leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

efi_loader: don't load signature database from file

Browse Source 
The UEFI specification requires that the signature database may only be
stored in tamper-resistant storage. So these variable may not be read
from an unsigned file.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
This commit is contained in:
Heinrich Schuchardt 2021-08-25 19:13:24 +02:00 committed by Heinrich Schuchardt
parent f3a343d733
commit 9ef82e2947
4 changed files with 29 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/efi_variable.h
View File

@ -161,10 +161,13 @@ efi_status_t __maybe_unused efi_var_collect(struct efi_var_file **bufp, loff_t *
/**
* efi_var_restore() - restore EFI variables from buffer
*
* Only if @safe is set secure boot related variables will be restored.
*
* @buf: buffer
* @safe: restoring from tamper-resistant storage
* Return: status code
*/
efi_status_t efi_var_restore(struct efi_var_file *buf);
efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe);
/**
* efi_var_from_file() - read variables from file

2
lib/efi_loader/efi_var_common.c
View File

@ -32,10 +32,8 @@ static const struct efi_auth_var_name_type name_type[] = {
{u"KEK", &efi_global_variable_guid, EFI_AUTH_VAR_KEK},
{u"db", &efi_guid_image_security_database, EFI_AUTH_VAR_DB},
{u"dbx", &efi_guid_image_security_database, EFI_AUTH_VAR_DBX},
/* not used yet
{u"dbt", &efi_guid_image_security_database, EFI_AUTH_VAR_DBT},
{u"dbr", &efi_guid_image_security_database, EFI_AUTH_VAR_DBR},
*/
};
static bool efi_secure_boot;

39
lib/efi_loader/efi_var_file.c
View File

@ -148,9 +148,10 @@ error:
#endif
}
efi_status_t efi_var_restore(struct efi_var_file *buf)
efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe)
{
struct efi_var_entry *var, *last_var;
u16 *data;
efi_status_t ret;
if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC ||
@ -160,21 +161,29 @@ efi_status_t efi_var_restore(struct efi_var_file *buf)
return EFI_INVALID_PARAMETER;
}
var = buf->var;
last_var = (struct efi_var_entry *)((u8 *)buf + buf->length);
while (var < last_var) {
u16 *data = var->name + u16_strlen(var->name) + 1;
for (var = buf->var; var < last_var;
var = (struct efi_var_entry *)
ALIGN((uintptr_t)data + var->length, 8)) {
if (var->attr & EFI_VARIABLE_NON_VOLATILE && var->length) {
ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
var->length, data, 0, NULL,
var->time);
if (ret != EFI_SUCCESS)
log_err("Failed to set EFI variable %ls\n",
var->name);
}
var = (struct efi_var_entry *)
ALIGN((uintptr_t)data + var->length, 8);
data = var->name + u16_strlen(var->name) + 1;
/*
* Secure boot related and non-volatile variables shall only be
* restored from U-Boot's preseed.
*/
if (!safe &&
(efi_auth_var_get_type(var->name, &var->guid) !=
EFI_AUTH_VAR_NONE ||
!(var->attr & EFI_VARIABLE_NON_VOLATILE)))
continue;
if (!var->length)
continue;
ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
var->length, data, 0, NULL,
var->time);
if (ret != EFI_SUCCESS)
log_err("Failed to set EFI variable %ls\n", var->name);
}
return EFI_SUCCESS;
}
@ -213,7 +222,7 @@ efi_status_t efi_var_from_file(void)
log_err("Failed to load EFI variables\n");
goto error;
}
if (buf->length != len || efi_var_restore(buf) != EFI_SUCCESS)
if (buf->length != len || efi_var_restore(buf, false) != EFI_SUCCESS)
log_err("Invalid EFI variables file\n");
error:
free(buf);

2
lib/efi_loader/efi_variable.c
View File

@ -426,7 +426,7 @@ efi_status_t efi_init_variables(void)
if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
ret = efi_var_restore((struct efi_var_file *)
__efi_var_file_begin);
__efi_var_file_begin, true);
if (ret != EFI_SUCCESS)
log_err("Invalid EFI variable seed\n");
}