When secure boot is enabled, only signed EFI binary can access
EFI boot service variable before ExitBootService. Which means that
the EFI boot service variable is secure.
This patch set add functions to EFI boot stub to generate a 512-bit
random number that it can be used as a root key for encryption and
authentication. This root key will be kept in EFI boot service variable.
EFI boot stub will read and transfer ERK (efi root key) to kernel.
At runtime, the ERK can be used to encrypted/authentication other
random number to generate EFI secure key. The EFI secure key can be
a new master key type for encrypted key. It's useful for hibernation
or evm.
Here is the proof of concept for using EFI secure key in hibernation:
https://github.com/joeyli/linux-s4sign/commit/6311e97038974bc5de8121769fb4d34470009566
Cc: Kees Cook <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: "Rafael J. Wysocki" <[email protected]>
Cc: Pavel Machek <[email protected]>
Cc: Chen Yu <[email protected]>
Cc: Oliver Neukum <[email protected]>
Cc: Ryan Chen <[email protected]>
Cc: Ard Biesheuvel <[email protected]>
Cc: David Howells <[email protected]>
Cc: Mimi Zohar <[email protected]>
Signed-off-by: "Lee, Chun-Yi" <[email protected]>
Lee, Chun-Yi (6):
x86/KASLR: make getting random long number function public
efi: the function transfers status to string
efi: generate efi root key in EFI boot stub
key: add EFI secure key type
key: add EFI secure key as a master key type
key: enforce the secure boot checking when loading efi root key
Documentation/admin-guide/kernel-parameters.txt | 6 +
arch/x86/boot/compressed/Makefile | 1 +
arch/x86/boot/compressed/cpuflags.c | 2 +-
arch/x86/boot/compressed/eboot.c | 2 +
arch/x86/boot/compressed/efi_root_key.c | 212 +++++++
arch/x86/boot/compressed/kaslr.c | 21 -
arch/x86/boot/compressed/misc.c | 17 +
arch/x86/boot/compressed/misc.h | 12 +-
arch/x86/include/asm/efi.h | 13 +
arch/x86/include/uapi/asm/bootparam.h | 1 +
arch/x86/kernel/setup.c | 3 +
arch/x86/lib/kaslr.c | 61 +-
arch/x86/lib/random.c | 68 +++
drivers/firmware/efi/Kconfig | 31 +
drivers/firmware/efi/Makefile | 1 +
drivers/firmware/efi/efi-secure-key.c | 748 ++++++++++++++++++++++++
include/keys/efi-type.h | 57 ++
include/linux/efi.h | 40 ++
include/linux/kernel.h | 3 +-
kernel/panic.c | 1 +
security/keys/encrypted-keys/encrypted.c | 10 +
21 files changed, 1226 insertions(+), 84 deletions(-)
create mode 100644 arch/x86/boot/compressed/efi_root_key.c
create mode 100644 arch/x86/lib/random.c
create mode 100644 drivers/firmware/efi/efi-secure-key.c
create mode 100644 include/keys/efi-type.h
--
2.13.6
--
To unsubscribe from this list: send the line "unsubscribe linux-efi" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
