From patchwork Thu May 2 04:04:39 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chun-Yi Lee X-Patchwork-Id: 10925985 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id ADF03933 for ; Thu, 2 May 2019 04:04:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 999BD28A6F for ; Thu, 2 May 2019 04:04:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 88C5628A93; Thu, 2 May 2019 04:04:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1876828A6F for ; Thu, 2 May 2019 04:04:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725536AbfEBEEw (ORCPT ); Thu, 2 May 2019 00:04:52 -0400 Received: from mail-pl1-f193.google.com ([209.85.214.193]:42450 "EHLO mail-pl1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725372AbfEBEEw (ORCPT ); Thu, 2 May 2019 00:04:52 -0400 Received: by mail-pl1-f193.google.com with SMTP id x15so397958pln.9; Wed, 01 May 2019 21:04:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=rM4F3y1QRq9xFsJANLJ2PQUCgusKq4bJmMsIhz12PE0=; b=Ts+TRyYTEECnYuiapH/JiLE3aOdUcKZNWtildqgDgHamRd1VdgzSGCAWO44xInhGdj +mSemGh+TE4HS0enaJJsBrtkBbEcqWjz1lpnryVQHRWMubhUVwQSTmS9EEIDPhXvjgjU 6g+o0scjwM2Wa4GBwJx9KfNyLLX34ZxZRDRKa2cvK6CWUZXFH0y6AEjV9qy3spZmahNA b+SQITUSMYLUc8ch/bNzxbVNjMDumR6A+WyTsRmnX8GEt5nMTj+WfPGejfq+coffthgc ++DUO+WcK0FirgVSRFVswobYbN0c12GGZ64G5JL7y1dbW1ZfpZpkx9vTuLSTED8o15Aa 1gWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=rM4F3y1QRq9xFsJANLJ2PQUCgusKq4bJmMsIhz12PE0=; b=PIQfgCDkuK6JeaM8WapizqgQYIoEHVzR4evwt9U4hEUUPDxqCNDlSguhadEdALMLh1 a2AQEtCa6FgXBLYjkUbo6JtMUoSf+NKSeYyODoeWeZq1F2UL1ChnjgyhTSKrCABE3PiB ahrglisHc/uQp0lJ321PI0qoKfi+ttaSiBSvznCX2PlZJaK3AZrUHbfpRuRpT3my1lg2 IwW1rVUW3gofKfZ9J12BsogSYPK0P6Fk4OioyRRd30B49wpqj4hB+Rhci4mcLqPtangr 6kuXjFbt2wZB0RQYAQ5QASeALElXZpDSBl1wlLR3efH6M5yxoLzjowDufz4iO9QMZjy0 iNzg== X-Gm-Message-State: APjAAAUhdwqVlMuycEHwAssfkVJPYJEbEz22/zHr4S752TayfVZcK/3G QUiBNFaZLmeFJi9PmEhatfc= X-Google-Smtp-Source: APXvYqwIlSDxRSKdkfXgyWtEN1++MlQ6biUp+2bnooCkGaXvtPFj1C9E0K1kp+y/Rsm678WOZw1y7g== X-Received: by 2002:a17:902:b28:: with SMTP id 37mr1260911plq.322.1556769891072; Wed, 01 May 2019 21:04:51 -0700 (PDT) Received: from linux-l9pv.suse ([202.47.205.198]) by smtp.gmail.com with ESMTPSA id k4sm1107687pgh.27.2019.05.01.21.04.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 01 May 2019 21:04:50 -0700 (PDT) From: "Lee, Chun-Yi" X-Google-Original-From: "Lee, Chun-Yi" To: Ard Biesheuvel , James Morris , "Serge E . Hallyn" , David Howells , Josh Boyer , Nayna Jain , Mimi Zohar Cc: linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, "Lee, Chun-Yi" , Kees Cook , Anton Vorontsov , Colin Cross , Tony Luck Subject: [PATCH 1/2 v2] efi: add a function to convert the status value to string Date: Thu, 2 May 2019 12:04:39 +0800 Message-Id: <20190502040441.30372-1-jlee@suse.com> X-Mailer: git-send-email 2.12.3 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This function can be used to convert EFI status value to string for printing out debug message. Using this function can improve the readability of log. v2. - Changed