Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 26 Feb 2019 06:22:10 +0000 (UTC)
From:      "Simon J. Gerraty" <sjg@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r344568 - in head/stand: . common ficl ficl32 i386/loader liblua libsa libsa32
Message-ID:  <201902260622.x1Q6MAI6003000@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: sjg
Date: Tue Feb 26 06:22:10 2019
New Revision: 344568
URL: https://svnweb.freebsd.org/changeset/base/344568

Log:
  Enable veriexec for loader
  
  This relies on libbearssl and libsecureboot
  to verify files read by loader in a maner equivalent
  to how mac_veriexec
  
  Note: disabled by default.
  Use is initially expected to be by embeded vendors
  
  Reviewed by:	emaste, imp
  Sponsored by:	Juniper Networks
  Differential Revision:	D16336

Modified:
  head/stand/common/boot.c
  head/stand/common/bootstrap.h
  head/stand/common/interp_forth.c
  head/stand/common/interp_simple.c
  head/stand/common/load_elf.c
  head/stand/common/load_elf_obj.c
  head/stand/common/module.c
  head/stand/ficl/Makefile.depend
  head/stand/ficl/ficl.h
  head/stand/ficl/fileaccess.c
  head/stand/ficl32/Makefile.depend
  head/stand/i386/loader/Makefile.depend
  head/stand/liblua/Makefile
  head/stand/liblua/lstd.c
  head/stand/libsa/Makefile
  head/stand/libsa/Makefile.depend
  head/stand/libsa32/Makefile.depend
  head/stand/loader.mk

Modified: head/stand/common/boot.c
==============================================================================
--- head/stand/common/boot.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/common/boot.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -106,6 +106,10 @@ command_boot(int argc, char *argv[])
 	if (archsw.arch_autoload() != 0)
 		return(CMD_ERROR);
 
+#ifdef LOADER_VERIEXEC
+	verify_pcr_export();		/* for measured boot */
+#endif
+
 	/* Call the exec handler from the loader matching the kernel */
 	file_formats[fp->f_loader]->l_exec(fp);
 	return(CMD_ERROR);

Modified: head/stand/common/bootstrap.h
==============================================================================
--- head/stand/common/bootstrap.h	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/common/bootstrap.h	Tue Feb 26 06:22:10 2019	(r344568)
@@ -330,6 +330,9 @@ struct arch_switch
     /* Probe ZFS pool(s), if needed. */
     void	(*arch_zfs_probe)(void);
 
+    /* Return the hypervisor name/type or NULL if not virtualized. */
+    const char *(*arch_hypervisor)(void);
+
     /* For kexec-type loaders, get ksegment structure */
     void	(*arch_kexec_kseg_get)(int *nseg, void **kseg);
 };
@@ -344,6 +347,10 @@ time_t	time(time_t *tloc);
 
 #ifndef CTASSERT
 #define	CTASSERT(x)	_Static_assert(x, "compile-time assertion failed")
+#endif
+
+#ifdef LOADER_VERIEXEC
+#include <verify_file.h>
 #endif
 
 #endif /* !_BOOTSTRAP_H_ */

Modified: head/stand/common/interp_forth.c
==============================================================================
--- head/stand/common/interp_forth.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/common/interp_forth.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -379,6 +379,13 @@ interp_include(const char *filename)
 		return(CMD_ERROR);
 	}
 
+#ifdef LOADER_VERIEXEC
+	if (verify_file(fd, filename, 0, VE_GUESS) < 0) {
+		close(fd);
+		sprintf(command_errbuf,"can't verify '%s'", filename);
+		return(CMD_ERROR);
+	}
+#endif
 	/*
 	 * Read the script into memory.
 	 */

Modified: head/stand/common/interp_simple.c
==============================================================================
--- head/stand/common/interp_simple.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/common/interp_simple.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -96,6 +96,14 @@ interp_include(const char *filename)
 		return(CMD_ERROR);
 	}
 
