[U-Boot] [PATCH 00/16] efi_loader: add secure boot support
AKASHI Takahiro
takahiro.akashi at linaro.org
Fri Nov 15 02:19:02 UTC 2019
Heinrich,
This patch set won't be applied cleanly to v2020.01-rc2 due to
bef18454044e ("freescale/powerpc: Rename the config CONFIG_SECURE_BOOT name")
5536c3c9d0d1 ("freescale/layerscape: Rename the config CONFIG_SECURE_BOOT
name")
Do you want to see another re-spin version right now?
The necessary changes are
* remove my patch#3
* modify my patch#4 by removing "depends on SECURE_BOOT" from
CONFIG_EFI_SECURE_BOOT
Since I haven't seen any comments on my v1, I'm rather reluctant
to post another version so quickly.
-Takahiro Akashi
On Wed, Nov 13, 2019 at 09:52:50AM +0900, AKASHI Takahiro wrote:
> One of major missing features in current UEFI implementation is "secure boot."
> The ultimate goal of my attempt is to implement image authentication based
> on signature and provide UEFI secure boot support which would be fully
> compliant with UEFI specification, section 32[1].
> (The code was originally developed by Patrick Wildt.)
>
> While this patch/RFC is still rough-edged, the aim here is to get early
> feedbacks from the community as the patch is quite huge (in total) and also
> as it's a security enhancement.
>
> Please note, however, this patch doesn't work on its own; there are
> a couple of functional dependencies[2] and [3], that I have submitted
> before. For complete workable patch set, see my repository[4],
> which also contains exeperimental timestamp-based revocation suuport.
>
> My "non-volatile" support[5], which is under discussion, is not mandatory
> and so not included here, but this inevitably implies that, for example,
> signature database variables, like db and dbx, won't be persistent unless you
> explicitly run "env save" command and that UEFI variables are not separated
> from U-Boot environment. Anyhow, Linaro is also working on implementing
> real "secure storage" solution based on TF-A and OP-TEE.
>
>
> Supported features:
> * image authentication based on db and dbx
> * supported signature types are
> EFI_CERT_SHA256_GUID (SHA256 digest for unsigned images)
> EFI_CERT_X509_GUID (x509 certificate for signed images)
> * SecureBoot/SignatureSupport variables
> * SetupMode and user mode
> * variable authentication based on PK and KEK
> EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
> * basic pytest test cases
>
> Unsupported features: (marked as TODO in most cases in the source code,
> and won't be included in this series)
> * hash algorithms other than SHA256
> * dbt: timestamp(RFC6131)-based certificate revocation
> * dbr: OS recovery
> * xxxDefault: default values for signature stores
> * transition to AuditMode and DeployedMode
> * recording rejected images in EFI_IMAGE_EXECUTION_INFO_TABLE
> * verification "policy", in particular, check against signature's owner
> * private authenticated variables
> * variable authentication with EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS
> * real secure storage support, including hardware-specific PK (Platform Key)
> installation
>
> TODO's other than "Unsupported features": (won't be included in this series)
> * struct efi_image_regions cannot have arbitrary number of regions
> * fail recovery, in particular, in modifying authenticated variables
> * support read-only attributes of well-defined global variables
> in particular, "SignatureSupport"
> * Extensive test suite (or more test cases) to confirm compatibility
> with EDK2
> => I requested EDK SCT community to add tests[6].
>
> Known issues:
> * remove generic CONFIG_SECURE_BOOT option (on NXP/Freescale platforms)
> (I'm looking forward to fixes from NXP guys.)
> * efitools is used in pytest, and its version must be v1.5.2 or later.
> (Solution: You can define EFITOOLS_PATH in defs.py for your own efitools.)
> * Pytest depends on standalone "helloworld" app for sandbox
> (Solution: You can define HELLO_PATH in defs.py or Heinrich's [7].)
>
> Test:
> * my pytest, included in this patch set, passed.
> * efi_selftest passed. (At least no reguression.)
> * Travis CI passed. (But pytest itself was skipped.)
>
>
> Hints about how to use:
> (Please see other documents, or my pytest scripts, for details.)
> * You can create your own certificates with openssl.
> * You can sign your application with sbsign (on Ubuntu).
> * You can create raw data for signature database with efitools, and
> install/manage authenticated variables with "env -set -e" command
> or efitools' "UpdateVars.efi" application.