the wording in subject and description. - Moved the marco immediately after the status value definitions. - Turned into a proper function instead of inline. Cc: Ard Biesheuvel Cc: Kees Cook Cc: Anton Vorontsov Cc: Colin Cross Cc: Tony Luck Signed-off-by: "Lee, Chun-Yi" --- include/linux/efi.h | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/include/linux/efi.h b/include/linux/efi.h index 54357a258b35..6f3f89a32eef 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -42,6 +42,34 @@ #define EFI_ABORTED (21 | (1UL << (BITS_PER_LONG-1))) #define EFI_SECURITY_VIOLATION (26 | (1UL << (BITS_PER_LONG-1))) +#define EFI_STATUS_STR(_status) \ +case EFI_##_status: \ + return "EFI_" __stringify(_status); + +static __attribute__((unused)) char * +efi_status_to_str(unsigned long status) +{ + switch (status) { + EFI_STATUS_STR(SUCCESS) + EFI_STATUS_STR(LOAD_ERROR) + EFI_STATUS_STR(INVALID_PARAMETER) + EFI_STATUS_STR(UNSUPPORTED) + EFI_STATUS_STR(BAD_BUFFER_SIZE) + EFI_STATUS_STR(BUFFER_TOO_SMALL) + EFI_STATUS_STR(NOT_READY) + EFI_STATUS_STR(DEVICE_ERROR) + EFI_STATUS_STR(WRITE_PROTECTED) + EFI_STATUS_STR(OUT_OF_RESOURCES) + EFI_STATUS_STR(NOT_FOUND) + EFI_STATUS_STR(ABORTED) + EFI_STATUS_STR(SECURITY_VIOLATION) + default: + pr_warn("Unknown efi status: 0x%lx", status); + } + + return "Unknown efi status"; +} + typedef unsigned long efi_status_t; typedef u8 efi_bool_t; typedef u16 efi_char16_t; /* UNICODE character */ From patchwork Thu May 2 04:04:40 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chun-Yi Lee X-Patchwork-Id: 10925987 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A24A214DB for ; Thu, 2 May 2019 04:05:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8FE2628A6F for ; Thu, 2 May 2019 04:05:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 80E7F28A93; Thu, 2 May 2019 04:05:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3DED628A6F for ; Thu, 2 May 2019 04:05:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726201AbfEBEE4 (ORCPT ); Thu, 2 May 2019 00:04:56 -0400 Received: from mail-pg1-f193.google.com ([209.85.215.193]:46895 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725372AbfEBEEz (ORCPT ); Thu, 2 May 2019 00:04:55 -0400 Received: by mail-pg1-f193.google.com with SMTP id n2so422830pgg.13; Wed, 01 May 2019 21:04:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=jz1PSIAOwqEC7aMJdQtzoyve7waLviSL+4YglVxn7es=; b=K11pW5qiJtxsZ0bF9x/JRCq8UPI9nEoAJGhuM7BK17TmlQ8MXwJlduwGMxy2FtAlPU OjI3+SGNjqd4sm4ytXxEKRaukqPp1QmTqC10DeBvxl2+sGv6GKIEwsuB1gev3F3LQ8Ro p72yPJrpddRbgocW4EIJDC0VfkHxCTwyRnY3c0F0BXE9OK2FECHGnNtRmBGhmFVMkKA5 jhLErVoU5w3CEXIzdDgWyWcPNBS4a3w4E3OD7PIMSrQwJCHGrX68ibaimnX8E1zdDQks IC6Al1qfyCS0HSQv0itwJMIaenTssHmuOY6mQVXBJIODxJ35ChL/IclAMbp+dvUrkGa0 gnGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=jz1PSIAOwqEC7aMJdQtzoyve7waLviSL+4YglVxn7es=; b=qNQWDI5bBy/kGKQhXhn6noGxWQwXMK4s0Bu0II6ZX0QJCUgrNpefDxHdBycZJ1LsCo POZp4uBfvrhPAi0iCurK2FXxSZfI8mCPnH8MqH15Tj6NfIzwMZ4bxKZ0es/dSoKfXjPY tX8WQw7927TquawOVnap/3oBPsinYhgO2sM/McswQOpdKoQpnUH1nOsWsnHGThbtzog3 