You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
109 lines
3.4 KiB
109 lines
3.4 KiB
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
|
From: Daniel Axtens <dja@axtens.net> |
|
Date: Mon, 28 Sep 2020 11:11:17 +1000 |
|
Subject: [PATCH] ieee1275: enter lockdown based on /ibm,secure-boot |
|
|
|
If the 'ibm,secure-boot' property of the root node is 2 or greater, |
|
enter lockdown. |
|
|
|
Signed-off-by: Daniel Axtens <dja@axtens.net> |
|
--- |
|
grub-core/Makefile.core.def | 1 + |
|
grub-core/kern/ieee1275/init.c | 27 +++++++++++++++++++++++++++ |
|
include/grub/lockdown.h | 3 ++- |
|
docs/grub.texi | 4 ++-- |
|
4 files changed, 32 insertions(+), 3 deletions(-) |
|
|
|
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def |
|
index 6bddc841b85..3f3459b2c70 100644 |
|
--- a/grub-core/Makefile.core.def |
|
+++ b/grub-core/Makefile.core.def |
|
@@ -323,6 +323,7 @@ kernel = { |
|
powerpc_ieee1275 = kern/powerpc/cache.S; |
|
powerpc_ieee1275 = kern/powerpc/dl.c; |
|
powerpc_ieee1275 = kern/powerpc/compiler-rt.S; |
|
+ powerpc_ieee1275 = kern/lockdown.c; |
|
|
|
sparc64_ieee1275 = kern/sparc64/cache.S; |
|
sparc64_ieee1275 = kern/sparc64/dl.c; |
|
diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c |
|
index 937c1bc44cb..fc7d9712729 100644 |
|
--- a/grub-core/kern/ieee1275/init.c |
|
+++ b/grub-core/kern/ieee1275/init.c |
|
@@ -44,6 +44,7 @@ |
|
#ifdef __sparc__ |
|
#include <grub/machine/kernel.h> |
|
#endif |
|
+#include <grub/lockdown.h> |
|
|
|
/* The minimal heap size we can live with. */ |
|
#define HEAP_MIN_SIZE (unsigned long) (2 * 1024 * 1024) |
|
@@ -271,6 +272,30 @@ grub_parse_cmdline (void) |
|
} |
|
} |
|
|
|
+static void |
|
+grub_get_ieee1275_secure_boot (void) |
|
+{ |
|
+ grub_ieee1275_phandle_t root; |
|
+ int rc; |
|
+ grub_uint32_t is_sb; |
|
+ |
|
+ grub_ieee1275_finddevice ("/", &root); |
|
+ |
|
+ rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", &is_sb, |
|
+ sizeof (is_sb), 0); |
|
+ |
|
+ /* ibm,secure-boot: |
|
+ * 0 - disabled |
|
+ * 1 - audit |
|
+ * 2 - enforce |
|
+ * 3 - enforce + OS-specific behaviour |
|
+ * |
|
+ * We only support enforce. |
|
+ */ |
|
+ if (rc >= 0 && is_sb >= 2) |
|
+ grub_lockdown (); |
|
+} |
|
+ |
|
grub_addr_t grub_modbase; |
|
|
|
void |
|
@@ -296,6 +321,8 @@ grub_machine_init (void) |
|
#else |
|
grub_install_get_time_ms (grub_rtc_get_time_ms); |
|
#endif |
|
+ |
|
+ grub_get_ieee1275_secure_boot (); |
|
} |
|
|
|
void |
|
diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h |
|
index 40531fa823b..ebfee4bf06e 100644 |
|
--- a/include/grub/lockdown.h |
|
+++ b/include/grub/lockdown.h |
|
@@ -24,7 +24,8 @@ |
|
#define GRUB_LOCKDOWN_DISABLED 0 |
|
#define GRUB_LOCKDOWN_ENABLED 1 |
|
|
|
-#ifdef GRUB_MACHINE_EFI |
|
+#if defined(GRUB_MACHINE_EFI) || \ |
|
+ (defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275)) |
|
extern void |
|
EXPORT_FUNC (grub_lockdown) (void); |
|
extern int |
|
diff --git a/docs/grub.texi b/docs/grub.texi |
|
index 4816be85611..a4da9c2a1b9 100644 |
|
--- a/docs/grub.texi |
|
+++ b/docs/grub.texi |
|
@@ -6227,8 +6227,8 @@ Measured boot is currently only supported on EFI platforms. |
|
@section Lockdown when booting on a secure setup |
|
|
|
The GRUB can be locked down when booted on a secure boot environment, for example |
|
-if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will |
|
-be restricted and some operations/commands cannot be executed. |
|
+if UEFI or Power secure boot is enabled. On a locked down configuration, the |
|
+GRUB will be restricted and some operations/commands cannot be executed. |
|
|
|
The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. |
|
Otherwise it does not exit.
|
|
|