>
>
> [1] https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf
> [2] https://lists.denx.de/pipermail/u-boot/2019-November/390127.html
> (import x509/pkcs7 parsers from linux)
> [3] https://lists.denx.de/pipermail/u-boot/2019-November/390150.html
> (extend rsa_verify() for UEFI secure boot)
> [4] http://git.linaro.org/people/takahiro.akashi/u-boot.git/ efi/secboot
> [5] https://lists.denx.de/pipermail/u-boot/2019-September/382835.html
> (non-volatile variables support)
> [6] https://bugzilla.tianocore.org/show_bug.cgi?id=2230
> [7] https://lists.denx.de/pipermail/u-boot/2019-November/389593.html
>
>
> Changes in v1 (Nov 13, 2019)
> * rebased to v2020.01-rc
> * remove already-merged patches
> * re-work the patch set for easier reviews, including
> - move a config definition patch forward (patch#4)
> - refactor/rename verification functions (patch#5/#10)
> - split signature database parser as a separate patch (patch#6)
> - split secure state transition code as a separate patch (patch#8)
> - move most part of init_secure_boot() into init_variables() (patch#8)
> - split test environment setup from test patches (patch#14)
> * add function descriptions (patch#5-#11)
> * make sure the section list is sorted in ascending order in hash
> calculation of PE image (patch#10)
> * add a new "-at" (authenticated access) option to "env -e" (patch#13)
> * list required host packages, in particular udisks2, in pytest
> (patch#14)
> * modify conftest.py to run under python3 (patch#14)
> * use a partition on a disk instead of a whole disk without partition
> table (patch#14)
> * reduce depencendy on efitools, yet relying on its host tools (patch#14)
> * modify pytests to catch up wth latest changes of "env -e" syntax
> (patch#15,#16)
>
> RFC (Sept 18, 2019)
>
> AKASHI Takahiro (16):
> include: pe.h: add signature-related definitions
> include: image.h: export hash algorithm helper functions
> secure boot: rename CONFIG_SECURE_BOOT config option
> efi_loader: add CONFIG_EFI_SECURE_BOOT config option
> efi_loader: add signature verification functions
> efi_loader: add signature database parser
> efi_loader: variable: support variable authentication
> efi_loader: variable: add secure boot state transition
> efi_loader: variable: add VendorKeys variable
> efi_loader: image_loader: support image authentication
> efi_loader: set up secure boot
> cmd: env: use appropriate guid for authenticated UEFI variable
> cmd: env: add "-at" option to "env set -e" command
> efi_loader, pytest: set up secure boot environment
> efi_loader, pytest: add UEFI secure boot tests (authenticated
> variables)
> efi_loader, pytest: add UEFI secure boot tests (image)
>
> .travis.yml | 4 +
> Kconfig | 7 +
> arch/arm/cpu/armv7/ls102xa/Kconfig | 3 +-
> arch/arm/cpu/armv8/fsl-layerscape/Kconfig | 3 +-
> arch/powerpc/cpu/mpc85xx/Kconfig | 3 +-
> cmd/nvedit.c | 5 +-
> cmd/nvedit_efi.c | 23 +-
> include/efi_api.h | 47 +
> include/efi_loader.h | 59 +-
> include/image.h | 10 +-
> include/pe.h | 16 +
> lib/efi_loader/Kconfig | 13 +
> lib/efi_loader/Makefile | 1 +
> lib/efi_loader/efi_boottime.c | 2 +-
> lib/efi_loader/efi_image_loader.c | 443 +++++++-
> lib/efi_loader/efi_setup.c | 38 +
> lib/efi_loader/efi_signature.c | 827 +++++++++++++++
> lib/efi_loader/efi_variable.c | 950 ++++++++++++++++--
> test/py/README.md | 4 +
> test/py/tests/test_efi_secboot/conftest.py | 128 +++
> test/py/tests/test_efi_secboot/defs.py | 21 +
> .../py/tests/test_efi_secboot/test_authvar.py | 289 ++++++
> test/py/tests/test_efi_secboot/test_signed.py | 97 ++
> .../tests/test_efi_secboot/test_unsigned.py | 100 ++
> 24 files changed, 2958 insertions(+), 135 deletions(-)
> create mode 100644 lib/efi_loader/efi_signature.c
> create mode 100644 test/py/tests/test_efi_secboot/conftest.py
> create mode 100644 test/py/tests/test_efi_secboot/defs.py
> create mode 100644 test/py/tests/test_efi_secboot/test_authvar.py
> create mode 100644 test/py/tests/test_efi_secboot/test_signed.py
> create mode 100644 test/py/tests/test_efi_secboot/test_unsigned.py
>
> --
> 2.21.0
>
More information about the U-Boot
mailing list