1 // SPDX-License-Identifier: GPL-2.0
3 #include <linux/kernel.h>
4 #include <linux/sched.h>
5 #include <linux/cred.h>
8 #include <linux/slab.h>
9 #include <keys/asymmetric-type.h>
10 #include <keys/system_keyring.h>
11 #include "../integrity.h"
13 static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID;
14 static efi_guid_t efi_cert_x509_sha256_guid __initdata =
15 EFI_CERT_X509_SHA256_GUID;
16 static efi_guid_t efi_cert_sha256_guid __initdata = EFI_CERT_SHA256_GUID;
19 * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
22 * This UEFI variable is set by the shim if a user tells the shim to not use
23 * the certs/hashes in the UEFI db variable for verification purposes. If it
24 * is set, we should ignore the db variable also and the true return indicates
27 static __init bool uefi_check_ignore_db(void)
31 unsigned long size = sizeof(db);
32 efi_guid_t guid = EFI_SHIM_LOCK_GUID;
34 status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db);
35 return status == EFI_SUCCESS;
39 * Get a certificate list blob from the named EFI variable.
41 static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
45 unsigned long lsize = 4;
46 unsigned long tmpdb[4];
49 status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
50 if (status != EFI_BUFFER_TOO_SMALL) {
51 pr_err("Couldn't get size: 0x%lx\n", status);
55 db = kmalloc(lsize, GFP_KERNEL);
59 status = efi.get_variable(name, guid, NULL, &lsize, db);
60 if (status != EFI_SUCCESS) {
62 pr_err("Error reading db var: 0x%lx\n", status);
73 static __init void uefi_blacklist_hash(const char *source, const void *data,
74 size_t len, const char *type,
79 hash = kmalloc(type_len + len * 2 + 1, GFP_KERNEL);
82 p = memcpy(hash, type, type_len);
84 bin2hex(p, data, len);
88 mark_hash_blacklisted(hash);
93 * Blacklist an X509 TBS hash.
95 static __init void uefi_blacklist_x509_tbs(const char *source,
96 const void *data, size_t len)
98 uefi_blacklist_hash(source, data, len, "tbs:", 4);
102 * Blacklist the hash of an executable.
104 static __init void uefi_blacklist_binary(const char *source,
105 const void *data, size_t len)
107 uefi_blacklist_hash(source, data, len, "bin:", 4);
111 * Return the appropriate handler for particular signature list types found in
112 * the UEFI db and MokListRT tables.
114 static __init efi_element_handler_t get_handler_for_db(const efi_guid_t *
117 if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0)
118 return add_to_platform_keyring;
123 * Return the appropriate handler for particular signature list types found in
124 * the UEFI dbx and MokListXRT tables.
126 static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *
129 if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0)
130 return uefi_blacklist_x509_tbs;
131 if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0)
132 return uefi_blacklist_binary;
137 * Load the certs contained in the UEFI databases into the platform trusted
138 * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist
141 static int __init load_uefi_certs(void)
143 efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
144 efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
145 void *db = NULL, *dbx = NULL, *mok = NULL;
146 unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
149 if (!efi.get_variable)
152 /* Get db, MokListRT, and dbx. They might not exist, so it isn't
153 * an error if we can't get them.
155 if (!uefi_check_ignore_db()) {
156 db = get_cert_list(L"db", &secure_var, &dbsize);
158 pr_err("MODSIGN: Couldn't get UEFI db list\n");
160 rc = parse_efi_signature_list("UEFI:db",
161 db, dbsize, get_handler_for_db);
163 pr_err("Couldn't parse db signatures: %d\n",
169 mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
171 pr_info("Couldn't get UEFI MokListRT\n");
173 rc = parse_efi_signature_list("UEFI:MokListRT",
174 mok, moksize, get_handler_for_db);
176 pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
180 dbx = get_cert_list(L"dbx", &secure_var, &dbxsize);
182 pr_info("Couldn't get UEFI dbx list\n");
184 rc = parse_efi_signature_list("UEFI:dbx",
186 get_handler_for_dbx);
188 pr_err("Couldn't parse dbx signatures: %d\n", rc);
194 late_initcall(load_uefi_certs);