGJSXobwfO9fw8UUf4=; b=uMexGUs6coj7bllb6fccR39TFDoRtE6zHrbl0i2SFS8hgQUiA0jYPRzFHHsMr5yQzE n1eXCkHEvqfWwbcLk4NR91Iz3xJTUfH9Fqo5c8gNk8foZh4rHSNjWvnb4WewW4ikhmke HpLTgOqNHf5qPYRZUYs5jhENkjnKwPyrWface3IWpG8TYslM54CHHv8y3GhZ90jDCnBJ W8jAK68fwjyF3F/vaNOsJGpO4Zi5ZhgLUELsVutQS0iMUWfJ4/p5pJ5kIHNPYe8QoZ8E +NUOsdDv2C01coU2/vrLi1DNtOc+rIYHfNn8Uk6YORIqzi8uq8MW6aFfjKkDlHY19JZQ Y1zw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=+XbspnOs8i3+68OKypf3qfPJwXGJSXobwfO9fw8UUf4=; b=i4XhU4nt+imirX1mjN3glrnFkgBF6D8C401S8yjVuNepZ8x8j1twstQbs+dyuEn5fm Cx2WSa8y6S2GKQKgX7vKykytLQnBot0Psh3v/TSFhEpglLXtKjPubiD7n8R2y608M3LE pcdD133pnsSpJC0V5mrR0djjMj3YEcTiSPpEu5Do1nUrwSgzcqYGOxnSr2w1qaoZ4DKt DrM0foFqgJZOuT3uC1h0dXmKdhRnGz1GmZgXajY4TUdMZGXxhVKWLbHMn34EvoEyxMkH rvhN+xm1KYo3alSK2HW9PVLmi4geLbLAznsvEPnCadxEyLYlo6sW1BJbSQkCzsjjUBb4 ch6w== X-Gm-Message-State: AJIora+Psl2fmD36FVWiaIWDqTKvxL0wall5eSC48yWixj3H3CqnZHxY 6Ug2ENhtizUBhJYG8Qfd0vwhNUH2TJfrZA== X-Received: by 2002:a17:90b:341:b0:1e0:cf43:df4f with SMTP id fh1-20020a17090b034100b001e0cf43df4fmr19820099pjb.126.1655615973315; Sat, 18 Jun 2022 22:19:33 -0700 (PDT) Received: from localhost.localdomain ([240d:1a:cf7:5800:82fa:5bff:fe4b:26b1]) by smtp.gmail.com with ESMTPSA id j3-20020a170903024300b001636c0b98a7sm6087243plh.226.2022.06.18.22.19.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jun 2022 22:19:33 -0700 (PDT) From: Masahisa Kojima To: u-boot@lists.denx.de Cc: Heinrich Schuchardt , Ilias Apalodimas , Simon Glass , Takahiro Akashi , Francois Ozog , Mark Kettenis , Masahisa Kojima Subject: [RFC PATCH 2/3] eficonfig: add "Show Signature Database" menu entry Date: Sun, 19 Jun 2022 14:20:21 +0900 Message-Id: <20220619052022.2694-3-masahisa.kojima@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220619052022.2694-1-masahisa.kojima@linaro.org> References: <20220619052022.2694-1-masahisa.kojima@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean This commit adds the menu-driven interface to show the signature database. Signed-off-by: Masahisa Kojima --- cmd/eficonfig_sbkey.c | 283 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 283 insertions(+) diff --git a/cmd/eficonfig_sbkey.c b/cmd/eficonfig_sbkey.c index a5c0dbe9b3..02ab8f8218 100644 --- a/cmd/eficonfig_sbkey.c +++ b/cmd/eficonfig_sbkey.c @@ -17,6 +17,64 @@ #include #include +struct eficonfig_sig_data { + struct efi_signature_list *esl; + struct efi_signature_data *esd; + struct list_head list; + struct eficonfig_sig_data **selected; + u16 *varname; +}; + +enum efi_sbkey_signature_type { + SIG_TYPE_X509 = 0, + SIG_TYPE_HASH, + SIG_TYPE_CRL, + SIG_TYPE_RSA2048, +}; + +struct eficonfig_sigtype_to_str { + efi_guid_t sig_type; + char *str; + enum efi_sbkey_signature_type type; +}; + +static const struct eficonfig_sigtype_to_str sigtype_to_str[] = { + {EFI_CERT_X509_GUID, "X509", SIG_TYPE_X509}, + {EFI_CERT_SHA256_GUID, "SHA256", SIG_TYPE_HASH}, + {EFI_CERT_X509_SHA256_GUID, "X509_SHA256 CRL", SIG_TYPE_CRL}, + {EFI_CERT_X509_SHA384_GUID, "X509_SHA384 CRL", SIG_TYPE_CRL}, + {EFI_CERT_X509_SHA512_GUID, "X509_SHA512 