[PATCH v1 07/21] grub-install: support embedding x509 certificates

[Sudhakar Kuppusamy]

From: Alastair D'Silva <alastair@d-silva.org>

To support verification of appended signatures, we need a way to
embed the necessary public keys. Existing appended signature schemes
in the Linux kernel use X.509 certificates, so allow certificates to
be embedded in the grub core image in the same way as PGP keys.

Signed-off-by: Alastair D'Silva <alastair@d-silva.org>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
---
 grub-core/commands/pgp.c    |  2 +-
 include/grub/kernel.h       |  2 ++
 include/grub/util/install.h |  3 +++
 util/grub-install-common.c  | 19 ++++++++++++++++++-
 util/grub-mkimage.c         | 14 ++++++++++++--
 util/mkimage.c              | 33 +++++++++++++++++++++++++++++++--
 6 files changed, 67 insertions(+), 6 deletions(-)

diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
index a45c2213c..847a5046a 100644
--- a/grub-core/commands/pgp.c
+++ b/grub-core/commands/pgp.c
@@ -944,7 +944,7 @@ GRUB_MOD_INIT(pgp)
     grub_memset (&pseudo_file, 0, sizeof (pseudo_file));
 
     /* Not an ELF module, skip.  */
-    if (header->type != OBJ_TYPE_PUBKEY)
+    if (header->type != OBJ_TYPE_GPG_PUBKEY)
       continue;
 
     pseudo_file.fs = &pseudo_fs;
diff --git a/include/grub/kernel.h b/include/grub/kernel.h
index 6121c1e66..5c5ac129d 100644
--- a/include/grub/kernel.h
+++ b/include/grub/kernel.h
@@ -29,6 +29,8 @@ enum
   OBJ_TYPE_CONFIG,
   OBJ_TYPE_PREFIX,
   OBJ_TYPE_PUBKEY,
+  OBJ_TYPE_GPG_PUBKEY,
+  OBJ_TYPE_X509_PUBKEY,
   OBJ_TYPE_DTB,
   OBJ_TYPE_DISABLE_SHIM_LOCK,
   OBJ_TYPE_DISABLE_CLI
diff --git a/include/grub/util/install.h b/include/grub/util/install.h
index 3aabc4285..52a667c37 100644
--- a/include/grub/util/install.h
+++ b/include/grub/util/install.h
@@ -69,6 +69,8 @@
       N_("disable shim_lock verifier"), 0 },                           \
   { "disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0,             \
     N_("disabled command line interface access"), 0 },                 \
+  { "x509key",   'x', N_("FILE"), 0,                                   \
+      N_("embed FILE as an x509 certificate for signature checking"), 0}, \
   { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,  \
     "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended 
signature"), 1}, \
   { "verbose", 'v', 0, 0,                                              \
@@ -193,6 +195,7 @@ grub_install_generate_image (const char *dir, const char 
*prefix,
                             const char *outname, char *mods[],
                             char *memdisk_path, char **pubkey_paths,
                             size_t npubkeys,
+                            char **x509key_paths, size_t nx509keys,
                             char *config_path,
                             const struct grub_install_image_target_desc 
*image_target,
                             int note, size_t appsig_size,
diff --git a/util/grub-install-common.c b/util/grub-install-common.c
index 22f0e56cb..29c45e26e 100644
--- a/util/grub-install-common.c
+++ b/util/grub-install-common.c
@@ -463,6 +463,8 @@ handle_install_list (struct install_list *il, const char 
*val,
 
 static char **pubkeys;
 static size_t npubkeys;
+static char **x509keys;
+static size_t nx509keys;
 static char *sbat;
 static int disable_shim_lock;
 static grub_compression_t compression;
@@ -510,6 +512,10 @@ grub_install_parse (int key, char *arg)
     case GRUB_INSTALL_OPTIONS_DISABLE_CLI:
       disable_cli = 1;
       return 1;
+    case 'x':
+      x509keys = xrealloc (x509keys, sizeof (x509keys[0]) * (nx509keys + 1));
+      x509keys[nx509keys++] = xstrdup (arg);
+      return 1;
 
     case GRUB_INSTALL_OPTIONS_VERBOSITY:
       verbosity++;
@@ -640,6 +646,9 @@ grub_install_make_image_wrap_file (const char *dir, const 
char *prefix,
   for (pk = pubkeys; pk < pubkeys + npubkeys; pk++)
     slen += sizeof (" --pubkey ''") + grub_strlen (*pk);
 
+  for (pk = x509keys; pk < x509keys + nx509keys; pk++)
+    slen += sizeof (" --x509key ''") + grub_strlen (*pk);
+
   for (md = modules.entries; *md; md++)
     slen += sizeof (" ''") + grub_strlen (*md);
 
@@ -680,6 +689,14 @@ grub_install_make_image_wrap_file (const char *dir, const 
char *prefix,
       *p++ = '\'';
     }
 
