src/boot/efi/shim.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /*
   3  * This program is free software; you can redistribute it and/or modify it
   4  * under the terms of the GNU Lesser General Public License as published by
   5  * the Free Software Foundation; either version 2.1 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful, but
   9  * WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11  * Lesser General Public License for more details.
  12  *
  13  * Port to systemd-boot
  14  * Copyright © 2017 Max Resch <resch.max@gmail.com>
  15  *
  16  * Security Policy Handling
  17  * Copyright © 2012 <James.Bottomley@HansenPartnership.com>
  18  * https://github.com/mjg59/efitools
  19  */
  20
  21 #include <efi.h>
  22 #include <efilib.h>
  23
  24 #include "util.h"
  25 #include "shim.h"
  26
  27 /* well known shim lock guid */
  28 #define SHIM_LOCK_GUID
  29
  30 struct ShimLock {
  31         EFI_STATUS __attribute__((sysv_abi)) (*shim_verify) (VOID *buffer, UINT32 size);
  32
  33         /* context is actually a struct for the PE header, but it isn't needed so void is sufficient just do define the interface
  34          * see shim.c/shim.h and PeHeader.h in the github shim repo */
  35         EFI_STATUS __attribute__((sysv_abi)) (*generate_hash) (VOID *data, UINT32 datasize, VOID *context, UINT8 *sha256hash, UINT8 *sha1hash);
  36
  37         EFI_STATUS __attribute__((sysv_abi)) (*read_header) (VOID *data, UINT32 datasize, VOID *context);
  38 };
  39
  40 static const EFI_GUID simple_fs_guid = SIMPLE_FILE_SYSTEM_PROTOCOL;
  41 static const EFI_GUID global_guid = EFI_GLOBAL_VARIABLE;
  42
  43 static const EFI_GUID security_protocol_guid = { 0xa46423e3, 0x4617, 0x49f1, {0xb9, 0xff, 0xd1, 0xbf, 0xa9, 0x11, 0x58, 0x39 } };
  44 static const EFI_GUID security2_protocol_guid = { 0x94ab2f58, 0x1438, 0x4ef1, {0x91, 0x52, 0x18, 0x94, 0x1a, 0x3a, 0x0e, 0x68 } };
  45 static const EFI_GUID shim_lock_guid = { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} };
  46
  47 BOOLEAN shim_loaded(void) {
  48         struct ShimLock *shim_lock;
  49
  50         return uefi_call_wrapper(BS->LocateProtocol, 3, (EFI_GUID*) &shim_lock_guid, NULL, (VOID**) &shim_lock) == EFI_SUCCESS;
  51 }
  52
  53 static BOOLEAN shim_validate(VOID *data, UINT32 size) {
  54         struct ShimLock *shim_lock;
  55
  56         if (!data)
  57                 return FALSE;
  58
  59         if (uefi_call_wrapper(BS->LocateProtocol, 3, (EFI_GUID*) &shim_lock_guid, NULL, (VOID**) &shim_lock) != EFI_SUCCESS)
  60                 return FALSE;
  61
  62         if (!shim_lock)
  63                 return FALSE;
  64
  65         return shim_lock->shim_verify(data, size) == EFI_SUCCESS;
  66 }
  67
  68 BOOLEAN secure_boot_enabled(void) {
  69         _cleanup_freepool_ CHAR8 *b = NULL;
  70         UINTN size;
  71
  72         if (efivar_get_raw(&global_guid, L"SecureBoot", &b, &size) == EFI_SUCCESS)
  73                 return *b > 0;
  74
  75         return FALSE;
  76 }
  77
  78 /*
  79  * See the UEFI Platform Initialization manual (Vol2: DXE) for this
  80  */
  81 struct _EFI_SECURITY2_PROTOCOL;
  82 struct _EFI_SECURITY_PROTOCOL;
