GNU GRUB - Bugs: bug #56423, module verification falls through...
You are not allowed to post comments on this tracker with your current authentication level.
bug #56423: module verification falls through to tpm, which approves it automatically
Submitter: | Benjamin Doron <benjamind> | ||
Submitted: | Fri 31 May 2019 06:48:33 AM UTC | ||
Category: | Security | Severity: | Major |
Priority: | 5 - Normal | Item Group: | Software Error |
Status: | None | Privacy: | Public |
Assigned to: | None | Originator Name: | |
Open/Closed: | Open | Release: | other |
Release: | Reproducibility: | Every Time | |
Planned Release: | None |
Sat 06 Jul 2019 03:24:52 PM UTC, comment #2: |
Benjamin Doron <benjamind> |
Fri 31 May 2019 07:13:46 AM UTC, comment #1: So, I didn't mention it, but yes, I obviously replaced the original grubx64.efi with the one that I built after I signed it. |
Benjamin Doron <benjamind> |
Fri 31 May 2019 06:48:33 AM UTC, original submission:
Configuration: grub 2.04-rc1, built with gcc 9.1.1 and binutils 2.31.1 on Fedora 30 and configured with "./configure --with-platform=efi --disable-werror". After running "make", built an image with "export GRUB_MODULES=$(cat mods); ./grub-mkimage -O x86_64-efi -o grubx64.efi -p /EFI/fedora -d grub-core $GRUB_MODULES)" and then signed grubx64.efi with pesign using a certificate enrolled in MOK (because secure boot is enabled, but this bug applies regardless). Then, copied the rest of the modules into the esp with "mkdir /boot/efi/EFI/fedora/x86_64-efi; cp grub-core/*.mod /boot/efi/EFI/fedora/x86_64-efi/" and signed them, mostly following the steps in https://www.gnu.org/software/grub/manual/grub/html_node/Using-digital-signatures.html.
|
Benjamin Doron <benjamind> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2019-05-31 | benjamind | Attached File | - | Added mods, #47006 |
Powered by Savane 3.13-758e.
Corresponding source code
Update: I observe the same behaviour on the 2.04 release, but I think that I've resolved the issue. Setting check_signatures to "enforce" results in the expected behaviour (modules load if pgp signed, even with the tpm module unloaded).
While an argument could be made for treating modules separately to regular signature verification (i.e, check their signatures even if signatures for other files aren't being checked), I'd consider this partially resolved. The bugs that I numbered 2 and 3 still remain, although these possibly are out of scope of the bug that I filed.
Most importantly, in my opinion, the documentation should be updated to clarify the standard behaviour here, as others might understand it as I did. (I could possibly do this.)