bugGNU GRUB - Bugs: bug #56423, module verification falls through...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #56423: module verification falls through to tpm, which approves it automatically

Submitter:  Benjamin Doron <benjamind>
Submitted:  Fri 31 May 2019 06:48:33 AM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  other
Release:  Reproducibility:  Every Time
Planned Release:  None

Sat 06 Jul 2019 03:24:52 PM UTC, comment #2: 

Update: I observe the same behaviour on the 2.04 release, but I think that I've resolved the issue. Setting check_signatures to "enforce" results in the expected behaviour (modules load if pgp signed, even with the tpm module unloaded).

While an argument could be made for treating modules separately to regular signature verification (i.e, check their signatures even if signatures for other files aren't being checked), I'd consider this partially resolved. The bugs that I numbered 2 and 3 still remain, although these possibly are out of scope of the bug that I filed.

Most importantly, in my opinion, the documentation should be updated to clarify the standard behaviour here, as others might understand it as I did. (I could possibly do this.)

Benjamin Doron <benjamind>
Fri 31 May 2019 07:13:46 AM UTC, comment #1: 

So, I didn't mention it, but yes, I obviously replaced the original grubx64.efi with the one that I built after I signed it.

Benjamin Doron <benjamind>
Fri 31 May 2019 06:48:33 AM UTC, original submission:  

Configuration: grub 2.04-rc1, built with gcc 9.1.1 and binutils 2.31.1 on Fedora 30 and configured with "./configure --with-platform=efi --disable-werror". After running "make", built an image with "export GRUB_MODULES=$(cat mods); ./grub-mkimage -O x86_64-efi -o grubx64.efi -p /EFI/fedora -d grub-core $GRUB_MODULES)" and then signed grubx64.efi with pesign using a certificate enrolled in MOK (because secure boot is enabled, but this bug applies regardless). Then, copied the rest of the modules into the esp with "mkdir /boot/efi/EFI/fedora/x86_64-efi; cp grub-core/*.mod /boot/efi/EFI/fedora/x86_64-efi/" and signed them, mostly following the steps in https://www.gnu.org/software/grub/manual/grub/html_node/Using-digital-signatures.html.


According to what I've read in the documentation for 2.04 (on git), inserting a module should now first check it for a valid pgp signature (where previously, distros disabled "insmod" entirely and grub would "insmod" regardless, having no concept of secure boot). However, I've observed that modules do get inserted, even without having detached signatures, so long as the tpm module is loaded. This is true on a VM with no TPM and a laptop with one. (With the tpm module loaded, try loading a module. It will succeed. Then "rmmod tpm" and try loading another. It fails with the error, "verification requested but nobody cares: <path to module>")

My bet is that the pgp module isn't verifying modules for some reason and that it's falling through to the tpm module, which measures (in some cases, 'measures') and okays them.


I consider the following to be bugs:
1. pgp module isn't verifying modules that we attempt to insert
2. tpm module is allowed to verify modules. The tpm can only measure. What if the module is malicious?
3. tpm module operates on a system without a tpm?

The following should also be considered (but I understand that I can't expect it to be done if I can't do it myself): If modules are meant to be verified against keys, a malicious user could trust another public key and then insert their module. Perhaps (on secure boot only, maybe?) modules should only be allowed to be inserted if signed by a particular key that's provided either with the source code at "make" time or to "grub2-mkimage" at build time to be included in the image.


Perhaps I'm misunderstanding where the pgp signatures should be (as .sigs with the .mods, no?) and that's why pgp isn't verifying them, but I see no indication why that would be the case.

Benjamin Doron <benjamind>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #47006:  mods added by benjamind (468B - application/octet-stream - The modules included at build time. I placed it with the source code)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by benjamind (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-05-31 benjamind Attached File- Added mods, #47006

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code