1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/kernel.h> 4 #include <linux/sched.h> 5 #include <linux/cred.h> 6 #include <linux/err.h> 7 #include <linux/efi.h> 8 #include <linux/slab.h> 9 #include <keys/asymmetric-type.h> 10 #include <keys/system_keyring.h> 11 #include "../integrity.h" 12 #include "keyring_handler.h" 13 14 /* 15 * Look to see if a UEFI variable called MokIgnoreDB exists and return true if 16 * it does. 17 * 18 * This UEFI variable is set by the shim if a user tells the shim to not use 19 * the certs/hashes in the UEFI db variable for verification purposes. If it 20 * is set, we should ignore the db variable also and the true return indicates 21 * this. 22 */ 23 static __init bool uefi_check_ignore_db(void) 24 { 25 efi_status_t status; 26 unsigned int db = 0; 27 unsigned long size = sizeof(db); 28 efi_guid_t guid = EFI_SHIM_LOCK_GUID; 29 30 status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db); 31 return status == EFI_SUCCESS; 32 } 33 34 /* 35 * Get a certificate list blob from the named EFI variable. 36 */ 37 static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, 38 unsigned long *size, efi_status_t *status) 39 { 40 unsigned long lsize = 4; 41 unsigned long tmpdb[4]; 42 void *db; 43 44 *status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); 45 if (*status == EFI_NOT_FOUND) 46 return NULL; 47 48 if (*status != EFI_BUFFER_TOO_SMALL) { 49 pr_err("Couldn't get size: 0x%lx\n", *status); 50 return NULL; 51 } 52 53 db = kmalloc(lsize, GFP_KERNEL); 54 if (!db) 55 return NULL; 56 57 *status = efi.get_variable(name, guid, NULL, &lsize, db); 58 if (*status != EFI_SUCCESS) { 59 kfree(db); 60 pr_err("Error reading db var: 0x%lx\n", *status); 61 return NULL; 62 } 63 64 *size = lsize; 65 return db; 66 } 67 68 /* 69 * Load the certs contained in the UEFI databases into the platform trusted 70 * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist 71 * keyring. 72 */ 73 static int __init load_uefi_certs(void) 74 { 75 efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; 76 efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; 77 void *db = NULL, *dbx = NULL, *mok = NULL; 78 unsigned long dbsize = 0, dbxsize = 0, moksize = 0; 79 efi_status_t status; 80 int rc = 0; 81 82 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 83 return false; 84 85 /* Get db, MokListRT, and dbx. They might not exist, so it isn't 86 * an error if we can't get them. 87 */ 88 if (!uefi_check_ignore_db()) { 89 db = get_cert_list(L"db", &secure_var, &dbsize, &status); 90 if (!db) { 91 if (status == EFI_NOT_FOUND) 92 pr_debug("MODSIGN: db variable wasn't found\n"); 93 else 94 pr_err("MODSIGN: Couldn't get UEFI db list\n"); 95 } else { 96 rc = parse_efi_signature_list("UEFI:db", 97 db, dbsize, get_handler_for_db); 98 if (rc) 99 pr_err("Couldn't parse db signatures: %d\n", 100 rc); 101 kfree(db); 102 } 103 } 104 105 mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); 106 if (!mok) { 107 if (status == EFI_NOT_FOUND) 108 pr_debug("MokListRT variable wasn't found\n"); 109 else 110 pr_info("Couldn't get UEFI MokListRT\n"); 111 } else { 112 rc = parse_efi_signature_list("UEFI:MokListRT", 113 mok, moksize, get_handler_for_db); 114 if (rc) 115 pr_err("Couldn't parse MokListRT signatures: %d\n", rc); 116 kfree(mok); 117 } 118 119 dbx = get_cert_list(L"dbx", &secure_var, &dbxsize, &status); 120 if (!dbx) { 121 if (status == EFI_NOT_FOUND) 122 pr_debug("dbx variable wasn't found\n"); 123 else 124 pr_info("Couldn't get UEFI dbx list\n"); 125 } else { 126 rc = parse_efi_signature_list("UEFI:dbx", 127 dbx, dbxsize, 128 get_handler_for_dbx); 129 if (rc) 130 pr_err("Couldn't parse dbx signatures: %d\n", rc); 131 kfree(dbx); 132 } 133 134 return rc; 135 } 136 late_initcall(load_uefi_certs); 137