1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/kernel.h> 4 #include <linux/sched.h> 5 #include <linux/cred.h> 6 #include <linux/dmi.h> 7 #include <linux/err.h> 8 #include <linux/efi.h> 9 #include <linux/slab.h> 10 #include <linux/ima.h> 11 #include <keys/asymmetric-type.h> 12 #include <keys/system_keyring.h> 13 #include "../integrity.h" 14 #include "keyring_handler.h" 15 16 /* 17 * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot 18 * certificates causes occurrence of a page fault in Apple's firmware and 19 * a crash disabling EFI runtime services. The following quirk skips reading 20 * these variables. 21 */ 22 static const struct dmi_system_id uefi_skip_cert[] = { 23 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") }, 24 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") }, 25 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") }, 26 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") }, 27 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") }, 28 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") }, 29 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") }, 30 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") }, 31 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") }, 32 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") }, 33 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") }, 34 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") }, 35 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") }, 36 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") }, 37 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") }, 38 { } 39 }; 40 41 /* 42 * Look to see if a UEFI variable called MokIgnoreDB exists and return true if 43 * it does. 44 * 45 * This UEFI variable is set by the shim if a user tells the shim to not use 46 * the certs/hashes in the UEFI db variable for verification purposes. If it 47 * is set, we should ignore the db variable also and the true return indicates 48 * this. 49 */ 50 static __init bool uefi_check_ignore_db(void) 51 { 52 efi_status_t status; 53 unsigned int db = 0; 54 unsigned long size = sizeof(db); 55 efi_guid_t guid = EFI_SHIM_LOCK_GUID; 56 57 status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db); 58 return status == EFI_SUCCESS; 59 } 60 61 /* 62 * Get a certificate list blob from the named EFI variable. 63 */ 64 static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, 65 unsigned long *size, efi_status_t *status) 66 { 67 unsigned long lsize = 4; 68 unsigned long tmpdb[4]; 69 void *db; 70 71 *status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); 72 if (*status == EFI_NOT_FOUND) 73 return NULL; 74 75 if (*status != EFI_BUFFER_TOO_SMALL) { 76 pr_err("Couldn't get size: 0x%lx\n", *status); 77 return NULL; 78 } 79 80 db = kmalloc(lsize, GFP_KERNEL); 81 if (!db) 82 return NULL; 83 84 *status = efi.get_variable(name, guid, NULL, &lsize, db); 85 if (*status != EFI_SUCCESS) { 86 kfree(db); 87 pr_err("Error reading db var: 0x%lx\n", *status); 88 return NULL; 89 } 90 91 *size = lsize; 92 return db; 93 } 94 95 /* 96 * load_moklist_certs() - Load MokList certs 97 * 98 * Load the certs contained in the UEFI MokListRT database into the 99 * platform trusted keyring. 100 * 101 * This routine checks the EFI MOK config table first. If and only if 102 * that fails, this routine uses the MokListRT ordinary UEFI variable. 103 * 104 * Return: Status 105 */ 106 static int __init load_moklist_certs(void) 107 { 108 struct efi_mokvar_table_entry *mokvar_entry; 109 efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; 110 void *mok; 111 unsigned long moksize; 112 efi_status_t status; 113 int rc; 114 115 /* First try to load certs from the EFI MOKvar config table. 116 * It's not an error if the MOKvar config table doesn't exist 117 * or the MokListRT entry is not found in it. 118 */ 119 mokvar_entry = efi_mokvar_entry_find("MokListRT"); 120 if (mokvar_entry) { 121 rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)", 122 mokvar_entry->data, 123 mokvar_entry->data_size, 124 get_handler_for_mok); 125 /* All done if that worked. */ 126 if (!rc) 127 return rc; 128 129 pr_err("Couldn't parse MokListRT signatures from EFI MOKvar config table: %d\n", 130 rc); 131 } 132 133 /* Get MokListRT. It might not exist, so it isn't an error 134 * if we can't get it. 135 */ 136 mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); 137 if (mok) { 138 rc = parse_efi_signature_list("UEFI:MokListRT", 139 mok, moksize, get_handler_for_mok); 140 kfree(mok); 141 if (rc) 142 pr_err("Couldn't parse MokListRT signatures: %d\n", rc); 143 return rc; 144 } 145 if (status == EFI_NOT_FOUND) 146 pr_debug("MokListRT variable wasn't found\n"); 147 else 148 pr_info("Couldn't get UEFI MokListRT\n"); 149 return 0; 150 } 151 152 /* 153 * load_uefi_certs() - Load certs from UEFI sources 154 * 155 * Load the certs contained in the UEFI databases into the platform trusted 156 * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist 157 * keyring. 158 */ 159 static int __init load_uefi_certs(void) 160 { 161 efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; 162 efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; 163 void *db = NULL, *dbx = NULL, *mokx = NULL; 164 unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0; 165 efi_status_t status; 166 int rc = 0; 167 const struct dmi_system_id *dmi_id; 168 169 dmi_id = dmi_first_match(uefi_skip_cert); 170 if (dmi_id) { 171 pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n"); 172 return false; 173 } 174 175 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 176 return false; 177 178 /* Get db and dbx. They might not exist, so it isn't an error 179 * if we can't get them. 180 */ 181 if (!uefi_check_ignore_db()) { 182 db = get_cert_list(L"db", &secure_var, &dbsize, &status); 183 if (!db) { 184 if (status == EFI_NOT_FOUND) 185 pr_debug("MODSIGN: db variable wasn't found\n"); 186 else 187 pr_err("MODSIGN: Couldn't get UEFI db list\n"); 188 } else { 189 rc = parse_efi_signature_list("UEFI:db", 190 db, dbsize, get_handler_for_db); 191 if (rc) 192 pr_err("Couldn't parse db signatures: %d\n", 193 rc); 194 kfree(db); 195 } 196 } 197 198 dbx = get_cert_list(L"dbx", &secure_var, &dbxsize, &status); 199 if (!dbx) { 200 if (status == EFI_NOT_FOUND) 201 pr_debug("dbx variable wasn't found\n"); 202 else 203 pr_info("Couldn't get UEFI dbx list\n"); 204 } else { 205 rc = parse_efi_signature_list("UEFI:dbx", 206 dbx, dbxsize, 207 get_handler_for_dbx); 208 if (rc) 209 pr_err("Couldn't parse dbx signatures: %d\n", rc); 210 kfree(dbx); 211 } 212 213 /* the MOK/MOKx can not be trusted when secure boot is disabled */ 214 if (!arch_ima_get_secureboot()) 215 return 0; 216 217 mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status); 218 if (!mokx) { 219 if (status == EFI_NOT_FOUND) 220 pr_debug("mokx variable wasn't found\n"); 221 else 222 pr_info("Couldn't get mokx list\n"); 223 } else { 224 rc = parse_efi_signature_list("UEFI:MokListXRT", 225 mokx, mokxsize, 226 get_handler_for_dbx); 227 if (rc) 228 pr_err("Couldn't parse mokx signatures %d\n", rc); 229 kfree(mokx); 230 } 231 232 /* Load the MokListRT certs */ 233 rc = load_moklist_certs(); 234 235 return rc; 236 } 237 late_initcall(load_uefi_certs); 238