proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-08-08 10:20:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Simplify the key management

Browse Source 
Move the key list building and management to mokutil to keep
MokManager as simple as possible.
This commit is contained in:
Gary Ching-Pang Lin 2012-09-19 17:12:30 +08:00
parent 1041805a18
commit c326e2dff4
1 changed files with 46 additions and 294 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

340
MokManager.c
View File

@ -97,7 +97,8 @@ done:
static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) { static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
MokListNode *list; MokListNode *list;
int i, remain = DataSize; INT64 remain = DataSize;
int i;
void *ptr; void *ptr;
list = AllocatePool(sizeof(MokListNode) * num); list = AllocatePool(sizeof(MokListNode) * num);
@ -109,24 +110,23 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
ptr = Data; ptr = Data;
for (i = 0; i < num; i++) { for (i = 0; i < num; i++) {
CopyMem(&list[i].MokSize, ptr, sizeof(UINT32));
remain -= sizeof(UINT32) + list[i].MokSize;
if (remain < 0) { if (remain < 0) {
Print(L"MOK list was corrupted\n"); Print(L"the list was corrupted\n");
FreePool(list); FreePool(list);
return NULL; return NULL;
} }
CopyMem(&list[i].MokSize, ptr, sizeof(UINT32));
ptr += sizeof(UINT32); ptr += sizeof(UINT32);
list[i].Mok = ptr; list[i].Mok = ptr;
ptr += list[i].MokSize; ptr += list[i].MokSize;
remain -= sizeof(UINT32) + list[i].MokSize;
} }
return list; return list;
} }
/* XXX MOK functions */
static void print_x509_name (X509_NAME *X509Name, char *name) static void print_x509_name (X509_NAME *X509Name, char *name)
{ {
char *str; char *str;
@ -285,6 +285,8 @@ static void show_mok_info (void *Mok, UINTN MokSize)
if (!Mok || MokSize == 0) if (!Mok || MokSize == 0)
return; return;
Print(L"size: %d\n", MokSize);
efi_status = get_sha256sum(Mok, MokSize, hash); efi_status = get_sha256sum(Mok, MokSize, hash);
if (efi_status != EFI_SUCCESS) { if (efi_status != EFI_SUCCESS) {
@ -306,220 +308,51 @@ static void show_mok_info (void *Mok, UINTN MokSize)
} }
} }
static UINT8 delete_mok(MokListNode *list, UINT32 MokNum, UINT32 delete) static UINT8 list_keys (void *MokNew, UINTN MokNewSize)
{ {
if (!list || !MokNum || MokNum <= delete)
return 0;
list[delete].Mok = NULL;
list[delete].MokSize = 0;
return 1;
}
static UINT8 mok_deletion_prompt(MokListNode *list, UINT32 MokNum)
{
EFI_INPUT_KEY key;
CHAR16 line[10];
unsigned int word_count = 0;
UINTN delete;
Print(L"delete key: ");
do {
key = get_keystroke();
if ((key.UnicodeChar < '0' ||
key.UnicodeChar > '9' ||
word_count >= 10) &&
key.UnicodeChar != CHAR_BACKSPACE)
continue;
if (word_count == 0 && key.UnicodeChar == CHAR_BACKSPACE)
continue;
Print(L"%c", key.UnicodeChar);
if (key.UnicodeChar == CHAR_BACKSPACE) {
word_count--;
line[word_count] = '\0';
continue;
}
line[word_count] = key.UnicodeChar;
word_count++;
} while (key.UnicodeChar != CHAR_CARRIAGE_RETURN);
Print(L"\n");
if (word_count == 0)
return 0;
line[word_count] = '\0';
delete = Atoi(line)-1;
if (delete >= MokNum) {
Print(L"No such key\n");
return 0;
}
if (!list[delete].Mok) {
Print(L"Already deleted\n");
return 0;
}
Print(L"Delete this key?\n");
show_mok_info(list[delete].Mok, list[delete].MokSize);
Print(L"(y/N) ");
key = get_keystroke();
if (key.UnicodeChar != 'y' && key.UnicodeChar != 'Y') {
Print(L"N\nAbort\n");
return 0;
}
Print(L"y\nDelete key %d\n", delete+1);
return delete_mok(list, MokNum, delete);
}
static void write_mok_list(void *MokListData, UINTN MokListDataSize,
MokListNode *list, UINT32 MokNum)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
UINT32 new_num = 0;
unsigned int i;
UINTN DataSize = 0;
void *Data, *ptr;
if (!MokListData || !list)