+#ifdef LOADER_VERIEXEC
+	if (verify_file(fd, filename, 0, VE_GUESS) < 0) {
+		close(fd);
+		sprintf(command_errbuf,"can't verify '%s'", filename);
+		return(CMD_ERROR);
+	}
+#endif
+
 	/*
 	 * Read the script into memory.
 	 */

Modified: head/stand/common/load_elf.c
==============================================================================
--- head/stand/common/load_elf.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/common/load_elf.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -245,6 +245,12 @@ __elfN(load_elf_header)(char *filename, elf_file_t ef)
 		goto error;
 	}
 
+#ifdef LOADER_VERIEXEC
+	if (verify_file(ef->fd, filename, bytes_read, VE_MUST) < 0) {
+	    err = EAUTH;
+	    goto error;
+	}
+#endif
 	return (0);
 
 error:

Modified: head/stand/common/load_elf_obj.c
==============================================================================
--- head/stand/common/load_elf_obj.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/common/load_elf_obj.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -129,6 +129,13 @@ __elfN(obj_loadfile)(char *filename, uint64_t dest,
 		goto oerr;
 	}
 
+#ifdef LOADER_VERIEXEC
+	if (verify_file(ef.fd, filename, bytes_read, VE_MUST) < 0) {
+	    err = EAUTH;
+	    goto oerr;
+	}
+#endif
+
 	kfp = file_findfile(NULL, __elfN(obj_kerneltype));
 	if (kfp == NULL) {
 		printf("elf" __XSTRING(__ELF_WORD_SIZE)

Modified: head/stand/common/module.c
==============================================================================
--- head/stand/common/module.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/common/module.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -104,6 +104,8 @@ command_load(int argc, char *argv[])
 {
     struct preloaded_file *fp;
     char	*typestr;
+    char	*prefix;
+    char	*skip;
     int		dofile, dokld, ch, error;
 
     dokld = dofile = 0;
@@ -114,11 +116,18 @@ command_load(int argc, char *argv[])
 	command_errmsg = "no filename specified";
 	return (CMD_CRIT);
     }
-    while ((ch = getopt(argc, argv, "kt:")) != -1) {
+    prefix = skip = NULL;
+    while ((ch = getopt(argc, argv, "kp:s:t:")) != -1) {
 	switch(ch) {
 	case 'k':
 	    dokld = 1;
 	    break;
+	case 'p':
+	    prefix = optarg;
+	    break;
+	case 's':
+	    skip = optarg;
+	    break;
 	case 't':
 	    typestr = optarg;
 	    dofile = 1;
@@ -141,6 +150,12 @@ command_load(int argc, char *argv[])
 	    return (CMD_CRIT);
 	}
 
+#ifdef LOADER_VERIEXEC
+	if (strncmp(typestr, "manifest", 8) == 0) {
+	    return (load_manifest(argv[1], prefix, skip, NULL));
+	}
+#endif
+
 	fp = file_findfile(argv[1], typestr);
 	if (fp) {
 		snprintf(command_errbuf, sizeof(command_errbuf),
@@ -434,6 +449,15 @@ file_loadraw(const char *fname, char *type, int insert
 	free(name);
 	return(NULL);
     }
+
+#ifdef LOADER_VERIEXEC
+    if (verify_file(fd, name, 0, VE_MUST) < 0) {
+	sprintf(command_errbuf, "can't verify '%s'", name);
+	free(name);
+	close(fd);
+	return(NULL);
+    }
+#endif
 
     if (archsw.arch_loadaddr != NULL)
 	loadaddr = archsw.arch_loadaddr(LOAD_RAW, name, loadaddr);

Modified: head/stand/ficl/Makefile.depend
==============================================================================
--- head/stand/ficl/Makefile.depend	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/ficl/Makefile.depend	Tue Feb 26 06:22:10 2019	(r344568)
@@ -2,9 +2,7 @@
 # Autogenerated - do NOT edit!
 