CRL", SIG_TYPE_CRL}, + /* U-Boot does not support the following signature types */ +/* {EFI_CERT_RSA2048_GUID, "RSA2048", SIG_TYPE_RSA2048}, */ +/* {EFI_CERT_RSA2048_SHA256_GUID, "RSA2048_SHA256", SIG_TYPE_RSA2048}, */ +/* {EFI_CERT_SHA1_GUID, "SHA1", SIG_TYPE_HASH}, */ +/* {EFI_CERT_RSA2048_SHA_GUID, "RSA2048_SHA", SIG_TYPE_RSA2048 }, */ +/* {EFI_CERT_SHA224_GUID, "SHA224", SIG_TYPE_HASH}, */ +/* {EFI_CERT_SHA384_GUID, "SHA384", SIG_TYPE_HASH}, */ +/* {EFI_CERT_SHA512_GUID, "SHA512", SIG_TYPE_HASH}, */ +}; + +static void eficonfig_console_wait_enter(void) +{ + int esc = 0; + enum bootmenu_key key = KEY_NONE; + + while (1) { + bootmenu_loop(NULL, &key, &esc); + + switch (key) { + case KEY_SELECT: + return; + default: + break; + } + } + + /* never happens */ + debug("eficonfig: this should not happen"); + return; +} + static bool is_secureboot_enabled(void) { efi_status_t ret; @@ -113,13 +171,238 @@ out: return ret; } +static void display_sigdata_info(struct eficonfig_sig_data *sg) +{ + u32 i; + + for (i = 0; i < ARRAY_SIZE(sigtype_to_str); i++) { + if (!guidcmp(&sg->esl->signature_type, &sigtype_to_str[i].sig_type)) { + printf(" Signature Type:\n" + " %s\n", sigtype_to_str[i].str); + + switch (sigtype_to_str[i].type) { + case SIG_TYPE_X509: + { + struct x509_certificate *cert_tmp; + + cert_tmp = x509_cert_parse(sg->esd->signature_data, + sg->esl->signature_size); + printf(" Subject:\n" + " %s\n" + " Issuer:\n" + " %s\n", + cert_tmp->subject, cert_tmp->issuer); + break; + } + case SIG_TYPE_CRL: + { + u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t) - + sizeof(struct efi_time); + struct efi_time *time = + (struct efi_time *)((u8 *)sg->esd->signature_data + + hash_size); + + printf(" ToBeSignedHash:\n"); + print_hex_dump(" ", DUMP_PREFIX_NONE, 16, 1, + sg->esd->signature_data, hash_size, false); + printf(" TimeOfRevocation:\n" + " %d-%d-%d %02d:%02d:%02d\n", + time->year, time->month, time->day, + time->hour, time->minute, time->second); + break; + } + case SIG_TYPE_HASH: + { + u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t); + + printf(" Hash:\n"); + print_hex_dump(" ", DUMP_PREFIX_NONE, 16, 1, + sg->esd->signature_data, hash_size, false); + break; + } + default: + eficonfig_print_msg("ERROR! Unsupported format."); + break; + } + } + } +} + +static void display_sigdata_header(struct eficonfig_sig_data *sg, char *str) +{ + puts(ANSI_CURSOR_HIDE); + puts(ANSI_CLEAR_CONSOLE); + printf(ANSI_CURSOR_POSITION, 1, 1); + + *sg->selected = sg; + printf("\n *** U-Boot Signature Database (%s %ls) ***\n\n" + " Owner GUID:\n" + " %pUL\n", + str, sg->varname, sg->esd->signature_owner.b); +} + +static efi_status_t eficonfig_process_sigdata_show(void *data) +{ + struct eficonfig_sig_data *sg = data; + + display_sigdata_header(sg, "Show"); + display_sigdata_info(sg); + + printf("\n\n Press ENTER to continue"); + eficonfig_console_wait_enter(); + + return EFI_SUCCESS; +} + +static efi_status_t prepare_signature_db_list(struct eficonfig_item **output, void *varname, + void *db, efi_uintn_t db_size, + eficonfig_entry_func