RTEfiSigDb.cpp@ 94130

Last change on this file since 94130 was 93115, checked in by vboxsync, 3 years ago
scm --update-copyright-year
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 29.8 KB

Line
1	/* $Id: RTEfiSigDb.cpp 93115 2022-01-01 11:31:46Z vboxsync $ */
2	/** @file
3	* IPRT - Utility for manipulating EFI signature databases.
4	*/
5
6	/*
7	* Copyright (C) 2021-2022 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <iprt/assert.h>
32	#include <iprt/buildconfig.h>
33	#include <iprt/err.h>
34	#include <iprt/efi.h>
35	#include <iprt/file.h>
36	#include <iprt/getopt.h>
37	#include <iprt/initterm.h>
38	#include <iprt/mem.h>
39	#include <iprt/message.h>
40	#include <iprt/path.h>
41	#include <iprt/stream.h>
42	#include <iprt/string.h>
43	#include <iprt/uuid.h>
44	#include <iprt/vfs.h>
45
46	#include <iprt/formats/efi-signature.h>
47	#include <iprt/formats/efi-varstore.h>
48
49
50	/*********************************************************************************************************************************
51	* Structures and Typedefs *
52	*********************************************************************************************************************************/
53
54
55	/*********************************************************************************************************************************
56	* Global Variables *
57	*********************************************************************************************************************************/
58	/** Signature type identifier to internal type mapping. */
59	struct RTEFISIGDBID2TYPEENTRY
60	{
61	const char *pszId;
62	RTEFISIGTYPE enmType;
63	} g_aId2SigType[] =
64	{
65	{ "sha256", RTEFISIGTYPE_SHA256 },
66	{ "rsa2048", RTEFISIGTYPE_RSA2048 },
67	{ "x509", RTEFISIGTYPE_X509 }
68	};
69
70
71	/*********************************************************************************************************************************
72	* Internal Functions *
73	*********************************************************************************************************************************/
74
75	/**
76	* Display the version of the cache program.
77	*
78	* @returns exit code.
79	*/
80	static RTEXITCODE rtEfiSigDbVersion(void)
81	{
82	RTPrintf("%sr%d\n", RTBldCfgVersion(), RTBldCfgRevision());
83	return RTEXITCODE_SUCCESS;
84	}
85
86
87	/**
88	* Shows the usage of the program.
89	*
90	* @returns Exit code.
91	* @param pszArg0 Program name.
92	* @param pszCommand Command selector, NULL if all.
93	*/
94	static RTEXITCODE rtEfiSigDbUsage(const char pszArg0, const char pszCommand)
95	{
96	if (!pszCommand \|\| !strcmp(pszCommand, "list"))
97	RTPrintf("Usage: %s list <signature database path>\n"
98	, RTPathFilename(pszArg0));
99
100	if (!pszCommand \|\| !strcmp(pszCommand, "add"))
101	RTPrintf("Usage: %s add <signature database path> <x509\|sha256\|rsa2048> <owner uuid> <signature path> ...\n"
102	, RTPathFilename(pszArg0));
103
104	if (!pszCommand \|\| !strcmp(pszCommand, "initnvram"))
105	RTPrintf("Usage: %s initnvram <nvram path> <init options>\n"
106	"\n"
107	"Init Options:\n"
108	" --pk <path>\n"
109	" Init the PK with the given signature.\n"
110	" --pk-owner <uuid>\n"
111	" Set the given UUID as the owner of the PK.\n"
112	" --kek <path>\n"
113	" Init the KEK with the given signature.\n"
114	" --kek-owner <uuid>\n"
115	" Set the given UUID as the owner of the KEK.\n"
116	" --db <x509\|sha256\|rsa2048>:<owner uuid>:<path>\n"
117	" Adds the given signature with the owner UUID and type to the db, can be given multiple times.\n"
118	" --secure-boot <on\|off>\n"
119	" Enables or disables secure boot\n"
120	, RTPathFilename(pszArg0));
121
122	return RTEXITCODE_SUCCESS;
123	}
124
125
126	static RTEFISIGTYPE rtEfiSigDbGetTypeById(const char *pszId)
127	{
128	for (uint32_t i = 0; i < RT_ELEMENTS(g_aId2SigType); i++)
129	if (!strcmp(pszId, g_aId2SigType[i].pszId))
130	return g_aId2SigType[i].enmType;
131
132	return RTEFISIGTYPE_INVALID;
133	}
134
135
136	/**
137	* Opens the specified signature database, returning an VFS file handle on success.