 DIRDEPS = \
-	include \
-	include/xlocale \
-	lib/msun \
+	stand/libsa \
 
 
 .include <dirdeps.mk>

Modified: head/stand/ficl/ficl.h
==============================================================================
--- head/stand/ficl/ficl.h	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/ficl/ficl.h	Tue Feb 26 06:22:10 2019	(r344568)
@@ -1157,6 +1157,10 @@ typedef void ficlCompileFcn(FICL_SYSTEM *);
 	DATA_SET(Xficl_compile_set, func)
 SET_DECLARE(Xficl_compile_set, ficlCompileFcn);
 
+#ifdef LOADER_VERIEXEC
+#include <verify_file.h>
+#endif
+
 #ifdef __cplusplus
 }
 #endif

Modified: head/stand/ficl/fileaccess.c
==============================================================================
--- head/stand/ficl/fileaccess.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/ficl/fileaccess.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -67,14 +67,21 @@ static void ficlFopen(FICL_VM *pVM, char *writeMode) /
     if (f == NULL)
         stackPushPtr(pVM->pStack, NULL);
     else
+#ifdef LOADER_VERIEXEC
+	if (*mode == 'r' &&
+	    verify_file(fileno(f), filename, 0, VE_GUESS) < 0) {
+	    fclose(f);
+	    stackPushPtr(pVM->pStack, NULL);
+	} else
+#endif
         {
-        ficlFILE *ff = (ficlFILE *)malloc(sizeof(ficlFILE));
-        strcpy(ff->filename, filename);
-        ff->f = f;
-        stackPushPtr(pVM->pStack, ff);
+	    ficlFILE *ff = (ficlFILE *)malloc(sizeof(ficlFILE));
+	    strcpy(ff->filename, filename);
+	    ff->f = f;
+	    stackPushPtr(pVM->pStack, ff);
 
-        fseek(f, 0, SEEK_SET);
-        }
+	    fseek(f, 0, SEEK_SET);
+	}
     pushIor(pVM, f != NULL);
 }
 

Modified: head/stand/ficl32/Makefile.depend
==============================================================================
--- head/stand/ficl32/Makefile.depend	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/ficl32/Makefile.depend	Tue Feb 26 06:22:10 2019	(r344568)
@@ -2,9 +2,7 @@
 # Autogenerated - do NOT edit!
 
 DIRDEPS = \
-	include \
-	include/xlocale \
-	lib/msun \
+	stand/libsa \
 
 
 .include <dirdeps.mk>

Modified: head/stand/i386/loader/Makefile.depend
==============================================================================
--- head/stand/i386/loader/Makefile.depend	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/i386/loader/Makefile.depend	Tue Feb 26 06:22:10 2019	(r344568)
@@ -2,15 +2,12 @@
 # Autogenerated - do NOT edit!
 
 DIRDEPS = \
-	include \
-	include/xlocale \
-	stand/ficl32 \
-	stand/geli \
-	stand/i386/btx/btx \
-	stand/i386/btx/btxldr \
-	stand/i386/btx/lib \
-	stand/i386/libi386 \
-	stand/libsa32 \
+	stand/${MACHINE_CPUARCH}/btx/btx \
+	stand/${MACHINE_CPUARCH}/btx/btxldr \
+	stand/${MACHINE_CPUARCH}/btx/lib \
+	stand/${MACHINE_CPUARCH}/libi386 \
+	stand/ficl \
+	stand/libsa \
 
 
 .include <dirdeps.mk>

Modified: head/stand/liblua/Makefile
==============================================================================
--- head/stand/liblua/Makefile	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/liblua/Makefile	Tue Feb 26 06:22:10 2019	(r344568)
@@ -35,5 +35,8 @@ CFLAGS+= -I${BOOTSRC}/include -I${LIBLUASRC} -I${LUASR
 .if ${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 0
 CFLAGS+=	-fPIC
 .endif
+.if ${MK_LOADER_VERIEXEC} == "yes"
+CFLAGS+= -I${SRCTOP}/lib/libsecureboot/h -DLOADER_VERIEXEC
+.endif
 
