From 4cf8c08cf7ea5396039a02b31f5fb1e283369466 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Sat, 16 May 2020 12:02:46 +0200 Subject: [PATCH] Enable tpm module and make system to boot even if TPM measurements fail Since GRUB 2.04 there is support for TPM measurements in a tpm module that uses the verifiers framework. So this is used now instead of the previous downstream patches that we were carrying. But we forgot to enable this module when rebasing to 2.04 which leads to GRUB no longer measuring the kernel, initrd and command line parameters. One side effect of using the verifiers framework is that if measurements fail, GRUB won't be able to open the files since the errors from the tpm module are propagated. This means that a firmware with a buggy tpm support will prevent the machine to boot, which was not the case with the previous downstream patches. Don't propagate the measurement errors to prevent this. Resolves: rhbz#1836433 Signed-off-by: Javier Martinez Canillas --- ...ore-existence-check-in-get_sorted_bl.patch | 10 +-- ...ate-TPM-measurement-errors-to-the-ve.patch | 62 +++++++++++++++++++ grub.macros | 2 +- grub.patches | 1 + grub2.spec | 6 +- 5 files changed, 72 insertions(+), 9 deletions(-) create mode 100644 0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch diff --git a/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch b/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch index 10e823b..4517745 100644 --- a/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch +++ b/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch @@ -1,8 +1,7 @@ -From 0cff1b8b056f408c0dd9f8e5f8071ea9f6193c6e Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 14 May 2020 17:52:53 -0700 -Subject: [PATCH 215/215] 10_linux.in: restore existence check in - `get_sorted_bls` +Subject: [PATCH] 10_linux.in: restore existence check in `get_sorted_bls` This is necessary to handle `/boot/loader/entries` not existing at all (or possibly existing but being empty - not sure about @@ -18,7 +17,7 @@ Signed-off-by: Adam Williamson 1 file changed, 3 insertions(+) diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 80299ecaf..519e2d9e6 100644 +index 80299ecaf00..519e2d9e616 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in @@ -141,6 +141,9 @@ get_sorted_bls() @@ -31,6 +30,3 @@ index 80299ecaf..519e2d9e6 100644 bls="${bls%.conf}" bls="${bls##*/}" echo "${bls}" --- -2.26.2 - diff --git a/0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch b/0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch new file mode 100644 index 0000000..ca125c6 --- /dev/null +++ b/0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch @@ -0,0 +1,62 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Sat, 16 May 2020 11:33:18 +0200 +Subject: [PATCH] tpm: Don't propagate TPM measurement errors to the verifiers + layer + +Currently if the EFI firmware fails to do a TPM measurement for a file, +the error will be propagated to the verifiers framework and so opening +the file will not succeed. + +This mean that buggy firmwares will prevent the system to boot since the +loader won't be able to open any file. But failing to do TPM measurements +shouldn't be a fatal error and the system should still be able to boot. + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/tpm.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c +index 1441c494d81..dbaeae46dfa 100644 +--- a/grub-core/commands/tpm.c ++++ b/grub-core/commands/tpm.c +@@ -49,7 +49,8 @@ grub_tpm_verify_init (grub_file_t io, + static grub_err_t + grub_tpm_verify_write (void *context, void *buf, grub_size_t size) + { +- return grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context); ++ grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context); ++ return GRUB_ERR_NONE; + } + + static grub_err_t +@@ -57,7 +58,6 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type) + { + const char *prefix = NULL; + char *description; +- grub_err_t status; + + switch (type) + { +@@ -73,15 +73,15 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type) + } + description = grub_malloc (grub_strlen (str) + grub_strlen (prefix) + 1); + if (!description) +- return grub_errno; ++ return GRUB_ERR_NONE; + grub_memcpy (description, prefix, grub_strlen (prefix)); + grub_memcpy (description + grub_strlen (prefix), str, + grub_strlen (str) + 1); +- status = +- grub_tpm_measure ((unsigned char *) str, grub_strlen (str), +- GRUB_STRING_PCR, description); ++ ++ grub_tpm_measure ((unsigned char *) str, grub_strlen (str), GRUB_STRING_PCR, ++ description); + grub_free (description); +- return status; ++ return GRUB_ERR_NONE; + } + + struct grub_file_verifier grub_tpm_verifier = { diff --git a/grub.macros b/grub.macros index bb560e5..fc6bfff 100644 --- a/grub.macros +++ b/grub.macros @@ -402,7 +402,7 @@ GRUB_MODULES=" all_video boot blscfg btrfs \\\ password_pbkdf2 pgp png reboot \\\ regexp search search_fs_uuid search_fs_file \\\ search_label serial sleep syslinuxcfg test tftp \\\ - version video xfs zstd " \ + tpm version video xfs zstd " \ GRUB_MODULES+=%{efi_modules} \ %{expand:%%{mkimage %{1} %{2} %{3} %{4}}} \ %{nil} diff --git a/grub.patches b/grub.patches index 717ec73..a833b9e 100644 --- a/grub.patches +++ b/grub.patches @@ -213,3 +213,4 @@ Patch0212: 0212-10_linux.in-fix-early-exit-due-error-when-reading-pe.patch Patch0213: 0213-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch Patch0214: 0214-10_linux.in-Store-cmdline-in-BLS-snippets-instead-of.patch Patch0215: 0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch +Patch0216: 0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch diff --git a/grub2.spec b/grub2.spec index 34c1f1f..591b7d5 100644 --- a/grub2.spec +++ b/grub2.spec @@ -9,7 +9,7 @@ Name: grub2 Epoch: 1 Version: 2.04 -Release: 18%{?dist} +Release: 19%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -504,6 +504,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Sat May 16 2020 Javier Martinez Canillas - 2.04-19 +- Enable tpm module and make system to boot even if TPM measurements fail + Resolves: rhbz#1836433 + * Thu May 14 2020 Adam Williamson - 2.04-18 - 10_linux.in: restore existence check in `get_sorted_bls` Resolves: rhbz#1836020