integrity: Load mokx variables into the blacklist keyring

During boot the Secure Boot Forbidden Signature Database, dbx,
is loaded into the blacklist keyring.  Systems booted with shim
have an equivalent Forbidden Signature Database called mokx.
Currently mokx is only used by shim and grub, the contents are
ignored by the kernel.

Add the ability to load mokx into the blacklist keyring during boot.

Signed-off-by: Eric Snowberg <[email protected]>
Suggested-by: James Bottomley <[email protected]>
Signed-off-by: David Howells <[email protected]>
Reviewed-by: Jarkko Sakkinen <[email protected]>
cc: [email protected]
Link: https://lore.kernel.org/r/c33c8e3839a41e9654f41cc92c7231104931b1d7.camel@HansenPartnership.com/
Link: https://lore.kernel.org/r/[email protected]/
Link: https://lore.kernel.org/r/161428674320.677100.12637282414018170743.stgit@warthog.procyon.org.uk/
Link: https://lore.kernel.org/r/161433313205.902181.2502803393898221637.stgit@warthog.procyon.org.uk/
Link: https://lore.kernel.org/r/161529607422.163428.13530426573612578854.stgit@warthog.procyon.org.uk/

diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index ee4b4c666854f6b40f5664acf20a10bc641c7448..f290f78c3f3012976a15d507cd26f195230a7fd0 100644 (file)
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -132,8 +132,9 @@ static int __init load_moklist_certs(void)
 static int __init load_uefi_certs(void)
 {
        efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
-       void *db = NULL, *dbx = NULL;
-       unsigned long dbsize = 0, dbxsize = 0;
+       efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
+       void *db = NULL, *dbx = NULL, *mokx = NULL;
+       unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
        efi_status_t status;
        int rc = 0;
 
@@ -175,6 +176,21 @@ static int __init load_uefi_certs(void)
                kfree(dbx);
        }
 
+       mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);
+       if (!mokx) {
+               if (status == EFI_NOT_FOUND)
+                       pr_debug("mokx variable wasn't found\n");
+               else
+                       pr_info("Couldn't get mokx list\n");
+       } else {
+               rc = parse_efi_signature_list("UEFI:MokListXRT",
+                                             mokx, mokxsize,
+                                             get_handler_for_dbx);
+               if (rc)
+                       pr_err("Couldn't parse mokx signatures %d\n", rc);
+               kfree(mokx);
+       }
+
        /* Load the MokListRT certs */
        rc = load_moklist_certs();