138	*
139	* @returns IPRT status code.
140	* @param pszPath Path to the signature database.
141	* @param phVfsFile Where to return the VFS file handle on success.
142	*/
143	static int rtEfiSigDbOpen(const char *pszPath, PRTVFSFILE phVfsFile)
144	{
145	int rc;
146
147	if (RTVfsChainIsSpec(pszPath))
148	{
149	RTVFSOBJ hVfsObj;
150	rc = RTVfsChainOpenObj(pszPath, RTFILE_O_READWRITE \| RTFILE_O_DENY_NONE \| RTFILE_O_OPEN,
151	RTVFSOBJ_F_OPEN_ANY \| RTVFSOBJ_F_CREATE_NOTHING \| RTPATH_F_ON_LINK,
152	&hVfsObj, NULL, NULL);
153	if ( RT_SUCCESS(rc)
154	&& RTVfsObjGetType(hVfsObj) == RTVFSOBJTYPE_FILE)
155	{
156	*phVfsFile = RTVfsObjToFile(hVfsObj);
157	RTVfsObjRelease(hVfsObj);
158	}
159	else
160	{
161	RTPrintf("'%s' doesn't point to a file\n", pszPath);
162	rc = VERR_INVALID_PARAMETER;
163	}
164	}
165	else
166	rc = RTVfsFileOpenNormal(pszPath, RTFILE_O_READWRITE \| RTFILE_O_DENY_NONE \| RTFILE_O_OPEN,
167	phVfsFile);
168
169	return rc;
170	}
171
172
173	/**
174	* Signature database enumeration callback.
175	*/
176	static DECLCALLBACK(int) rtEfiSgDbEnum(RTEFISIGDB hEfiSigDb, RTEFISIGTYPE enmSigType, PCRTUUID pUuidOwner,
177	const void pvSig, size_t cbSig, void pvUser)
178	{
179	RT_NOREF(hEfiSigDb, pvUser);
180
181	uint32_t pidxSig = (uint32_t )pvUser;
182
183	RTPrintf("%02u: %s\n", (*pidxSig)++, RTEfiSigDbTypeStringify(enmSigType));
184	RTPrintf(" Owner: %RTuuid\n", pUuidOwner);
185	RTPrintf(" Signature:\n"
186	"%.*Rhxd\n\n", cbSig, pvSig);
187	return VINF_SUCCESS;
188	}
189
190
191	/**
192	* Handles the 'list' command.
193	*
194	* @returns Program exit code.
195	* @param pszArg0 The program name.
196	* @param cArgs The number of arguments to the 'add' command.
197	* @param papszArgs The argument vector, starting after 'add'.
198	*/
199	static RTEXITCODE rtEfiSgDbCmdList(const char pszArg0, int cArgs, char *papszArgs)
200	{
201	RT_NOREF(pszArg0);
202
203	if (!cArgs)
204	{
205	RTPrintf("An input path must be given\n");
206	return RTEXITCODE_FAILURE;
207	}
208
209	RTEXITCODE rcExit = RTEXITCODE_SUCCESS;
210	RTVFSFILE hVfsFile = NIL_RTVFSFILE;
211	int rc = rtEfiSigDbOpen(papszArgs[0], &hVfsFile);
212	if (RT_SUCCESS(rc))
213	{
214	RTEFISIGDB hEfiSigDb;
215	rc = RTEfiSigDbCreate(&hEfiSigDb);
216	if (RT_SUCCESS(rc))
217	{
218	uint32_t idxSig = 0;
219
220	rc = RTEfiSigDbAddFromExistingDb(hEfiSigDb, hVfsFile);
221	if (RT_SUCCESS(rc))
222	RTEfiSigDbEnum(hEfiSigDb, rtEfiSgDbEnum, &idxSig);
223	else
224	{
225	RTPrintf("Loading the signature database failed with %Rrc\n", rc);
226	rcExit = RTEXITCODE_FAILURE;
227	}
228
229	RTEfiSigDbDestroy(hEfiSigDb);
230	}
231	else
232	{
233	RTPrintf("Creating the signature database failed with %Rrc\n", rc);
234	rcExit = RTEXITCODE_FAILURE;
235	}
236
237	RTVfsFileRelease(hVfsFile);
238	}
239	else
240	rcExit = RTEXITCODE_FAILURE;
241
242	return rcExit;
243	}
244
245
246	/**
247	* Handles the 'add' command.