OWBM72dfXyuDRzBTPokcSJjVlEvBYCOdf+IzteDCx3on/O797VmHjaCAFdbF2S4mnDQu lvBg5pFn0JMLWEUP97SZqUfUubUIM+A6mk+drbhMlGPdLTa6h/jXaCQtQqo2AmITu8gS fP4Q== X-Gm-Message-State: APjAAAUg15GBNYkKLgREph1F8Enjff0PJ/xwDxCoJWt9p5+ZqJVSEZvJ VVd0huqqwM4WE85o4JJQMq8= X-Google-Smtp-Source: APXvYqxeWFXdp9Aaw2xVD6N3+II2bl82wdzZQQIjljIKkZW1twnJvGKHWabJWPcKHP5bXGU8BZVw6w== X-Received: by 2002:a65:6545:: with SMTP id a5mr1661162pgw.264.1556769895131; Wed, 01 May 2019 21:04:55 -0700 (PDT) Received: from linux-l9pv.suse ([202.47.205.198]) by smtp.gmail.com with ESMTPSA id k4sm1107687pgh.27.2019.05.01.21.04.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 01 May 2019 21:04:54 -0700 (PDT) From: "Lee, Chun-Yi" X-Google-Original-From: "Lee, Chun-Yi" To: Ard Biesheuvel , James Morris , "Serge E . Hallyn" , David Howells , Josh Boyer , Nayna Jain , Mimi Zohar Cc: linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, "Lee, Chun-Yi" Subject: [PATCH 2/2 v3] efi: print appropriate status message when loading certificates Date: Thu, 2 May 2019 12:04:40 +0800 Message-Id: <20190502040441.30372-2-jlee@suse.com> X-Mailer: git-send-email 2.12.3 In-Reply-To: <20190502040441.30372-1-jlee@suse.com> References: <20190502040441.30372-1-jlee@suse.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP When loading certificates list from UEFI variable, the original error message direct shows the efi status code from UEFI firmware. It looks ugly: [ 2.335031] Couldn't get size: 0x800000000000000e [ 2.335032] Couldn't get UEFI MokListRT [ 2.339985] Couldn't get size: 0x800000000000000e [ 2.339987] Couldn't get UEFI dbx list So, this patch shows the status string instead of status code. On the other hand, the "Couldn't get UEFI" message doesn't need to be exposed when db/dbx/mok variable do not exist. So, this patch set the message level to debug. v3. - Print messages similar to db/mok when loading dbx hash to blacklist: [ 1.500952] EFI: Blacklisting hash of an executable: UEFI:dbx [ 1.501773] blacklist: Loaded blacklisting hash 'bin:80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0a' - Setting messages for the existence of db/mok/dbx lists to debug level. v2. Setting the MODSIGN messages level to debug. Link: https://forums.opensuse.org/showthread.php/535324-MODSIGN-Couldn-t-get-UEFI-db-list?p=2897516#post2897516 Cc: James Morris Cc: Serge E. Hallyn" Cc: David Howells Cc: Nayna Jain Cc: Josh Boyer Cc: Mimi Zohar Signed-off-by: "Lee, Chun-Yi" --- certs/blacklist.c | 3 +- security/integrity/platform_certs/load_uefi.c | 40 +++++++++++++++++++-------- 2 files changed, 31 insertions(+), 12 deletions(-) diff --git a/certs/blacklist.c b/certs/blacklist.c index 3a507b9e2568..f91437e39e44 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -100,7 +100,8 @@ int mark_hash_blacklisted(const char *hash) if (IS_ERR(key)) { pr_err("Problem blacklisting hash (%ld)\n", PTR_ERR(key)); return PTR_ERR(key); - } + } else + pr_notice("Loaded blacklisting hash '%s'\n", hash); return 0; } diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index 