  83 struct _EFI_DEVICE_PATH_PROTOCOL;
  84
  85 typedef struct _EFI_SECURITY2_PROTOCOL EFI_SECURITY2_PROTOCOL;
  86 typedef struct _EFI_SECURITY_PROTOCOL EFI_SECURITY_PROTOCOL;
  87 typedef struct _EFI_DEVICE_PATH_PROTOCOL EFI_DEVICE_PATH_PROTOCOL;
  88
  89 typedef EFI_STATUS (EFIAPI *EFI_SECURITY_FILE_AUTHENTICATION_STATE) (
  90         const EFI_SECURITY_PROTOCOL *This,
  91         UINT32 AuthenticationStatus,
  92         const EFI_DEVICE_PATH_PROTOCOL *File
  93 );
  94
  95 typedef EFI_STATUS (EFIAPI *EFI_SECURITY2_FILE_AUTHENTICATION) (
  96         const EFI_SECURITY2_PROTOCOL *This,
  97         const EFI_DEVICE_PATH_PROTOCOL *DevicePath,
  98         VOID *FileBuffer,
  99         UINTN FileSize,
 100         BOOLEAN  BootPolicy
 101 );
 102
 103 struct _EFI_SECURITY2_PROTOCOL {
 104         EFI_SECURITY2_FILE_AUTHENTICATION FileAuthentication;
 105 };
 106
 107 struct _EFI_SECURITY_PROTOCOL {
 108         EFI_SECURITY_FILE_AUTHENTICATION_STATE  FileAuthenticationState;
 109 };
 110
 111 /* Handle to the original authenticator for security1 protocol */
 112 static EFI_SECURITY_FILE_AUTHENTICATION_STATE esfas = NULL;
 113
 114 /* Handle to the original authenticator for security2 protocol */
 115 static EFI_SECURITY2_FILE_AUTHENTICATION es2fa = NULL;
 116
 117 /*
 118  * Perform shim/MOK and Secure Boot authentication on a binary that's already been
 119  * loaded into memory. This function does the platform SB authentication first
 120  * but preserves its return value in case of its failure, so that it can be
 121  * returned in case of a shim/MOK authentication failure. This is done because
 122  * the SB failure code seems to vary from one implementation to another, and I
 123  * don't want to interfere with that at this time.
 124  */
 125 static EFIAPI EFI_STATUS security2_policy_authentication (const EFI_SECURITY2_PROTOCOL *this,
 126                                                           const EFI_DEVICE_PATH_PROTOCOL *device_path,
 127                                                           VOID *file_buffer, UINTN file_size, BOOLEAN boot_policy) {
 128         EFI_STATUS status;
 129
 130         /* Chain original security policy */
 131         status = uefi_call_wrapper(es2fa, 5, this, device_path, file_buffer, file_size, boot_policy);
 132
 133         /* if OK, don't bother with MOK check */
 134         if (status == EFI_SUCCESS)
 135                 return status;
 136
 137         if (shim_validate(file_buffer, file_size))
 138                 return EFI_SUCCESS;
 139
 140         return status;
 141 }
 142
 143 /*
 144  * Perform both shim/MOK and platform Secure Boot authentication. This function loads
 145  * the file and performs shim/MOK authentication first simply to avoid double loads
 146  * of Linux kernels, which are much more likely to be shim/MOK-signed than platform-signed,
 147  * since kernels are big and can take several seconds to load on some computers and
 148  * filesystems. This also has the effect of returning whatever the platform code is for
 149  * authentication failure, be it EFI_ACCESS_DENIED, EFI_SECURITY_VIOLATION, or something
 150  * else. (This seems to vary between implementations.)
