xref: /OK3568_Linux_fs/kernel/security/integrity/platform_certs/load_uefi.c (revision 4882a59341e53eb6f0b4789bf948001014eff981)
1 // SPDX-License-Identifier: GPL-2.0
2 
3 #include <linux/kernel.h>
4 #include <linux/sched.h>
5 #include <linux/cred.h>
6 #include <linux/dmi.h>
7 #include <linux/err.h>
8 #include <linux/efi.h>
9 #include <linux/slab.h>
10 #include <keys/asymmetric-type.h>
11 #include <keys/system_keyring.h>
12 #include "../integrity.h"
13 #include "keyring_handler.h"
14 
15 /*
16  * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
17  * certificates causes occurrence of a page fault in Apple's firmware and
18  * a crash disabling EFI runtime services. The following quirk skips reading
19  * these variables.
20  */
21 static const struct dmi_system_id uefi_skip_cert[] = {
22 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
23 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
24 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
25 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
26 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
27 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
28 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
29 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
30 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
31 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
32 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
33 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
34 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
35 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
36 	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
37 	{ }
38 };
39 
40 /*
41  * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
42  * it does.
43  *
44  * This UEFI variable is set by the shim if a user tells the shim to not use
45  * the certs/hashes in the UEFI db variable for verification purposes.  If it
46  * is set, we should ignore the db variable also and the true return indicates
47  * this.
48  */
uefi_check_ignore_db(void)49 static __init bool uefi_check_ignore_db(void)
50 {
51 	efi_status_t status;
52 	unsigned int db = 0;
53 	unsigned long size = sizeof(db);
54 	efi_guid_t guid = EFI_SHIM_LOCK_GUID;
55 
56 	status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db);
57 	return status == EFI_SUCCESS;
58 }
59 
60 /*
61  * Get a certificate list blob from the named EFI variable.
62  */
get_cert_list(efi_char16_t * name,efi_guid_t * guid,unsigned long * size,efi_status_t * status)63 static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
64 				  unsigned long *size, efi_status_t *status)
65 {
66 	unsigned long lsize = 4;
67 	unsigned long tmpdb[4];
68 	void *db;
69 
70 	*status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
71 	if (*status == EFI_NOT_FOUND)
72 		return NULL;
73 
74 	if (*status != EFI_BUFFER_TOO_SMALL) {
75 		pr_err("Couldn't get size: 0x%lx\n", *status);
76 		return NULL;
77 	}
78 
79 	db = kmalloc(lsize, GFP_KERNEL);
80 	if (!db)
81 		return NULL;
82 
83 	*status = efi.get_variable(name, guid, NULL, &lsize, db);
84 	if (*status != EFI_SUCCESS) {
85 		kfree(db);
86 		pr_err("Error reading db var: 0x%lx\n", *status);
87 		return NULL;
88 	}
89 
90 	*size = lsize;
91 	return db;
92 }
93 
94 /*
95  * load_moklist_certs() - Load MokList certs
96  *
97  * Load the certs contained in the UEFI MokListRT database into the
98  * platform trusted keyring.
99  *
100  * This routine checks the EFI MOK config table first. If and only if
101  * that fails, this routine uses the MokListRT ordinary UEFI variable.
102  *
103  * Return:	Status
104  */
load_moklist_certs(void)105 static int __init load_moklist_certs(void)
106 {
107 	struct efi_mokvar_table_entry *mokvar_entry;
108 	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
109 	void *mok;
110 	unsigned long moksize;
111 	efi_status_t status;
112 	int rc;
113 
114 	/* First try to load certs from the EFI MOKvar config table.
115 	 * It's not an error if the MOKvar config table doesn't exist
116 	 * or the MokListRT entry is not found in it.
117 	 */
118 	mokvar_entry = efi_mokvar_entry_find("MokListRT");
119 	if (mokvar_entry) {
120 		rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)",
121 					      mokvar_entry->data,
122 					      mokvar_entry->data_size,
123 					      get_handler_for_db);
124 		/* All done if that worked. */
125 		if (!rc)
126 			return rc;
127 
128 		pr_err("Couldn't parse MokListRT signatures from EFI MOKvar config table: %d\n",
129 		       rc);
130 	}
131 
132 	/* Get MokListRT. It might not exist, so it isn't an error
133 	 * if we can't get it.
134 	 */
135 	mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status);
136 	if (mok) {
137 		rc = parse_efi_signature_list("UEFI:MokListRT",
138 					      mok, moksize, get_handler_for_db);
139 		kfree(mok);
140 		if (rc)
141 			pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
142 		return rc;
143 	}
144 	if (status == EFI_NOT_FOUND)
145 		pr_debug("MokListRT variable wasn't found\n");
146 	else
147 		pr_info("Couldn't get UEFI MokListRT\n");
148 	return 0;
149 }
150 
151 /*
152  * load_uefi_certs() - Load certs from UEFI sources
153  *
154  * Load the certs contained in the UEFI databases into the platform trusted
155  * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist
156  * keyring.
157  */
load_uefi_certs(void)158 static int __init load_uefi_certs(void)
159 {
160 	efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
161 	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
162 	void *db = NULL, *dbx = NULL, *mokx = NULL;
163 	unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
164 	efi_status_t status;
165 	int rc = 0;
166 	const struct dmi_system_id *dmi_id;
167 
168 	dmi_id = dmi_first_match(uefi_skip_cert);
169 	if (dmi_id) {
170 		pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
171 		return false;
172 	}
173 
174 	if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
175 		return false;
176 
177 	/* Get db and dbx.  They might not exist, so it isn't an error
178 	 * if we can't get them.
179 	 */
180 	if (!uefi_check_ignore_db()) {
181 		db = get_cert_list(L"db", &secure_var, &dbsize, &status);
182 		if (!db) {
183 			if (status == EFI_NOT_FOUND)
184 				pr_debug("MODSIGN: db variable wasn't found\n");
185 			else
186 				pr_err("MODSIGN: Couldn't get UEFI db list\n");
187 		} else {
188 			rc = parse_efi_signature_list("UEFI:db",
189 					db, dbsize, get_handler_for_db);
190 			if (rc)
191 				pr_err("Couldn't parse db signatures: %d\n",
192 				       rc);
193 			kfree(db);
194 		}
195 	}
196 
197 	dbx = get_cert_list(L"dbx", &secure_var, &dbxsize, &status);
198 	if (!dbx) {
199 		if (status == EFI_NOT_FOUND)
200 			pr_debug("dbx variable wasn't found\n");
201 		else
202 			pr_info("Couldn't get UEFI dbx list\n");
203 	} else {
204 		rc = parse_efi_signature_list("UEFI:dbx",
205 					      dbx, dbxsize,
206 					      get_handler_for_dbx);
207 		if (rc)
208 			pr_err("Couldn't parse dbx signatures: %d\n", rc);
209 		kfree(dbx);
210 	}
211 
212 	mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);
213 	if (!mokx) {
214 		if (status == EFI_NOT_FOUND)
215 			pr_debug("mokx variable wasn't found\n");
216 		else
217 			pr_info("Couldn't get mokx list\n");
218 	} else {
219 		rc = parse_efi_signature_list("UEFI:MokListXRT",
220 					      mokx, mokxsize,
221 					      get_handler_for_dbx);
222 		if (rc)
223 			pr_err("Couldn't parse mokx signatures %d\n", rc);
224 		kfree(mokx);
225 	}
226 
227 	/* Load the MokListRT certs */
228 	rc = load_moklist_certs();
229 
230 	return rc;
231 }
232 late_initcall(load_uefi_certs);
233