grub-install: Support embedding x509 certificates

To support verification of appended signatures, we need a way to embed the
necessary public keys. Existing appended signature schemes in the Linux kernel
use X.509 certificates, so allow certificates to be embedded in the GRUB core
image in the same way as PGP keys.

Signed-off-by: Alastair D'Silva <alastair@d-silva.org>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/include/grub/kernel.h b/include/grub/kernel.h
index 885289f5d3d7bfbe2c4040ab3c928141fdd4964d..9f3e2031f795939db1abcbb21a0db027bf046fdb 100644 (file)
--- a/include/grub/kernel.h
+++ b/include/grub/kernel.h
@@ -29,6 +29,7 @@ enum
   OBJ_TYPE_CONFIG,
   OBJ_TYPE_PREFIX,
   OBJ_TYPE_GPG_PUBKEY,
+  OBJ_TYPE_X509_PUBKEY,
   OBJ_TYPE_DTB,
   OBJ_TYPE_DISABLE_SHIM_LOCK,
   OBJ_TYPE_DISABLE_CLI

diff --git a/include/grub/util/install.h b/include/grub/util/install.h
index 3aabc4285a3c191e00f16330f5176bc05bff08db..6f27e2e42d5bcd63ed8a96d2a302709532a30b0e 100644 (file)
--- a/include/grub/util/install.h
+++ b/include/grub/util/install.h
@@ -69,6 +69,8 @@
       N_("disable shim_lock verifier"), 0 },                           \
   { "disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0,             \
     N_("disabled command line interface access"), 0 },                 \
+  { "x509key",   'x', N_("FILE"), 0,                                   \
+      N_("embed FILE as an x509 certificate for appended signature checking"), 0}, \
   { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,  \
     "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), 1}, \
   { "verbose", 'v', 0, 0,                                              \
@@ -193,6 +195,7 @@ grub_install_generate_image (const char *dir, const char *prefix,
                             const char *outname, char *mods[],
                             char *memdisk_path, char **pubkey_paths,
                             size_t npubkeys,
+                            char **x509key_paths, size_t nx509keys,
                             char *config_path,
                             const struct grub_install_image_target_desc *image_target,
                             int note, size_t appsig_size,

diff --git a/util/grub-install-common.c b/util/grub-install-common.c
index 102ab18b00ae49c5abba9280e467454c6707ffef..a913ee61c4ceec23c258b974842d28b815aaee33 100644 (file)
--- a/util/grub-install-common.c
+++ b/util/grub-install-common.c
@@ -463,6 +463,8 @@ handle_install_list (struct install_list *il, const char *val,
 
 static char **pubkeys;
 static size_t npubkeys;
+static char **x509keys;
+static size_t nx509keys;
 static char *sbat;
 static int disable_shim_lock;
 static grub_compression_t compression;
@@ -511,6 +513,10 @@ grub_install_parse (int key, char *arg)
     case GRUB_INSTALL_OPTIONS_DISABLE_CLI:
       disable_cli = 1;
       return 1;
+    case 'x':
+      x509keys = xrealloc (x509keys, sizeof (x509keys[0]) * (nx509keys + 1));
+      x509keys[nx509keys++] = xstrdup (arg);
+      return 1;
 
     case GRUB_INSTALL_OPTIONS_VERBOSITY:
       verbosity++;
@@ -642,6 +648,9 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix,
   for (pk = pubkeys; pk < pubkeys + npubkeys; pk++)
     slen += sizeof (" --pubkey ''") + grub_strlen (*pk);
 
+  for (pk = x509keys; pk < x509keys + nx509keys; pk++)
+    slen += sizeof (" --x509key ''") + grub_strlen (*pk);
+
   for (md = modules.entries; *md; md++)
     slen += sizeof (" ''") + grub_strlen (*md);
 
@@ -682,6 +691,14 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix,
       *p++ = '\'';
     }
 
+  for (pk = x509keys; pk < x509keys + nx509keys; pk++)
+    {
+      p = grub_stpcpy (p, "--x509key '");
+      p = grub_stpcpy (p, *pk);
+      *p++ = '\'';
+      *p++ = ' ';
+    }
+
   for (md = modules.entries; *md; md++)
     {
       *p++ = ' ';
@@ -708,7 +725,7 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix,
 
   grub_install_generate_image (dir, prefix, fp, outname,
                               modules.entries, memdisk_path,
-                              pubkeys, npubkeys, config_path, tgt,
+                              pubkeys, npubkeys,  x509keys, nx509keys, config_path, tgt,
                               note, appsig_size, compression, dtb, sbat,
                               disable_shim_lock, disable_cli);
   while (dc--)

diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c
index 9370e609fa8f37249510725fdc71b303768ef586..fb14aa731cdd2101dbcbbb922ffb175e0e96d150 100644 (file)
--- a/util/grub-mkimage.c
+++ b/util/grub-mkimage.c
@@ -76,6 +76,7 @@ static struct argp_option options[] = {
   {"config",   'c', N_("FILE"), 0, N_("embed FILE as an early config"), 0},
    /* TRANSLATORS: "embed" is a verb (command description).  "*/
   {"pubkey",   'k', N_("FILE"), 0, N_("embed FILE as public key for PGP signature checking"), 0},
+  {"x509key",     'x', N_("FILE"), 0, N_("embed FILE as an x509 certificate for appended signature checking"), 0},
   /* TRANSLATORS: NOTE is a name of segment.  */
   {"note",   'n', 0, 0, N_("add NOTE segment for CHRP IEEE1275"), 0},
   {"output",  'o', N_("FILE"), 0, N_("output a generated image to FILE [default=stdout]"), 0},
@@ -125,6 +126,8 @@ struct arguments
   char *dtb;
   char **pubkeys;
   size_t npubkeys;
+  char **x509keys;
+  size_t nx509keys;
   char *font;
   char *config;
   char *sbat;
@@ -209,6 +212,12 @@ argp_parser (int key, char *arg, struct argp_state *state)
       arguments->pubkeys[arguments->npubkeys++] = xstrdup (arg);
       break;
 
+    case 'x':
+      arguments->x509keys = xrealloc (arguments->x509keys,
+                                      sizeof (arguments->x509keys[0]) * (arguments->nx509keys + 1));
+      arguments->x509keys[arguments->nx509keys++] = xstrdup (arg);
+      break;
+
     case 'c':
       if (arguments->config)
        free (arguments->config);
@@ -339,7 +348,8 @@ main (int argc, char *argv[])
   grub_install_generate_image (arguments.dir, arguments.prefix, fp,
                               arguments.output, arguments.modules,
                               arguments.memdisk, arguments.pubkeys,
-                              arguments.npubkeys, arguments.config,
+                              arguments.npubkeys, arguments.x509keys,
+                              arguments.nx509keys, arguments.config,
                               arguments.image_target, arguments.note,
                               arguments.appsig_size,
                               arguments.comp, arguments.dtb,

diff --git a/util/mkimage.c b/util/mkimage.c
index 61c4e78e29b610d8c373e14c0fd751abe57d57b8..f364a5718ecee7bf38797d0ac8366fd9fcbc6b75 100644 (file)
--- a/util/mkimage.c
+++ b/util/mkimage.c
@@ -883,7 +883,7 @@ void
 grub_install_generate_image (const char *dir, const char *prefix,
                             FILE *out, const char *outname, char *mods[],
                             char *memdisk_path, char **pubkey_paths,
-                            size_t npubkeys, char *config_path,
+                            size_t npubkeys, char **x509key_paths, size_t nx509keys, char *config_path,
                             const struct grub_install_image_target_desc *image_target,
                             int note, size_t appsig_size, grub_compression_t comp, const char *dtb_path,
                             const char *sbat_path, int disable_shim_lock,
@@ -929,6 +929,24 @@ grub_install_generate_image (const char *dir, const char *prefix,
       }
   }
 
+  if (nx509keys != 0 && image_target->id != IMAGE_PPC)
+    grub_util_error (_("x509 public key can be support only to appended signature"
+                       " with powerpc-ieee1275 images"));
+
+  {
+    size_t i;
+
+    for (i = 0; i < nx509keys; i++)
+      {
+        size_t curs;
+
+        curs = ALIGN_ADDR (grub_util_get_image_size (x509key_paths[i]));
+        grub_util_info ("the size of x509 public key %u is 0x%" GRUB_HOST_PRIxLONG_LONG,
+                        (unsigned) i, (unsigned long long) curs);
+        total_module_size += curs + sizeof (struct grub_module_header);
+      }
+  }
+
   if (memdisk_path)
     {
       memdisk_size = ALIGN_UP(grub_util_get_image_size (memdisk_path), 512);
@@ -1065,6 +1083,25 @@ grub_install_generate_image (const char *dir, const char *prefix,
       }
   }
 
+  {
+    size_t i;
+
+    for (i = 0; i < nx509keys; i++)
+      {
+        size_t curs;
+        struct grub_module_header *header;
+
+        curs = grub_util_get_image_size (x509key_paths[i]);
+        header = (struct grub_module_header *) (kernel_img + offset);
+        header->type = grub_host_to_target32 (OBJ_TYPE_X509_PUBKEY);
+        header->size = grub_host_to_target32 (curs + sizeof (*header));
+
+        offset += sizeof (*header);
+        grub_util_load_image (x509key_paths[i], kernel_img + offset);
+        offset += ALIGN_ADDR (curs);
+      }
+  }
+
   if (memdisk_path)
     {
       struct grub_module_header *header;