Commit ebd9c2ae authored by Eric Snowberg's avatar Eric Snowberg Committed by David Howells
Browse files

integrity: Load mokx variables into the blacklist keyring 



During boot the Secure Boot Forbidden Signature Database, dbx,
is loaded into the blacklist keyring.  Systems booted with shim
have an equivalent Forbidden Signature Database called mokx.
Currently mokx is only used by shim and grub, the contents are
ignored by the kernel.

Add the ability to load mokx into the blacklist keyring during boot.

Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
Suggested-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
cc: keyrings@vger.kernel.org
Link: https://lore.kernel.org/r/c33c8e3839a41e9654f41cc92c7231104931b1d7.camel@HansenPartnership.com/
Link: https://lore.kernel.org/r/20210122181054.32635-5-eric.snowberg@oracle.com/ # v5
Link: https://lore.kernel.org/r/161428674320.677100.12637282414018170743.stgit@warthog.procyon.org.uk/
Link: https://lore.kernel.org/r/161433313205.902181.2502803393898221637.stgit@warthog.procyon.org.uk/ # v2
Link: https://lore.kernel.org/r/161529607422.163428.13530426573612578854.stgit@warthog.procyon.org.uk/ # v3
parent d1f04410

security/integrity/platform_certs/load_uefi.c

+18 −2
Original line number Diff line number Diff line
@@ -132,8 +132,9 @@ static int __init load_moklist_certs(void) 
static int __init load_uefi_certs(void)

{

	efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;

	void *db = NULL, *dbx = NULL;

	unsigned long dbsize = 0, dbxsize = 0;

	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;

	void *db = NULL, *dbx = NULL, *mokx = NULL;

	unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;

	efi_status_t status;

	int rc = 0;
@@ -175,6 +176,21 @@ static int __init load_uefi_certs(void) 
		kfree(dbx);

	}



	mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);

	if (!mokx) {

		if (status == EFI_NOT_FOUND)

			pr_debug("mokx variable wasn't found\n");

		else

			pr_info("Couldn't get mokx list\n");

	} else {

		rc = parse_efi_signature_list("UEFI:MokListXRT",

					      mokx, mokxsize,

					      get_handler_for_dbx);

		if (rc)

			pr_err("Couldn't parse mokx signatures %d\n", rc);

		kfree(mokx);

	}



	/* Load the MokListRT certs */

	rc = load_moklist_certs();