Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:munix9
grub2
0001-Improve-TPM-key-protection-on-boot-interru...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0001-Improve-TPM-key-protection-on-boot-interruptions.patch of Package grub2
From 27b3e919b9b51a4fedeb3a5aef19c87f0cd7b687 Mon Sep 17 00:00:00 2001 From: Michael Chang <mchang@suse.com> Date: Fri, 17 Nov 2023 12:32:59 +0800 Subject: [PATCH] Improve TPM key protection on boot interruptions The unattended boot process for full disk encryption relies on an authorized TPM policy to ensure the system's integrity before releasing the key to grub. Subsequently, grub assumes responsibility for securing the boot process, directing it towards a trusted default without any expected interruptions. Any interruption during this process indicates potential modification attempts, and releasing the obtained key to the next stage should not occur in such cases. This commit addresses a vulnerability associated with interrupted boot processes that could potentially enable malicious modifications to the default or trusted boot target. To reinforce system security, the code has been updated to incorporate measures that discard the TPM protected key in the event of boot interruptions. Furthermore, this patch aims to enhance code readability by renaming structures and function names related to cryptographic keys, improving clarity and maintainability. By implementing these changes, this enhancement seeks to fortify the protection of TPM keys, thereby ensuring a more robust defense against potential unauthorized modifications during the boot process. Signed-Off-by Michael Chang <mchang@suse.com> --- grub-core/commands/crypttab.c | 38 ++++++++++++++++++++++++++--------- grub-core/disk/cryptodisk.c | 8 +++++++- grub-core/loader/linux.c | 6 +++--- grub-core/normal/main.c | 2 +- grub-core/normal/menu.c | 7 +++++++ grub-core/normal/menu_entry.c | 2 +- include/grub/crypttab.h | 18 ++++++++++------- 7 files changed, 59 insertions(+), 22 deletions(-) diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c index c2217ca98..9397bede9 100644 --- a/grub-core/commands/crypttab.c +++ b/grub-core/commands/crypttab.c @@ -9,17 +9,20 @@ GRUB_MOD_LICENSE ("GPLv3+"); -struct grub_key_publisher *kpuber; +grub_crypto_key_list_t *cryptokey_lst; grub_err_t -grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path) +grub_cryptokey_add_or_update (const char *uuid, const char *key, grub_size_t key_len, const char *path, int is_tpmkey) { - struct grub_key_publisher *cur = NULL; + grub_crypto_key_list_t *cur = NULL; - FOR_LIST_ELEMENTS (cur, kpuber) + FOR_LIST_ELEMENTS (cur, cryptokey_lst) if (grub_uuidcasecmp (cur->name, uuid, sizeof (cur->name)) == 0) break; + if (!cur && !uuid) + return GRUB_ERR_NONE; + if (!cur) cur = grub_zalloc (sizeof (*cur)); if (!cur) @@ -44,21 +47,24 @@ grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, cur->path = grub_strdup (path); } + if (is_tpmkey >= 0) + cur->is_tpmkey = is_tpmkey; + if (!cur->name) { cur->name = grub_strdup (uuid); - grub_list_push (GRUB_AS_LIST_P (&kpuber), GRUB_AS_LIST (cur)); + grub_list_push (GRUB_AS_LIST_P (&cryptokey_lst), GRUB_AS_LIST (cur)); } return GRUB_ERR_NONE; } void -grub_initrd_discard_key (void) +grub_cryptokey_discard (void) { - struct grub_key_publisher *cur, *nxt; + grub_crypto_key_list_t *cur, *nxt; - FOR_LIST_ELEMENTS_SAFE (cur, nxt, kpuber) + FOR_LIST_ELEMENTS_SAFE (cur, nxt, cryptokey_lst) { grub_list_remove (GRUB_AS_LIST (cur)); grub_memset (cur->key, 0, cur->key_len); @@ -69,6 +75,20 @@ grub_initrd_discard_key (void) } } +void +grub_cryptokey_tpmkey_discard (void) +{ + grub_crypto_key_list_t *cur = NULL; + + FOR_LIST_ELEMENTS (cur, cryptokey_lst) + if (cur->is_tpmkey) + break; + + /* Discard all keys if any of them is tpm */ + if (cur) + grub_cryptokey_discard(); +} + static grub_err_t grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), int argc, char **argv) @@ -92,7 +112,7 @@ grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), } /*FIXME: Validate UUID string*/ - return grub_initrd_publish_key (argv[1], NULL, 0, path); + return grub_cryptokey_add_or_update (argv[1], NULL, 0, path, -1); } static grub_command_t