+  for (pk = x509keys; pk < x509keys + nx509keys; pk++)
+    {
+      p = grub_stpcpy (p, "--x509key '");
+      p = grub_stpcpy (p, *pk);
+      *p++ = '\'';
+      *p++ = ' ';
+    }
+
   for (md = modules.entries; *md; md++)
     {
       *p++ = ' ';
@@ -706,7 +723,7 @@ grub_install_make_image_wrap_file (const char *dir, const 
char *prefix,
 
   grub_install_generate_image (dir, prefix, fp, outname,
                               modules.entries, memdisk_path,
-                              pubkeys, npubkeys, config_path, tgt,
+                              pubkeys, npubkeys,  x509keys, nx509keys, 
config_path, tgt,
                               note, appsig_size, compression, dtb, sbat,
                               disable_shim_lock, disable_cli);
   while (dc--)
diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c
index 6c5063ac2..1f958e04b 100644
--- a/util/grub-mkimage.c
+++ b/util/grub-mkimage.c
@@ -75,7 +75,8 @@ static struct argp_option options[] = {
    /* TRANSLATORS: "embed" is a verb (command description).  "*/
   {"config",   'c', N_("FILE"), 0, N_("embed FILE as an early config"), 0},
    /* TRANSLATORS: "embed" is a verb (command description).  "*/
-  {"pubkey",   'k', N_("FILE"), 0, N_("embed FILE as public key for signature 
checking"), 0},
+  {"pubkey",   'k', N_("FILE"), 0, N_("embed FILE as public key for PGP 
signature checking"), 0},
+  {"x509key",     'x', N_("FILE"), 0, N_("embed FILE as an x509 certificate 
for appended signature checking"), 0},
   /* TRANSLATORS: NOTE is a name of segment.  */
   {"note",   'n', 0, 0, N_("add NOTE segment for CHRP IEEE1275"), 0},
   {"output",  'o', N_("FILE"), 0, N_("output a generated image to FILE 
[default=stdout]"), 0},
@@ -125,6 +126,8 @@ struct arguments
   char *dtb;
   char **pubkeys;
   size_t npubkeys;
+  char **x509keys;
+  size_t nx509keys;
   char *font;
   char *config;
   char *sbat;
@@ -208,6 +211,12 @@ argp_parser (int key, char *arg, struct argp_state *state)
       arguments->pubkeys[arguments->npubkeys++] = xstrdup (arg);
       break;
 
+    case 'x':
+      arguments->x509keys = xrealloc (arguments->x509keys,
+                                      sizeof (arguments->x509keys[0]) * 
(arguments->nx509keys + 1));
+      arguments->x509keys[arguments->nx509keys++] = xstrdup (arg);
+      break;
+
     case 'c':
       if (arguments->config)
        free (arguments->config);
@@ -338,7 +347,8 @@ main (int argc, char *argv[])
   grub_install_generate_image (arguments.dir, arguments.prefix, fp,
                               arguments.output, arguments.modules,
                               arguments.memdisk, arguments.pubkeys,
-                              arguments.npubkeys, arguments.config,
+                              arguments.npubkeys, arguments.x509keys,
+                              arguments.nx509keys, arguments.config,
                               arguments.image_target, arguments.note,
                               arguments.appsig_size,
                               arguments.comp, arguments.dtb,
diff --git a/util/mkimage.c b/util/mkimage.c
index f5c59f563..7076d632b 100644
--- a/util/mkimage.c
+++ b/util/mkimage.c
@@ -883,7 +883,7 @@ void
 grub_install_generate_image (const char *dir, const char *prefix,
                             FILE *out, const char *outname, char *mods[],
                             char *memdisk_path, char **pubkey_paths,
-                            size_t npubkeys, char *config_path,
+                            size_t npubkeys, char **x509key_paths, size_t 
nx509keys, char *config_path,
                             const struct grub_install_image_target_desc 
*image_target,
                             int note, size_t appsig_size, grub_compression_t 
comp, const char *dtb_path,
                             const char *sbat_path, int disable_shim_lock,
@@ -929,6 +929,18 @@ grub_install_generate_image (const char *dir, const char 
*prefix,
       }
   }
 
+  {
+    size_t i;
+    for (i = 0; i < nx509keys; i++)
+      {
+        size_t curs;
+        curs = ALIGN_ADDR (grub_util_get_image_size (x509key_paths[i]));
+        grub_util_info ("the size of x509 public key %u is 0x%" 
GRUB_HOST_PRIxLONG_LONG,
+                        (unsigned) i, (unsigned long long) curs);
+        total_module_size += curs + sizeof (struct grub_module_header);
+      }
+  }
+
   if (memdisk_path)
     {
       memdisk_size = ALIGN_UP(grub_util_get_image_size (memdisk_path), 512);
@@ -1053,7 +1065,7 @@ grub_install_generate_image (const char *dir, const char 
*prefix,
        curs = grub_util_get_image_size (pubkey_paths[i]);
 
        header = (struct grub_module_header *) (kernel_img + offset);
-       header->type = grub_host_to_target32 (OBJ_TYPE_PUBKEY);
+       header->type = grub_host_to_target32 (OBJ_TYPE_GPG_PUBKEY);
        header->size = grub_host_to_target32 (curs + sizeof (*header));
        offset += sizeof (*header);
 
@@ -1062,6 +1074,23 @@ grub_install_generate_image (const char *dir, const char 
*prefix,
       }
   }
 
+  {
+    size_t i;
+    for (i = 0; i < nx509keys; i++)
+      {
+        size_t curs;
+        struct grub_module_header *header;
+
+        curs = grub_util_get_image_size (x509key_paths[i]);
+        header = (struct grub_module_header *) (kernel_img + offset);
+        header->type = grub_host_to_target32 (OBJ_TYPE_X509_PUBKEY);
+        header->size = grub_host_to_target32 (curs + sizeof (*header));
+        offset += sizeof (*header);
+        grub_util_load_image (x509key_paths[i], kernel_img + offset);
+        offset += ALIGN_ADDR (curs);
+      }
+  }
+
   if (memdisk_path)
     {
       struct grub_module_header *header;
-- 
2.43.5