248	*
249	* @returns Program exit code.
250	* @param pszArg0 The program name.
251	* @param cArgs The number of arguments to the 'add' command.
252	* @param papszArgs The argument vector, starting after 'add'.
253	*/
254	static RTEXITCODE rtEfiSgDbCmdAdd(const char pszArg0, int cArgs, char *papszArgs)
255	{
256	RT_NOREF(pszArg0);
257
258	if (!cArgs)
259	{
260	RTPrintf("The signature database path is missing\n");
261	return RTEXITCODE_FAILURE;
262	}
263
264	RTEXITCODE rcExit = RTEXITCODE_SUCCESS;
265	RTVFSFILE hVfsFile = NIL_RTVFSFILE;
266	int rc = rtEfiSigDbOpen(papszArgs[0], &hVfsFile);
267	if (RT_SUCCESS(rc))
268	{
269	RTEFISIGDB hEfiSigDb;
270	rc = RTEfiSigDbCreate(&hEfiSigDb);
271	if (RT_SUCCESS(rc))
272	{
273	uint64_t cbSigDb = 0;
274	rc = RTVfsFileQuerySize(hVfsFile, &cbSigDb);
275	if ( RT_SUCCESS(rc)
276	&& cbSigDb)
277	rc = RTEfiSigDbAddFromExistingDb(hEfiSigDb, hVfsFile);
278	if (RT_SUCCESS(rc))
279	{
280	cArgs--;
281	papszArgs++;
282
283	while (cArgs >= 3)
284	{
285	RTEFISIGTYPE enmSigType = rtEfiSigDbGetTypeById(papszArgs[0]);
286	const char *pszUuidOwner = papszArgs[1];
287	const char *pszSigDataPath = papszArgs[2];
288
289	if (enmSigType == RTEFISIGTYPE_INVALID)
290	{
291	RTPrintf("Signature type '%s' is not known\n", papszArgs[0]);
292	break;
293	}
294
295	RTUUID UuidOwner;
296	rc = RTUuidFromStr(&UuidOwner, pszUuidOwner);
297	if (RT_FAILURE(rc))
298	{
299	RTPrintf("UUID '%s' is malformed\n", pszUuidOwner);
300	break;
301	}
302
303	RTVFSFILE hVfsFileSigData = NIL_RTVFSFILE;
304	rc = rtEfiSigDbOpen(pszSigDataPath, &hVfsFileSigData);
305	if (RT_FAILURE(rc))
306	{
307	RTPrintf("Opening '%s' failed with %Rrc\n", pszSigDataPath, rc);
308	break;
309	}
310
311	rc = RTEfiSigDbAddSignatureFromFile(hEfiSigDb, enmSigType, &UuidOwner, hVfsFileSigData);
312	RTVfsFileRelease(hVfsFileSigData);
313	if (RT_FAILURE(rc))
314	{
315	RTPrintf("Adding signature data from '%s' failed with %Rrc\n", pszSigDataPath, rc);
316	break;
317	}
318	papszArgs += 3;
319	cArgs -= 3;
320	}
321
322	if (RT_SUCCESS(rc))
323	{
324	if (!cArgs)
325	{
326	rc = RTVfsFileSeek(hVfsFile, 0 /offSeek/, RTFILE_SEEK_BEGIN, NULL /poffActual/);
327	AssertRC(rc);
328
329	rc = RTEfiSigDbWriteToFile(hEfiSigDb, hVfsFile);
330	if (RT_FAILURE(rc))
331	{
332	RTPrintf("Writing the updated signature database failed with %Rrc\n", rc);
333	rcExit = RTEXITCODE_FAILURE;
334	}
335	}
336	else
337	{
338	RTPrintf("Incomplete list of entries to add given\n");
339	rcExit = RTEXITCODE_FAILURE;
340	}
341	}
342	}
343	else
344	{
345	RTPrintf("Loading the signature database failed with %Rrc\n", rc);
346	rcExit = RTEXITCODE_FAILURE;
347	}
348
349	RTEfiSigDbDestroy(hEfiSigDb);
350	}
351	else
352	{
353	RTPrintf("Creating the signature database failed with %Rrc\n", rc);
354	rcExit = RTEXITCODE_FAILURE;
355	}
356
357	RTVfsFileRelease(hVfsFile);
358	}
359	else
360	rcExit = RTEXITCODE_FAILURE;
361
362	return rcExit;
363	}
364
365
366	/**
367	* Adds the given signature to the given database.