func, + struct eficonfig_sig_data **selected, + struct list_head *siglist_list, + u32 *count) +{ + u32 num = 0; + efi_uintn_t size; + struct list_head *pos, *n; + struct efi_signature_list *esl; + struct efi_signature_data *esd; + struct eficonfig_item *menu_item, *iter; + struct eficonfig_sig_data *sg; + + INIT_LIST_HEAD(siglist_list); + esl = db; + size = db_size; + + /* + * parse the signature database and save the pointers to + * efi_signature_list and efi_signature_data. + * We expect the signature list is saved in correct format. + */ + while (size > 0) { + u32 remain; + + esd = (struct efi_signature_data *)((u8 *)esl + + (sizeof(struct efi_signature_list) + + esl->signature_header_size)); + remain = esl->signature_list_size - (sizeof(struct efi_signature_list) + + esl->signature_header_size); + for (; remain > 0; remain -= esl->signature_size) { + sg = calloc(1, sizeof(struct eficonfig_sig_data)); + if (!sg) + return EFI_OUT_OF_RESOURCES; + + sg->esl = esl; + sg->esd = esd; + list_add_tail(&sg->list, siglist_list); + esd = (struct efi_signature_data *)((u8 *)esd + esl->signature_size); + num++; + } + + size -= esl->signature_list_size; + esl = (struct efi_signature_list *)((u8 *)esl + esl->signature_list_size); + } + + menu_item = calloc(num + 1, sizeof(struct eficonfig_item)); + if (!menu_item) + return EFI_OUT_OF_RESOURCES; + + iter = menu_item; + list_for_each_safe(pos, n, siglist_list) { + char buf[40] = {0}; + char *title; + + sg = list_entry(pos, struct eficonfig_sig_data, list); + + snprintf(buf, sizeof(buf), "%pUL", &sg->esd->signature_owner); + title = calloc(1, (strlen(buf) + 1)); + if (!title) + return EFI_OUT_OF_RESOURCES; + + strlcpy(title, buf, strlen(buf) + 1); + iter->title = title; + sg->selected = selected; + sg->varname = varname; + iter->func = func; + iter->data = sg; + iter++; + } + + /* add "Quit" entry */ + iter->title = "Quit"; + iter->func = eficonfig_process_quit; + iter->data = NULL; + num += 1; + + *count = num; + *output = menu_item; + + return EFI_SUCCESS; +} + +static efi_status_t process_show_signature_db(void *varname) +{ + u32 i, count = 0; + efi_status_t ret; + struct eficonfig_item *menu_item = NULL, *iter; + void *db = NULL; + efi_uintn_t db_size; + struct list_head siglist_list; + struct eficonfig_sig_data *selected; + + db = efi_get_var(varname, efi_auth_var_get_guid(varname), &db_size); + if (!db) { + eficonfig_print_msg("There is no entry in the signature database."); + return EFI_NOT_FOUND; + } + + ret = prepare_signature_db_list(&menu_item, varname, db, db_size, + eficonfig_process_sigdata_show, &selected, + &siglist_list, &count); + if (ret != EFI_SUCCESS) + goto out; + + ret = eficonfig_process_common(menu_item, count, " ** Show Signature Database **"); + +out: + if (menu_item) { + iter = menu_item; + for (i = 0; i < count - 1; iter++, i++) { + free(iter->title); + free(iter->data); + } + } + + free(menu_item); + free(db); + + return ret; +} + +static efi_status_t eficonfig_process_show_signature_db(void *data) +{ + efi_status_t ret; + + while (1) { + ret = process_show_signature_db(data); + if (ret != EFI_SUCCESS) + break; + } + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} + static struct eficonfig_item key_config_pk_menu_items[] = { {"Enroll New Key", eficonfig_process_enroll_key}, + {"Show Signature Database", eficonfig_process_show_signature_db}, {"Quit", eficonfig_process_quit}, }; static struct eficonfig_item key_config_menu_items[] = { {"Enroll New Key", eficonfig_process_enroll_key}, + {"Show Signature Database", eficonfig_process_show_signature_db}, {"Quit", eficonfig_process_quit}, }; From patchwork Sun Jun 19 05:20:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahisa Kojima X-Patchwork-Id: 583003 Delivered-To: patch@linaro.org Received: by 2002:a05:7000:7814:0:0:0:0 with SMTP id b20csp758107mav; Sat, 18 Jun 2022 22:19:59 -0700 (PDT) X-Google-Smtp-Source: AGRyM1t4KmRp+ON9WtbXFNLiYgqDPneGD7+UTnwU9avw+VxfwFgiyKVw9Jc4o68hDU1wxycL2Hdo X-Received: by 2002:a05:6402:350b:b0:42f:d079:647f with SMTP id b11-20020a056402350b00b0042fd079647fmr21135223edd.321.1655615998831; Sat, 18 Jun 2022 22:19:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1655615998; cv=none; d=google.com; s=arc-20160816; b=JDRXy+9yHkCIPqu5LNE/i+og1JRyy4yyFaFAjinkCoTje++eRJWb1o6GhvJ+C1XPGT OvXY1rDodw8b6GULiqtsuaaoNHN7AnoMYnDvt2ugP/N69KXkVxchnTFJ6hFY3zPBR44f Exks5+ue8VcmmA95OlaSceN4ev/RxWZx9zrEDlSwDmrtcUGpWAZsFH5joDP8lwwlIstY a9H9AbV5disN3NVAhYDTLk4mBaOfeGJoW01naE7ieou5h/ymi2WkAe5G9YBodbRecTxm 2mwY8BSjZkfme1XFR9mLqOPmsmyWI63w0aTqPLyLlxJchzI8hStqJy+McQHFAnd8RexH OqxA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=Y2mZs8XTetd7WZtB7os+qoxQ28UNXrCUE4UNgct3cM8=; b=sjYIBpYfHHNYB0io7Kyo04X5uFLGNoIxSyZQ+VGKwnaTuL8MSUspy/Clz2AjWCgODt d5W90Eud0o9gOebtBTGkYOM5h0xGvIZp4qVxVD+13yjHssoSv9c3e+xqXt7013YkW+MO leuCsyX1lPEEigx6Yul8JO0lgLav/QXEWBVsT4xalB2cQfpoxf2ZdPb6eUJL5+goGG/A 7gVnMzqGSa8FmUE0Vm3qo+iBgZgHngkYPX4pa3TQ7C8cF9ciLlp7DsCd8Q1j7VxzAUm5 COn/j+KRYfzo3g72p8xbDSz2gcT1HNBut83UDgKpPUCFYDy0WptkJ6vyWx3Xo34auR78 2C8w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="RaoMI/Po"; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id nb19-20020a1709071c9300b006e82f2c77cfsi8132509ejc.199.2022.06.18.22.19.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jun 2022 22:19:58 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="RaoMI/Po"; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id D412D84400; Sun, 19 Jun 2022 07:19:43 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="RaoMI/Po"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id EB7EE843F4; Sun, 19 Jun 2022 07:19:40 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pl1-x634.google.com (mail-pl1-x634.google.com [IPv6:2607:f8b0:4864:20::634]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 3BA2F843D8 for ; Sun, 19 Jun 2022 07:19:38 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-pl1-x634.google.com with SMTP id o18so22287plg.2 for ; Sat, 18 Jun 2022 22:19:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Y2mZs8XTetd7WZtB7os+qoxQ28UNXrCUE4UNgct3cM8=; b=RaoMI/PoXZhXq+ttixCSyg6zMFF2S3uJdAP3c1aAtZryVQ4QzdPW2cALb/t+7XEWeg