Don't permit loading modules on UEFI secure boot

Author: Colin Watson <cjwatson@ubuntu.com>
Origin: vendor, http://pkgs.fedoraproject.org/cgit/grub2.git/tree/grub-2.00-no-insmod-on-sb.patch
Forwarded: no
Last-Update: 2013-12-25

Patch-Name: no_insmod_on_sb.patch

Gbp-Pq: Name no_insmod_on_sb.patch

diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
index e394cd96f8c06705efd44ac17f589ffa09329df8..b6535155baca0ebab1a411f2158ef95013f2e188 100644 (file)
--- a/grub-core/kern/dl.c
+++ b/grub-core/kern/dl.c
@@ -38,6 +38,10 @@
 #define GRUB_MODULES_MACHINE_READONLY
 #endif
 
+#ifdef GRUB_MACHINE_EFI
+#include <grub/efi/efi.h>
+#endif
+
 \f
 
 #pragma GCC diagnostic ignored "-Wcast-align"
@@ -686,6 +690,15 @@ grub_dl_load_file (const char *filename)
   void *core = 0;
   grub_dl_t mod = 0;
 
+#ifdef GRUB_MACHINE_EFI
+  if (grub_efi_secure_boot ())
+    {
+      grub_error (GRUB_ERR_ACCESS_DENIED,
+                 "Secure Boot forbids loading module from %s", filename);
+      return 0;
+    }
+#endif
+
   grub_boot_time ("Loading module %s", filename);
 
   file = grub_file_open (filename);

diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
index d467785fc6ce0763ec1392a65d6b30f1747ab5c4..b677bd2806f3997e68f5f285f929fe092f2d5f61 100644 (file)
--- a/grub-core/kern/efi/efi.c
+++ b/grub-core/kern/efi/efi.c
@@ -264,6 +264,34 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
   return NULL;
 }
 
+grub_efi_boolean_t
+grub_efi_secure_boot (void)
+{
+  grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
+  grub_size_t datasize;
+  char *secure_boot = NULL;
+  char *setup_mode = NULL;
+  grub_efi_boolean_t ret = 0;
+
+  secure_boot = grub_efi_get_variable ("SecureBoot", &efi_var_guid, &datasize);
+
+  if (datasize != 1 || !secure_boot)
+    goto out;
+
+  setup_mode = grub_efi_get_variable ("SetupMode", &efi_var_guid, &datasize);
+
+  if (datasize != 1 || !setup_mode)
+    goto out;
+
+  if (*secure_boot && !*setup_mode)
+    ret = 1;
+
+ out:
+  grub_free (secure_boot);
+  grub_free (setup_mode);
+  return ret;
+}
+
 #pragma GCC diagnostic ignored "-Wcast-align"
 
 /* Search the mods section from the PE32/PE32+ image. This code uses

diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
index e9c601f34103ae1a4ced7e93be8204970bfef193..5e87950fd06c1e7461b8b85e10c046a7f89c20ea 100644 (file)
--- a/include/grub/efi/efi.h
+++ b/include/grub/efi/efi.h
@@ -73,6 +73,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
                                     const grub_efi_guid_t *guid,
                                     void *data,
                                     grub_size_t datasize);
+grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);
 int
 EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
                                             const grub_efi_device_path_t *dp2);