368	*
369	* @returns IPRT status code.
370	* @param hEfiSigDb The EFI signature database handle.
371	* @param pszSigPath The signature data path.
372	* @param pszSigType The signature type.
373	* @param pszUuidOwner The owner UUID.
374	*/
375	static int rtEfiSigDbAddSig(RTEFISIGDB hEfiSigDb, const char pszSigPath, const char pszSigType, const char *pszUuidOwner)
376	{
377	RTEFISIGTYPE enmSigType = rtEfiSigDbGetTypeById(pszSigType);
378	if (enmSigType == RTEFISIGTYPE_INVALID)
379	return RTMsgErrorRc(VERR_INVALID_PARAMETER, "Signature type '%s' is unknown!", pszSigType);
380
381	RTUUID UuidOwner;
382	int rc = RTUuidFromStr(&UuidOwner, pszUuidOwner);
383	if (RT_FAILURE(rc))
384	return RTMsgErrorRc(VERR_INVALID_PARAMETER, "Owner UUID '%s' is malformed!", pszUuidOwner);
385
386	RTVFSFILE hVfsFileSigData = NIL_RTVFSFILE;
387	rc = rtEfiSigDbOpen(pszSigPath, &hVfsFileSigData);
388	if (RT_FAILURE(rc))
389	return RTMsgErrorRc(rc, "Opening '%s' failed: %Rrc", pszSigPath, rc);
390
391	rc = RTEfiSigDbAddSignatureFromFile(hEfiSigDb, enmSigType, &UuidOwner, hVfsFileSigData);
392	RTVfsFileRelease(hVfsFileSigData);
393	if (RT_FAILURE(rc))
394	return RTMsgErrorRc(rc, "Adding signature '%s' failed: %Rrc", pszSigPath, rc);
395
396	return VINF_SUCCESS;
397	}
398
399
400	/**
401	* Sets the given attributes for the given EFI variable store variable.
402	*
403	* @returns IPRT status code.
404	* @param hVfsVarStore Handle of the EFI variable store VFS.
405	* @param pszVar The variable to set the attributes for.
406	* @param fAttr The attributes to set, see EFI_VAR_HEADER_ATTR_XXX.
407	*/
408	static int rtEfiSigDbSetVarAttr(RTVFS hVfsVarStore, const char *pszVar, uint32_t fAttr)
409	{
410	char szVarPath[_1K];
411	ssize_t cch = RTStrPrintf2(szVarPath, sizeof(szVarPath), "/raw/%s/attr", pszVar);
412	Assert(cch > 0); RT_NOREF(cch);
413
414	RTVFSFILE hVfsFileAttr = NIL_RTVFSFILE;
415	int rc = RTVfsFileOpen(hVfsVarStore, szVarPath,
416	RTFILE_O_READWRITE \| RTFILE_O_DENY_NONE \| RTFILE_O_OPEN,
417	&hVfsFileAttr);
418	if (RT_SUCCESS(rc))
419	{
420	uint32_t fAttrLe = RT_H2LE_U32(fAttr);
421	rc = RTVfsFileWrite(hVfsFileAttr, &fAttrLe, sizeof(fAttrLe), NULL /pcbWritten/);
422	RTVfsFileRelease(hVfsFileAttr);
423	}
424
425	return rc;
426	}
427
428
429	/**
430	* Adds the given variable to the variable store.
431	*
432	* @returns IPRT status code.
433	* @param hVfsVarStore Handle of the EFI variable store VFS.
434	* @param pGuid The EFI GUID of the variable.
435	* @param pszVar The variable name.
436	* @param fAttr Attributes for the variable.
437	* @param phVfsFile Where to return the VFS file handle to the created variable on success.