 151  */
 152 static EFIAPI EFI_STATUS security_policy_authentication (const EFI_SECURITY_PROTOCOL *this, UINT32 authentication_status,
 153                                                          const EFI_DEVICE_PATH_PROTOCOL *device_path_const) {
 154         EFI_STATUS status;
 155         _cleanup_freepool_ EFI_DEVICE_PATH *dev_path = NULL;
 156         _cleanup_freepool_ CHAR16 *dev_path_str = NULL;
 157         EFI_HANDLE h;
 158         EFI_FILE *root;
 159         _cleanup_freepool_ CHAR8 *file_buffer = NULL;
 160         UINTN file_size;
 161
 162         if (!device_path_const)
 163                 return EFI_INVALID_PARAMETER;
 164
 165         dev_path = DuplicateDevicePath((EFI_DEVICE_PATH*) device_path_const);
 166
 167         status = uefi_call_wrapper(BS->LocateDevicePath, 3, (EFI_GUID*) &simple_fs_guid, &dev_path, &h);
 168         if (status != EFI_SUCCESS)
 169                 return status;
 170
 171         /* No need to check return value, this already happend in efi_main() */
 172         root = LibOpenRoot(h);
 173         dev_path_str = DevicePathToStr(dev_path);
 174
 175         status = file_read(root, dev_path_str, 0, 0, &file_buffer, &file_size);
 176         if (EFI_ERROR(status))
 177                 return status;
 178         uefi_call_wrapper(root->Close, 1, root);
 179
 180         if (shim_validate(file_buffer, file_size))
 181                 return EFI_SUCCESS;
 182
 183         /* Try using the platform's native policy.... */
 184         return uefi_call_wrapper(esfas, 3, this, authentication_status, device_path_const);
 185 }
 186
 187 EFI_STATUS security_policy_install(void) {
 188         EFI_SECURITY_PROTOCOL *security_protocol;
 189         EFI_SECURITY2_PROTOCOL *security2_protocol = NULL;
 190         EFI_STATUS status;
 191
 192         /* Already Installed */
 193         if (esfas)
 194                 return EFI_ALREADY_STARTED;
 195
 196         /*
 197          * Don't bother with status here. The call is allowed
 198          * to fail, since SECURITY2 was introduced in PI 1.2.1.
 199          * Use security2_protocol == NULL as indicator.
 200          */
 201         uefi_call_wrapper(BS->LocateProtocol, 3, (EFI_GUID*) &security2_protocol_guid, NULL, (VOID**) &security2_protocol);
 202
 203         status = uefi_call_wrapper(BS->LocateProtocol, 3, (EFI_GUID*) &security_protocol_guid, NULL, (VOID**) &security_protocol);
 204          /* This one is mandatory, so there's a serious problem */
 205         if (status != EFI_SUCCESS)
 206                 return status;
 207
 208         esfas = security_protocol->FileAuthenticationState;
 209         security_protocol->FileAuthenticationState = security_policy_authentication;
 210
 211         if (security2_protocol) {
 212                 es2fa = security2_protocol->FileAuthentication;
 213                 security2_protocol->FileAuthentication = security2_policy_authentication;
 214         }
 215
 216         return EFI_SUCCESS;
 217 }
 218
 219 EFI_STATUS security_policy_uninstall(void) {
 220         EFI_STATUS status;
 221
 222         if (esfas) {
 223                 EFI_SECURITY_PROTOCOL *security_protocol;
 224
 225                 status = uefi_call_wrapper(BS->LocateProtocol, 3, (EFI_GUID*) &security_protocol_guid, NULL, (VOID**) &security_protocol);
 226
 227                 if (status != EFI_SUCCESS)
 228                         return status;
 229
 230                 security_protocol->FileAuthenticationState = esfas;
 231                 esfas = NULL;
 232         } else
 233                 /* nothing installed */
 234                 return EFI_NOT_STARTED;
 235
 236         if (es2fa) {
 237                 EFI_SECURITY2_PROTOCOL *security2_protocol;
 238
 239                 status = uefi_call_wrapper(BS->LocateProtocol, 3, (EFI_GUID*) &security2_protocol_guid, NULL, (VOID**) &security2_protocol);
 240
 241                 if (status != EFI_SUCCESS)
 242                         return status;
 243
 244                 security2_protocol->FileAuthentication = es2fa;
 245                 es2fa = NULL;
 246         }
 247
 248         return EFI_SUCCESS;
 249 }