cmd; diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c index aa0d43562..babc94868 100644 --- a/grub-core/disk/cryptodisk.c +++ b/grub-core/disk/cryptodisk.c @@ -1071,6 +1071,9 @@ grub_cryptodisk_scan_device_real (const char *name, struct cryptodisk_read_hook_ctx read_hook_data = {0}; int askpass = 0; char *part = NULL; +#ifndef GRUB_UTIL + int is_tpmkey = 0; +#endif dev = grub_cryptodisk_get_by_source_disk (source); @@ -1183,6 +1186,9 @@ grub_cryptodisk_scan_device_real (const char *name, ret = grub_cryptodisk_insert (dev, name, source); if (ret != GRUB_ERR_NONE) goto error; +#ifndef GRUB_UTIL + is_tpmkey = 1; +#endif goto cleanup; } } @@ -1244,7 +1250,7 @@ grub_cryptodisk_scan_device_real (const char *name, #ifndef GRUB_UTIL if (cargs->key_data && dev) - grub_initrd_publish_key (dev->uuid, (const char *)cargs->key_data, cargs->key_len, NULL); + grub_cryptokey_add_or_update (dev->uuid, (const char *)cargs->key_data, cargs->key_len, NULL, is_tpmkey); #endif if (askpass) { diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c index 9ee8f3790..e5e792958 100644 --- a/grub-core/loader/linux.c +++ b/grub-core/loader/linux.c @@ -226,13 +226,13 @@ grub_initrd_init (int argc, char *argv[], int i; int newc = 0; struct dir *root = 0; - struct grub_key_publisher *pk; + grub_crypto_key_list_t *pk; int numkey = 0; initrd_ctx->nfiles = 0; initrd_ctx->components = 0; - FOR_LIST_ELEMENTS (pk, kpuber) + FOR_LIST_ELEMENTS (pk, cryptokey_lst) if (pk->key && pk->path) numkey++; @@ -305,7 +305,7 @@ grub_initrd_init (int argc, char *argv[], goto overflow; } - FOR_LIST_ELEMENTS (pk, kpuber) + FOR_LIST_ELEMENTS (pk, cryptokey_lst) if (pk->key && pk->path) { grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c index a3f711d1d..1b426af69 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c @@ -479,7 +479,7 @@ grub_cmdline_run (int nested, int force_auth) return; } - grub_initrd_discard_key (); + grub_cryptokey_discard (); grub_normal_reader_init (nested); while (1) diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c index 14b0ab1ec..1df2638d7 100644 --- a/grub-core/normal/menu.c +++ b/grub-core/normal/menu.c @@ -32,6 +32,7 @@ #include <grub/script_sh.h> #include <grub/gfxterm.h> #include <grub/dl.h> +#include <grub/crypttab.h> /* Time to delay after displaying an error message about a default/fallback entry failing to boot. */ @@ -708,6 +709,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) if (grub_key_is_interrupt (key)) { timeout = -1; + grub_cryptokey_tpmkey_discard(); break; } @@ -790,6 +792,11 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) clear_timeout (); } + /* Timeout is interrupted by external input, Forget tpmkey if timeout + * is not cut by enter */ + if (c != '\n' && c != '\r') + grub_cryptokey_tpmkey_discard(); + switch (c) { case GRUB_TERM_KEY_HOME: diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c index 384ab9ce3..e5ba91ea4 100644 --- a/grub-core/normal/menu_entry.c +++ b/grub-core/normal/menu_entry.c @@ -1263,7 +1263,7 @@ grub_menu_entry_run (grub_menu_entry_t entry) return; } - grub_initrd_discard_key(); + grub_cryptokey_discard(); screen = make_screen (entry); if (! screen) diff --git a/include/grub/crypttab.h b/include/grub/crypttab.h index 113c53cfc..f86404686 100644 --- a/include/grub/crypttab.h +++ b/include/grub/crypttab.h @@ -4,21 +4,25 @@ #include <grub/types.h> #include <grub/err.h> -struct grub_key_publisher +typedef struct grub_crypto_key_list { - struct grub_key_publisher *next; - struct grub_key_publisher **prev; + struct grub_crypto_key_list *next; + struct grub_crypto_key_list **prev; char *name; /* UUID */ char *path; char *key; grub_size_t key_len; -}; + int is_tpmkey; +} grub_crypto_key_list_t; -extern struct grub_key_publisher *EXPORT_VAR (kpuber); +extern grub_crypto_key_list_t *EXPORT_VAR (cryptokey_lst); grub_err_t -grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path); +grub_cryptokey_add_or_update (const char *uuid, const char *key, grub_size_t key_len, const char *path, int is_tpmkey); void -grub_initrd_discard_key (void); +grub_cryptokey_discard (void); + +void +grub_cryptokey_tpmkey_discard (void); #endif /* ! GRUB_CRYPTTAB_HEADER */ -- 2.35.3
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