438	*/
439	static int rtEfiSigDbVarStoreAddVar(RTVFS hVfsVarStore, PCEFI_GUID pGuid, const char *pszVar, uint32_t fAttr, PRTVFSFILE phVfsFile)
440	{
441	RTUUID UuidVar;
442	RTEfiGuidToUuid(&UuidVar, pGuid);
443
444	char szVarPath[_1K];
445	ssize_t cch = RTStrPrintf2(szVarPath, sizeof(szVarPath), "/by-uuid/%RTuuid/%s", &UuidVar, pszVar);
446	Assert(cch > 0); RT_NOREF(cch);
447
448	int rc = RTVfsFileOpen(hVfsVarStore, szVarPath,
449	RTFILE_O_READWRITE \| RTFILE_O_DENY_NONE \| RTFILE_O_OPEN,
450	phVfsFile);
451	if ( rc == VERR_PATH_NOT_FOUND
452	\|\| rc == VERR_FILE_NOT_FOUND)
453	{
454	/*
455	* Try to create the owner GUID of the variable by creating the appropriate directory,
456	* ignore error if it exists already.
457	*/
458	RTVFSDIR hVfsDirRoot = NIL_RTVFSDIR;
459	rc = RTVfsOpenRoot(hVfsVarStore, &hVfsDirRoot);
460	if (RT_SUCCESS(rc))
461	{
462	char szGuidPath[_1K];
463	cch = RTStrPrintf2(szGuidPath, sizeof(szGuidPath), "by-uuid/%RTuuid", &UuidVar);
464	Assert(cch > 0);
465
466	RTVFSDIR hVfsDirGuid = NIL_RTVFSDIR;
467	rc = RTVfsDirCreateDir(hVfsDirRoot, szGuidPath, 0755, 0 /fFlags/, &hVfsDirGuid);
468	if (RT_SUCCESS(rc))
469	RTVfsDirRelease(hVfsDirGuid);
470	else if (rc == VERR_ALREADY_EXISTS)
471	rc = VINF_SUCCESS;
472
473	RTVfsDirRelease(hVfsDirRoot);
474	}
475	else
476	rc = RTMsgErrorRc(rc, "Opening variable storage root directory failed: %Rrc", rc);
477
478	if (RT_SUCCESS(rc))
479	{
480	rc = RTVfsFileOpen(hVfsVarStore, szVarPath,
481	RTFILE_O_READWRITE \| RTFILE_O_DENY_NONE \| RTFILE_O_CREATE,
482	phVfsFile);
483	if (RT_SUCCESS(rc))
484	rc = rtEfiSigDbSetVarAttr(hVfsVarStore, pszVar, fAttr);
485	}
486
487	if (RT_FAILURE(rc))
488	rc = RTMsgErrorRc(rc, "Creating the variable '%s' failed: %Rrc", pszVar, rc);
489	}
490
491	return rc;
492	}
493
494
495	/**
496	* Creates the given variable and sets the data.
497	*
498	* @returns IPRT status code.
499	* @param hVfsVarStore Handle of the EFI variable store VFS.
500	* @param pGuid The EFI GUID of the variable.
501	* @param pszVar The variable name.
502	* @param fAttr Attributes for the variable.
503	* @param pvBuf The data to write.
504	* @param cbBuf Number of bytes of data.
505	*/
506	static int rtEfiSigDbVarStoreSetVar(RTVFS hVfsVarStore, PCEFI_GUID pGuid, const char *pszVar, uint32_t fAttr,
507	const void *pvBuf, size_t cbBuf)
508	{
509	RTVFSFILE hVfsFileVar = NIL_RTVFSFILE;
510	int rc = rtEfiSigDbVarStoreAddVar(hVfsVarStore, pGuid, pszVar, fAttr, &hVfsFileVar);
511	if (RT_SUCCESS(rc))
512	{
513	rc = RTVfsFileWrite(hVfsFileVar, pvBuf, cbBuf, NULL /pcbWritten/);
514	if (RT_FAILURE(rc))
515	rc = RTMsgErrorRc(rc, "Writing variable '%s' failed: %Rrc", pszVar, rc);
516	RTVfsFileRelease(hVfsFileVar);
517	}
518	else
519	rc = RTMsgErrorRc(rc, "Creating variable '%s' failed: %Rrc", pszVar, rc);
520
521	return rc;
522	}
523
524
525	/**
526	* Adds the given signature to the given signature database of the given EFI variable store.