return;
for (i = 0; i < MokNum; i++) {
if (list[i].Mok && list[i].MokSize > 0) {
DataSize += list[i].MokSize + sizeof(UINT32);
if (new_num < i) {
list[new_num].Mok = list[i].Mok;
list[new_num].MokSize = list[i].MokSize;
}
new_num++;
}
}
if (new_num == 0) {
Data = NULL;
goto done;
}
DataSize += sizeof(UINT32);
Data = AllocatePool(DataSize * sizeof(UINT8));
ptr = Data;
CopyMem(Data, &new_num, sizeof(new_num));
ptr += sizeof(new_num);
for (i = 0; i < new_num; i++) {
CopyMem(ptr, &list[i].MokSize, sizeof(list[i].MokSize));
ptr += sizeof(list[i].MokSize);
CopyMem(ptr, list[i].Mok, list[i].MokSize);
ptr += list[i].MokSize;
}
done:
efi_status = uefi_call_wrapper(RT->SetVariable, 5, L"MokList",
&shim_lock_guid,
EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS,
DataSize, Data);
if (efi_status != EFI_SUCCESS) {
Print(L"Failed to set variable %d\n", efi_status);
}
if (Data)
FreePool(Data);
}
static void mok_mgmt_shell (void)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
unsigned int i, changed = 0;
void *MokListData = NULL;
UINTN MokListDataSize = 0;
UINT32 MokNum; UINT32 MokNum;
UINT32 attributes; MokListNode *keys = NULL;
MokListNode *list = NULL; int i, ret = 0;
EFI_INPUT_KEY key;
efi_status = get_variable(L"MokList", shim_lock_guid, &attributes, CopyMem(&MokNum, MokNew, sizeof(UINT32));
&MokListDataSize, &MokListData);
if (efi_status != EFI_SUCCESS) {
Print(L"Failed to get MokList\n");
goto error;
}
if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
Print(L"MokList is compromised!\nErase all keys in MokList!\n");
if (delete_variable(L"MokList", shim_lock_guid) != EFI_SUCCESS) {
Print(L"Failed to erase MokList\n");
}
goto error;
}
CopyMem(&MokNum, MokListData, sizeof(UINT32));
if (MokNum == 0) { if (MokNum == 0) {
Print(L"No key enrolled\n"); Print(L"No key exists\n");
goto error;
}
list = build_mok_list(MokNum,
(void *)MokListData + sizeof(UINT32),
MokListDataSize - sizeof(UINT32));
if (!list) {
Print(L"Failed to construct MOK list\n");
goto error; goto error;
} }
do { keys = build_mok_list(MokNum,
Print(L"shim) "); (void *)MokNew + sizeof(UINT32),
key = get_keystroke(); MokNewSize - sizeof(UINT32));
Print(L"%c\n", key.UnicodeChar);
switch (key.UnicodeChar) { if (!keys) {
case 'l': Print(L"Failed to construct key list in MokNew\n");
case 'L': goto error;
for (i = 0; i < MokNum; i++) {
if (list[i].Mok) {
Print(L"Key %d\n", i+1);
show_mok_info(list[i].Mok, list[i].MokSize);
Print(L"\n");
}
}
break;
case 'd':
case 'D':
if (mok_deletion_prompt(list, MokNum) && changed == 0)
changed = 1;
break;
}
} while (key.UnicodeChar != 'c' && key.UnicodeChar != 'C');
if (changed) {
write_mok_list(MokListData, MokListDataSize, list, MokNum);
} }
Print(L"New machine owner key(s):\n\n");
for (i = 0; i < MokNum; i++) {
Print(L"Key %d:\n", i);
show_mok_info(keys[i].Mok, keys[i].MokSize);
Print(L"\n");
}
ret = 1;
error: error:
if (MokListData) if (keys)
FreePool(MokListData); FreePool(keys);
if (list)
FreePool(list); return ret;
} }
static UINT8 mok_enrollment_prompt (void *Mok, UINTN MokSize) static UINT8 mok_enrollment_prompt (void *MokNew, UINTN MokNewSize)
{ {
EFI_INPUT_KEY key; EFI_INPUT_KEY key;
Print(L"New machine owner key:\n\n"); if (!list_keys(MokNew, MokNewSize)) {
show_mok_info(Mok, MokSize); return 0;
Print(L"\nEnroll the key? (y/N): "); }
Print(L"\nEnroll the key(s)? (y/N): ");
key = get_keystroke(); key = get_keystroke();
Print(L"%c\n", key.UnicodeChar); Print(L"%c\n", key.UnicodeChar);
@ -533,59 +366,23 @@ static UINT8 mok_enrollment_prompt (void *Mok, UINTN MokSize)
return 0; return 0;
} }
static EFI_STATUS enroll_mok (void *Mok, UINT32 MokSize, void *OldData, static EFI_STATUS enroll_mok (void *MokNew, UINT32 MokNewSize)
UINT32 OldDataSize, UINT32 MokNum)
{ {