81b19c52832b..6b6996e5bc27 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -1,5 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 +#define pr_fmt(fmt) "EFI: "fmt + #include #include #include @@ -35,6 +37,18 @@ static __init bool uefi_check_ignore_db(void) return status == EFI_SUCCESS; } +static void str16_to_str(efi_char16_t *str16, char *str, int str_size) +{ + int i = 0; + + while (str16[i] != '\0' && i < (str_size - 1)) { + str[i] = str16[i]; + i++; + } + + str[i] = '\0'; +} + /* * Get a certificate list blob from the named EFI variable. */ @@ -44,13 +58,20 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, efi_status_t status; unsigned long lsize = 4; unsigned long tmpdb[4]; + char namestr[16]; void *db; + str16_to_str(name, namestr, ARRAY_SIZE(namestr)); status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); if (status != EFI_BUFFER_TOO_SMALL) { - pr_err("Couldn't get size: 0x%lx\n", status); + if (status == EFI_NOT_FOUND) + pr_debug("UEFI %s list doesn't exist\n", namestr); + else + pr_err("Couldn't get size for UEFI %s list: %s\n", + namestr, efi_status_to_str(status)); return NULL; } + pr_debug("UEFI %s list exists\n", namestr); db = kmalloc(lsize, GFP_KERNEL); if (!db) @@ -59,7 +80,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, status = efi.get_variable(name, guid, NULL, &lsize, db); if (status != EFI_SUCCESS) { kfree(db); - pr_err("Error reading db var: 0x%lx\n", status); + pr_err("Error reading UEFI %s list: %s\n", + namestr, efi_status_to_str(status)); return NULL; } @@ -95,6 +117,7 @@ static __init void uefi_blacklist_hash(const char *source, const void *data, static __init void uefi_blacklist_x509_tbs(const char *source, const void *data, size_t len) { + pr_info("Blacklisting X.509 TBS hash: %s\n", source); uefi_blacklist_hash(source, data, len, "tbs:", 4); } @@ -104,6 +127,7 @@ static __init void uefi_blacklist_x509_tbs(const char *source, static __init void uefi_blacklist_binary(const char *source, const void *data, size_t len) { + pr_info("Blacklisting hash of an executable: %s\n", source); uefi_blacklist_hash(source, data, len, "bin:", 4); } @@ -154,9 +178,7 @@ static int __init load_uefi_certs(void) */ if (!uefi_check_ignore_db()) { db = get_cert_list(L"db", &secure_var, &dbsize); - if (!db) { - pr_err("MODSIGN: Couldn't get UEFI db list\n"); - } else { + if (db) { rc = parse_efi_signature_list("UEFI:db", db, dbsize, get_handler_for_db); if (rc) @@ -167,9 +189,7 @@ static int __init load_uefi_certs(void) } mok = get_cert_list(L"MokListRT", &mok_var, &moksize); - if (!mok) { - pr_info("Couldn't get UEFI MokListRT\n"); - } else { + if (mok) { rc = parse_efi_signature_list("UEFI:MokListRT", mok, moksize, get_handler_for_db); if (rc) @@ -178,9 +198,7 @@ static int __init load_uefi_certs(void) } dbx = get_cert_list(L"dbx", &secure_var, &dbxsize); - if (!dbx) { - pr_info("Couldn't get UEFI dbx list\n"); - } else { + if (dbx) { rc = parse_efi_signature_list("UEFI:dbx", dbx, dbxsize, get_handler_for_dbx);