 .include <bsd.lib.mk>

Modified: head/stand/liblua/lstd.c
==============================================================================
--- head/stand/liblua/lstd.c	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/liblua/lstd.c	Tue Feb 26 06:22:10 2019	(r344568)
@@ -31,6 +31,10 @@ __FBSDID("$FreeBSD$");
 #include "lstd.h"
 #include "math.h"
 
+#ifdef LOADER_VERIEXEC
+#include <verify_file.h>
+#endif
+
 FILE *
 fopen(const char *filename, const char *mode)
 {
@@ -75,6 +79,17 @@ fopen(const char *filename, const char *mode)
 		close(fd);
 		return (NULL);
 	}
+
+#ifdef LOADER_VERIEXEC
+	/* only regular files and only reading makes sense */
+	if (S_ISREG(st.st_mode) && !(m & O_WRONLY)) {
+		if (verify_file(fd, filename, 0, VE_GUESS) < 0) {
+			free(f);
+			close(fd);
+			return (NULL);
+		}
+	}
+#endif
 
 	f->fd = fd;
 	f->offset = 0;

Modified: head/stand/libsa/Makefile
==============================================================================
--- head/stand/libsa/Makefile	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/libsa/Makefile	Tue Feb 26 06:22:10 2019	(r344568)
@@ -164,6 +164,11 @@ SRCS+=  explicit_bzero.c crc32_libkern.c
 .include "${SASRC}/geli/Makefile.inc"
 .endif
 
+.if ${MK_LOADER_VERIEXEC} == "yes" && ${MK_BEARSSL} == "yes"
+.include "${SRCTOP}/lib/libbearssl/Makefile.libsa.inc"
+.include "${SRCTOP}/lib/libsecureboot/Makefile.libsa.inc"
+.endif
+
 # Maybe ZFS
 .if ${MK_LOADER_ZFS} == "yes"
 .include "${SASRC}/zfs/Makefile.inc"

Modified: head/stand/libsa/Makefile.depend
==============================================================================
--- head/stand/libsa/Makefile.depend	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/libsa/Makefile.depend	Tue Feb 26 06:22:10 2019	(r344568)
@@ -2,10 +2,6 @@
 # Autogenerated - do NOT edit!
 
 DIRDEPS = \
-	include \
-	include/arpa \
-	include/xlocale \
-	lib/libbz2 \
 
 
 .include <dirdeps.mk>

Modified: head/stand/libsa32/Makefile.depend
==============================================================================
--- head/stand/libsa32/Makefile.depend	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/libsa32/Makefile.depend	Tue Feb 26 06:22:10 2019	(r344568)
@@ -2,10 +2,7 @@
 # Autogenerated - do NOT edit!
 
 DIRDEPS = \
-	include \
-	include/arpa \
-	include/xlocale \
-	lib/libbz2 \
+	stand/libsa \
 
 
 .include <dirdeps.mk>

Modified: head/stand/loader.mk
==============================================================================
--- head/stand/loader.mk	Tue Feb 26 06:17:23 2019	(r344567)
+++ head/stand/loader.mk	Tue Feb 26 06:22:10 2019	(r344568)
@@ -73,6 +73,10 @@ SRCS+=	interp_simple.c
 .error Unknown interpreter ${LOADER_INTERP}
 .endif
 
+.if ${MK_LOADER_VERIEXEC} != "no"
+CFLAGS+= -DLOADER_VERIEXEC -I${SRCTOP}/lib/libsecureboot/h
+.endif
+
 .if defined(BOOT_PROMPT_123)
 CFLAGS+=	-DBOOT_PROMPT_123
 .endif



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201902260622.x1Q6MAI6003000>