From 7a65d7b558974c89f19afaf0d78b54dc0327f56c Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Wed, 15 Aug 2012 09:53:05 -0400 Subject: [PATCH] Don't permit insmod on secure boot --- grub-core/kern/corecmd.c | 9 +++++++++ grub-core/kern/efi/efi.c | 28 ++++++++++++++++++++++++++++ include/grub/efi/efi.h | 1 + 3 files changed, 38 insertions(+) diff --git a/grub-core/kern/corecmd.c b/grub-core/kern/corecmd.c index eec575c..3df9dbd 100644 --- a/grub-core/kern/corecmd.c +++ b/grub-core/kern/corecmd.c @@ -28,6 +28,10 @@ #include #include +#ifdef GRUB_MACHINE_EFI +#include +#endif + /* set ENVVAR=VALUE */ static grub_err_t grub_core_cmd_set (struct grub_command *cmd __attribute__ ((unused)), @@ -81,6 +85,11 @@ grub_core_cmd_insmod (struct grub_command *cmd __attribute__ ((unused)), { grub_dl_t mod; +#ifdef GRUB_MACHINE_EFI + if (grub_efi_secure_boot()) + return grub_error (GRUB_ERR_ACCESS_DENIED, N_("Secure Boot forbids insmod")); +#endif + if (argc == 0) return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected")); diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c index 820968f..ad7aa8d 100644 --- a/grub-core/kern/efi/efi.c +++ b/grub-core/kern/efi/efi.c @@ -259,6 +259,34 @@ grub_efi_set_variable(const char *var, const grub_efi_guid_t *guid, return grub_error (GRUB_ERR_IO, "could not set EFI variable `%s'", var); } +grub_efi_boolean_t +grub_efi_secure_boot (void) +{ + grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID; + grub_size_t datasize; + char *secure_boot = NULL; + char *setup_mode = NULL; + grub_efi_boolean_t ret = 0; + + secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize); + + if (datasize != 1 || !secure_boot) + goto out; + + setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize); + + if (datasize != 1 || !setup_mode) + goto out; + + if (*secure_boot && !*setup_mode) + ret = 1; + + out: + grub_free (secure_boot); + grub_free (setup_mode); + return ret; +} + #pragma GCC diagnostic ignored "-Wcast-align" /* Search the mods section from the PE32/PE32+ image. This code uses diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h index 9370fd5..a000c38 100644 --- a/include/grub/efi/efi.h +++ b/include/grub/efi/efi.h @@ -72,6 +72,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var, const grub_efi_guid_t *guid, void *data, grub_size_t datasize); +grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void); int EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1, const grub_efi_device_path_t *dp2); -- 1.7.11.2