S1iKDH/zpMg1rJeQw3acRZ+t9fyLjLwbxIoFPTSwL3FCmTKmBRoTKjKBtQGffQBzl2Do +1bucpbzY092Waerst9d1mK7pJid5y4Et3ewAalHh2L7qtfb8mwYZTmJEfJ2AE8rtJ9y hY0Ddtr8m/wXljFC6+kOZV94Xx2ceFpxeVKaGcJabOu573+vty0wu9MxFSnUXchbk6BQ +uQOkMUM4AvoCSziaLiHAEVyR6DGz/IGkR2C0sJwDGMyBHcPTVl/zOyTZHE5nvUAw/yO qskw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Y2mZs8XTetd7WZtB7os+qoxQ28UNXrCUE4UNgct3cM8=; b=pzK2ddgDvXZ9pqLImxA7Bo0WwUyQq5UFXYBFAzhZS5U9jp0pyTRGhnLLqIMtIaX0hN Mg/aHEmMAJ1B8QA7lSK+eFUYI8U6Ixh1a6nlPWelTPddnbdVqsmN4+gHXcvVBuv5jths XvhY5rZjLPWkest+Q2e/Ywb4n0DLoaE8OYEZp1Nr+NJiXdRIlicMqc7KygOnjzjz0zRq t1KWj5h3+EP/Y6Mg9IqqRm9PhDAlsTm+U/Vu0khpWW3jYs77oILAI0zt5+aJkit1Auz/ 9nvTRjonOzO3/tI+9KqaEzYFrWrdrenu35Dh0pIRNjGty9LvMQI8jW008NMRrJgcLFIv jMPg== X-Gm-Message-State: AJIora9N2APndfZ1bqkkFb9TxOm0N9uMItHwpsiRvqlHejY+V4vLsWXr j1//eLQL2/e6R5Y9NvrHWguU72DtUBUqsQ== X-Received: by 2002:a17:902:dac7:b0:166:4ce4:7e32 with SMTP id q7-20020a170902dac700b001664ce47e32mr17606170plx.168.1655615976409; Sat, 18 Jun 2022 22:19:36 -0700 (PDT) Received: from localhost.localdomain ([240d:1a:cf7:5800:82fa:5bff:fe4b:26b1]) by smtp.gmail.com with ESMTPSA id j3-20020a170903024300b001636c0b98a7sm6087243plh.226.2022.06.18.22.19.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jun 2022 22:19:36 -0700 (PDT) From: Masahisa Kojima To: u-boot@lists.denx.de Cc: Heinrich Schuchardt , Ilias Apalodimas , Simon Glass , Takahiro Akashi , Francois Ozog , Mark Kettenis , Masahisa Kojima Subject: [RFC PATCH 3/3] eficonfig: add "Delete Key" menu entry Date: Sun, 19 Jun 2022 14:20:22 +0900 Message-Id: <20220619052022.2694-4-masahisa.kojima@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220619052022.2694-1-masahisa.kojima@linaro.org> References: <20220619052022.2694-1-masahisa.kojima@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean This commit add the menu-driven interface to delete the signature database entry. EFI Signature Lists can contain the multiple signature entries, this menu can delete the indivisual entry. If the PK is enrolled and UEFI Secure Boot is in User Mode, user can not delete the existing signature lists since the signature lists must be signed by KEK or PK but signing information is not stored in the signature database. Signed-off-by: Masahisa Kojima --- cmd/eficonfig_sbkey.c | 218 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 217 insertions(+), 1 deletion(-) diff --git a/cmd/eficonfig_sbkey.c b/cmd/eficonfig_sbkey.c index 02ab8f8218..142bb4cef5 100644 --- a/cmd/eficonfig_sbkey.c +++ b/cmd/eficonfig_sbkey.c @@ -54,6 +54,29 @@ static const struct eficonfig_sigtype_to_str sigtype_to_str[] = { /* {EFI_CERT_SHA512_GUID, "SHA512", SIG_TYPE_HASH}, */ }; +static int eficonfig_console_yes_no(void) +{ + int esc = 0; + enum bootmenu_key key = KEY_NONE; + + while (1) { + bootmenu_loop(NULL, &key, &esc); + + switch (key) { + case KEY_SELECT: + return 1; + case KEY_QUIT: + return 0; + default: + break; + } + } + + /* never happens */ + debug("eficonfig: this should not happen"); + return 0; +} + static void eficonfig_console_wait_enter(void) { int