rpms/grub2
8
0
Fork 0
mirror of https://src.fedoraproject.org/rpms/grub2.git synced 2024-11-24 06:22:43 +00:00
Code Issues 24 Projects 4 Releases Packages Wiki Activity Actions

Enable tpm module and make system to boot even if TPM measurements fail

Browse source 
Since GRUB 2.04 there is support for TPM measurements in a tpm module that
uses the verifiers framework. So this is used now instead of the previous
downstream patches that we were carrying.

But we forgot to enable this module when rebasing to 2.04 which leads to
GRUB no longer measuring the kernel, initrd and command line parameters.

One side effect of using the verifiers framework is that if measurements
fail, GRUB won't be able to open the files since the errors from the tpm
module are propagated. This means that a firmware with a buggy tpm support
will prevent the machine to boot, which was not the case with the previous
downstream patches. Don't propagate the measurement errors to prevent this.

Resolves: rhbz#1836433

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
This commit is contained in:
Javier Martinez Canillas 2020-05-16 12:02:46 +02:00
parent 4ff1f12e40
commit 4cf8c08cf7
No known key found for this signature in database
GPG key ID: C751E590D63F3D69
5 changed files with 72 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch
View file

@ -1,8 +1,7 @@
From 0cff1b8b056f408c0dd9f8e5f8071ea9f6193c6e Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Thu, 14 May 2020 17:52:53 -0700
Subject: [PATCH 215/215] 10_linux.in: restore existence check in
`get_sorted_bls`
Subject: [PATCH] 10_linux.in: restore existence check in `get_sorted_bls`
This is necessary to handle `/boot/loader/entries` not existing
at all (or possibly existing but being empty - not sure about
@ -18,7 +17,7 @@ Signed-off-by: Adam Williamson <awilliam@redhat.com>
1 file changed, 3 insertions(+)
diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
index 80299ecaf..519e2d9e6 100644
index 80299ecaf00..519e2d9e616 100644
--- a/util/grub.d/10_linux.in
+++ b/util/grub.d/10_linux.in
@@ -141,6 +141,9 @@ get_sorted_bls()
@ -31,6 +30,3 @@ index 80299ecaf..519e2d9e6 100644
bls="${bls%.conf}"
bls="${bls##*/}"
echo "${bls}"
--
2.26.2

62
0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch Normal file
View file

@ -0,0 +1,62 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm@redhat.com>
Date: Sat, 16 May 2020 11:33:18 +0200
Subject: [PATCH] tpm: Don't propagate TPM measurement errors to the verifiers
layer
Currently if the EFI firmware fails to do a TPM measurement for a file,
the error will be propagated to the verifiers framework and so opening
the file will not succeed.
This mean that buggy firmwares will prevent the system to boot since the
loader won't be able to open any file. But failing to do TPM measurements
shouldn't be a fatal error and the system should still be able to boot.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
---
grub-core/commands/tpm.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c
index 1441c494d81..dbaeae46dfa 100644
--- a/grub-core/commands/tpm.c
+++ b/grub-core/commands/tpm.c
@@ -49,7 +49,8 @@ grub_tpm_verify_init (grub_file_t io,
static grub_err_t
grub_tpm_verify_write (void *context, void *buf, grub_size_t size)
{
- return grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context);
+ grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context);
+ return GRUB_ERR_NONE;
}
static grub_err_t
@@ -57,7 +58,6 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type)
{
const char *prefix = NULL;
char *description;
- grub_err_t status;
switch (type)
{
@@ -73,15 +73,15 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type)
}
description = grub_malloc (grub_strlen (str) + grub_strlen (prefix) + 1);
if (!description)
- return grub_errno;
+ return GRUB_ERR_NONE;
grub_memcpy (description, prefix, grub_strlen (prefix));
grub_memcpy (description + grub_strlen (prefix), str,
grub_strlen (str) + 1);
- status =
- grub_tpm_measure ((unsigned char *) str, grub_strlen (str),
- GRUB_STRING_PCR, description);
+
+ grub_tpm_measure ((unsigned char *) str, grub_strlen (str), GRUB_STRING_PCR,
+ description);
grub_free (description);
- return status;
+ return GRUB_ERR_NONE;
}
struct grub_file_verifier grub_tpm_verifier = {

2
grub.macros
View file

@ -402,7 +402,7 @@ GRUB_MODULES=" all_video boot blscfg btrfs \\\
password_pbkdf2 pgp png reboot \\\
regexp search search_fs_uuid search_fs_file \\\
search_label serial sleep syslinuxcfg test tftp \\\
version video xfs zstd " \
tpm version video xfs zstd " \
GRUB_MODULES+=%{efi_modules} \
%{expand:%%{mkimage %{1} %{2} %{3} %{4}}} \
%{nil}

1
grub.patches
View file

@ -213,3 +213,4 @@ Patch0212: 0212-10_linux.in-fix-early-exit-due-error-when-reading-pe.patch
Patch0213: 0213-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch
Patch0214: 0214-10_linux.in-Store-cmdline-in-BLS-snippets-instead-of.patch
Patch0215: 0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch
Patch0216: 0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch

6
grub2.spec
View file

@ -9,7 +9,7 @@
Name: grub2
Epoch: 1
Version: 2.04
Release: 18%{?dist}
Release: 19%{?dist}
Summary: Bootloader with support for Linux, Multiboot and more
License: GPLv3+
URL: http://www.gnu.org/software/grub/
@ -504,6 +504,10 @@ rm -r /boot/grub2.tmp/ || :
%endif
%changelog
* Sat May 16 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.04-19
- Enable tpm module and make system to boot even if TPM measurements fail
Resolves: rhbz#1836433
* Thu May 14 2020 Adam Williamson <awilliam@redhat.com> - 2.04-18
- 10_linux.in: restore existence check in `get_sorted_bls`
Resolves: rhbz#1836020