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID; EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status; EFI_STATUS efi_status;
void *Data, *ptr;
UINT32 DataSize = 0;
if (OldData)
DataSize += OldDataSize;
else
DataSize += sizeof(UINT32);
DataSize += sizeof(UINT32);
DataSize += MokSize;
MokNum += 1;
Data = AllocatePool(DataSize);
if (!Data) {
Print(L"Failed to allocate buffer for MOK list\n");
return EFI_OUT_OF_RESOURCES;
}
ptr = Data;
if (OldData) {
CopyMem(ptr, OldData, OldDataSize);
CopyMem(ptr, &MokNum, sizeof(MokNum));
ptr += OldDataSize;
} else {
CopyMem(ptr, &MokNum, sizeof(MokNum));
ptr += sizeof(MokNum);
}
/* Write new MOK */ /* Write new MOK */
CopyMem(ptr, &MokSize, sizeof(MokSize));
ptr += sizeof(MokSize);
CopyMem(ptr, Mok, MokSize);
efi_status = uefi_call_wrapper(RT->SetVariable, 5, L"MokList", efi_status = uefi_call_wrapper(RT->SetVariable, 5, L"MokList",
&shim_lock_guid, &shim_lock_guid,
EFI_VARIABLE_NON_VOLATILE EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS, | EFI_VARIABLE_BOOTSERVICE_ACCESS,
DataSize, Data); MokNewSize, MokNew);
if (efi_status != EFI_SUCCESS) { if (efi_status != EFI_SUCCESS) {
Print(L"Failed to set variable %d\n", efi_status); Print(L"Failed to set variable %d\n", efi_status);
goto error; goto error;
} }
error: error:
if (Data)
FreePool(Data);
return efi_status; return efi_status;
} }
@ -593,83 +390,38 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
{ {
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID; EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status; EFI_STATUS efi_status;
UINTN MokSize = 0, MokListDataSize = 0; UINTN MokNewSize = 0;
void *Mok = NULL, *MokListData = NULL; void *MokNew = NULL;
UINT32 MokNum = 0;
UINT32 attributes; UINT32 attributes;
MokListNode *list = NULL;
UINT8 confirmed; UINT8 confirmed;
efi_status = get_variable(L"MokNew", shim_lock_guid, &attributes, efi_status = get_variable(L"MokNew", shim_lock_guid, &attributes,
&MokSize, &Mok); &MokNewSize, &MokNew);
if (efi_status != EFI_SUCCESS) { if (efi_status != EFI_SUCCESS) {
goto error; goto error;
} }
efi_status = get_variable(L"MokList", shim_lock_guid, &attributes, confirmed = mok_enrollment_prompt(MokNew, MokNewSize);
&MokListDataSize, &MokListData);
if (efi_status == EFI_SUCCESS && MokListData) {
int i;
if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
Print(L"MokList is compromised!\nErase all keys in MokList!\n");
if (delete_variable(L"MokList", shim_lock_guid) != EFI_SUCCESS) {
Print(L"Failed to erase MokList\n");
}
goto error;
}
CopyMem(&MokNum, MokListData, sizeof(UINT32));
list = build_mok_list(MokNum,
(void *)MokListData + sizeof(UINT32),
MokListDataSize - sizeof(UINT32));
if (!list) {
Print(L"Failed to construct MOK list\n");
goto error;
}
/* check if the key is already enrolled */
for (i = 0; i < MokNum; i++) {
if (list[i].MokSize == MokSize &&
CompareMem(list[i].Mok, Mok, MokSize) == 0) {
Print(L"MOK was already enrolled\n");
goto error;
}
}
}
confirmed = mok_enrollment_prompt(Mok, MokSize);
if (!confirmed) if (!confirmed)
goto error; goto error;
efi_status = enroll_mok(Mok, MokSize, MokListData, efi_status = enroll_mok(MokNew, MokNewSize);
MokListDataSize, MokNum);
if (efi_status != EFI_SUCCESS) { if (efi_status != EFI_SUCCESS) {
Print(L"Failed to enroll MOK\n"); Print(L"Failed to enroll MOK\n");
goto error; goto error;
} }
mok_mgmt_shell();
error: error:
if (Mok) { if (MokNew) {
if (delete_variable(L"MokNew", shim_lock_guid) != EFI_SUCCESS) { if (delete_variable(L"MokNew", shim_lock_guid) != EFI_SUCCESS) {
Print(L"Failed to delete MokNew\n"); Print(L"Failed to delete MokNew\n");
} }
FreePool (Mok); FreePool (MokNew);
} }
if (list)
FreePool (list);
if (MokListData)
FreePool (MokListData);
return EFI_SUCCESS; return EFI_SUCCESS;
} }