esc = 0; @@ -72,7 +95,19 @@ static void eficonfig_console_wait_enter(void) /* never happens */ debug("eficonfig: this should not happen"); - return; +} + +static bool is_setupmode(void) +{ + efi_status_t ret; + u8 setup_mode; + efi_uintn_t size; + + size = sizeof(setup_mode); + ret = efi_get_variable_int(u"SetupMode", &efi_global_variable_guid, + NULL, &size, &setup_mode, NULL); + + return setup_mode == 1; } static bool is_secureboot_enabled(void) @@ -254,6 +289,103 @@ static efi_status_t eficonfig_process_sigdata_show(void *data) return EFI_SUCCESS; } +static efi_status_t eficonfig_process_sigdata_delete(void *data) +{ + int yes_no; + struct eficonfig_sig_data *sg = data; + + display_sigdata_header(sg, "Delete"); + display_sigdata_info(sg); + + printf("\n\n Press ENTER to delete, ESC/CTRL+C to quit"); + yes_no = eficonfig_console_yes_no(); + if (!yes_no) + return EFI_NOT_READY; + + return EFI_SUCCESS; +} + +static void delete_selected_signature_data(void *db, efi_uintn_t *db_size, + struct eficonfig_sig_data *target, + struct list_head *siglist_list) +{ + u8 *dest, *start; + struct list_head *pos, *n; + u32 remain; + u32 size = *db_size; + u8 *end = (u8 *)db + size; + struct eficonfig_sig_data *sg; + + list_for_each_safe(pos, n, siglist_list) { + sg = list_entry(pos, struct eficonfig_sig_data, list); + if (sg->esl == target->esl && sg->esd == target->esd) { + remain = sg->esl->signature_list_size - + (sizeof(struct efi_signature_list) - + sg->esl->signature_header_size) - + sg->esl->signature_size; + if (remain > 0) { + /* only delete the single signature data */ + sg->esl->signature_list_size -= sg->esl->signature_size; + size -= sg->esl->signature_size; + dest = (u8 *)sg->esd; + start = (u8 *)sg->esd + sg->esl->signature_size; + } else { + /* delete entire signature list */ + dest = (u8 *)sg->esl; + start = (u8 *)sg->esl + sg->esl->signature_list_size; + size -= sg->esl->signature_list_size; + } + memmove(dest, start, (end - start)); + } + } + + *db_size = size; +} + +static efi_status_t create_time_based_payload(void *db, void **new_db, efi_uintn_t *size) +{ + efi_status_t ret; + struct efi_time time; + efi_uintn_t total_size; + struct efi_variable_authentication_2 *auth; + + *new_db = NULL; + + /* + * SetVariable() call with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS + * attribute requires EFI_VARIABLE_AUTHENTICATED_2 descriptor, prepare it + * without certificate data in it. + */ + total_size = sizeof(struct efi_variable_authentication_2) + *size; + + auth = calloc(1, total_size); + if (!auth) + return EFI_OUT_OF_RESOURCES; + + ret = EFI_CALL((*efi_runtime_services.get_time)(&time, NULL)); + if (ret != EFI_SUCCESS) { + free(auth); + return EFI_OUT_OF_RESOURCES; + } + time.pad1 = 0; + time.nanosecond = 0; + time.timezone = 0; + time.daylight = 0; + time.pad2 = 0; + memcpy(&auth->time_stamp, &time, sizeof(time)); + auth->auth_info.hdr.dwLength = sizeof(struct win_certificate_uefi_guid); + auth->auth_info.hdr.wRevision = 0x0200; + auth->auth_info.hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID; + guidcpy(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7); + if (db) + memcpy((u8 *)auth + sizeof(struct efi_variable_authentication_2), db, *size); + + *new_db = auth; + *size = total_size; + + return EFI_SUCCESS; +} + static efi_status_t prepare_signature_db_list(struct eficonfig_item **output, void *varname, void *db, efi_uintn_t db_size, eficonfig_entry_func func, @@ -378,6 +510,68 @@ out: return ret; } +static efi_status_t process_delete_key(void *varname) +{ + u32 attr, i, count = 0; + efi_status_t ret; + struct eficonfig_item *menu_item = NULL, *iter; + void *db = NULL, *new_db = NULL; + efi_uintn_t db_size; + struct list_head siglist_list; + struct eficonfig_sig_data *selected; + + db = efi_get_var(varname, efi_auth_var_get_guid(varname), &db_size); + if (!db) { + eficonfig_print_msg("There is no entry in the signature database."); + return EFI_NOT_FOUND; + } + + ret = prepare_signature_db_list(&menu_item, varname, db, db_size, + eficonfig_process_sigdata_delete, &selected, + &siglist_list, &count); + if (ret != EFI_SUCCESS) + goto out; + + ret = eficonfig_process_common(menu_item, count, " ** Delete Key **"); + + if (ret == EFI_SUCCESS) { + delete_selected_signature_data(db, &db_size, selected, &siglist_list); + + ret = create_time_based_payload(db, &new_db, &db_size); + if (ret != EFI_SUCCESS) + goto out; + + attr = EFI_VARIABLE_NON_VOLATILE | + EFI_VARIABLE_BOOTSERVICE_ACCESS | + EFI_VARIABLE_RUNTIME_ACCESS | + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS; + ret = efi_set_variable_int((u16 *)varname, efi_auth_var_get_guid((u16 *)varname), + attr, db_size, new_db, false); + if (ret != EFI_SUCCESS) { + eficonfig_print_msg("ERROR! Fail to delete signature database"); + goto out; + } + } + +out: + if (menu_item) { + iter = menu_item; + for (i = 0; i < count - 1; iter++, i++) { + free(iter->title); + free(iter->data); + } + } + + free(menu_item); + free(db); + free(new_db); + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} + static efi_status_t eficonfig_process_show_signature_db(void *data) { efi_status_t ret; @@ -394,6 +588,27 @@ static efi_status_t eficonfig_process_show_signature_db(void *data) return ret; } +static efi_status_t eficonfig_process_delete_key(void *data) +{ + efi_status_t ret; + + if (!is_setupmode()) { + eficonfig_print_msg("Not in the SetupMode, can not delete."); + return EFI_SUCCESS; + } + + while (1) { + ret = process_delete_key(data); + if (ret != EFI_SUCCESS) + break; + } + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} + static struct eficonfig_item key_config_pk_menu_items[] = { {"Enroll New Key", eficonfig_process_enroll_key}, {"Show Signature Database", eficonfig_process_show_signature_db}, @@ -403,6 +618,7 @@ static struct eficonfig_item key_config_pk_menu_items[] = { static struct eficonfig_item key_config_menu_items[] = { {"Enroll New Key", eficonfig_process_enroll_key}, {"Show Signature Database", eficonfig_process_show_signature_db}, + {"Delete Key", eficonfig_process_delete_key}, {"Quit", eficonfig_process_quit}, };