527	*
528	* @returns IPRT status code.
529	* @param hVfsVarStore Handle of the EFI variable store VFS.
530	* @param pGuid The EFI GUID of the variable.
531	* @param pszDb The signature database to update.
532	* @param fWipeDbBefore Flag whether to wipe the database before adding the signature.
533	* @param cSigs Number of signatures following.
534	* @param ... A triple of signature path, signature type and owner uuid string pointers for each
535	* signature.
536	*/
537	static int rtEfiSigDbVarStoreAddToDb(RTVFS hVfsVarStore, PCEFI_GUID pGuid, const char *pszDb, bool fWipeDbBefore, uint32_t cSigs,
538	... /const char pszSigPath, const char pszSigType, const char pszUuidOwner*/)
539	{
540	RTVFSFILE hVfsFileSigDb = NIL_RTVFSFILE;
541	int rc = rtEfiSigDbVarStoreAddVar(hVfsVarStore, pGuid, pszDb,
542	EFI_VAR_HEADER_ATTR_NON_VOLATILE
543	\| EFI_VAR_HEADER_ATTR_BOOTSERVICE_ACCESS
544	\| EFI_VAR_HEADER_ATTR_RUNTIME_ACCESS
545	\| EFI_AUTH_VAR_HEADER_ATTR_TIME_BASED_AUTH_WRITE_ACCESS,
546	&hVfsFileSigDb);
547	if (RT_SUCCESS(rc))
548	{
549	RTEFISIGDB hEfiSigDb;
550	rc = RTEfiSigDbCreate(&hEfiSigDb);
551	if (RT_SUCCESS(rc))
552	{
553	if (!fWipeDbBefore)
554	rc = RTEfiSigDbAddFromExistingDb(hEfiSigDb, hVfsFileSigDb);
555	if (RT_SUCCESS(rc))
556	{
557	va_list VarArgs;
558	va_start(VarArgs, cSigs);
559
560	while ( cSigs--
561	&& RT_SUCCESS(rc))
562	{
563	const char pszSigPath = va_arg(VarArgs, const char );
564	const char pszSigType = va_arg(VarArgs, const char );
565	const char pszUuidOwner = va_arg(VarArgs, const char );
566
567	rc = rtEfiSigDbAddSig(hEfiSigDb, pszSigPath, pszSigType, pszUuidOwner);
568	}
569
570	va_end(VarArgs);
571	if (RT_SUCCESS(rc))
572	{
573	rc = RTVfsFileSeek(hVfsFileSigDb, 0 /offSeek/, RTFILE_SEEK_BEGIN, NULL /poffActual/);
574	AssertRC(rc);
575
576	rc = RTEfiSigDbWriteToFile(hEfiSigDb, hVfsFileSigDb);
577	if (RT_FAILURE(rc))
578	rc = RTMsgErrorRc(rc, "Writing updated signature database failed: %Rrc", rc);
579	}
580	}
581	else
582	rc = RTMsgErrorRc(rc, "Loading signature database failed: %Rrc", rc);
583
584	RTEfiSigDbDestroy(hEfiSigDb);
585	}
586	else
587	rc = RTMsgErrorRc(rc, "Creating signature database failed: %Rrc", rc);
588
589	RTVfsFileRelease(hVfsFileSigDb);
590	}
591	else
592	rc = RTMsgErrorRc(rc, "Opening signature database '%s' failed: %Rrc", pszDb, rc);
593
594	return rc;
595	}
596
597
598	/**
599	* Handles the 'initnvram' command.
600	*
601	* @returns Program exit code.
602	* @param pszArg0 The program name.
603	* @param cArgs The number of arguments to the 'add' command.
604	* @param papszArgs The argument vector, starting after 'add'.
605	*/
606	static RTEXITCODE rtEfiSgDbCmdInitNvram(const char pszArg0, int cArgs, char *papszArgs)
607	{
608	RT_NOREF(pszArg0);
609	RTERRINFOSTATIC ErrInfo;
610
611	/*
612	* Parse the command line.
613	*/
614	static RTGETOPTDEF const s_aOptions[] =
615	{
616	{ "--pk", 'p', RTGETOPT_REQ_STRING },
617	{ "--pk-owner", 'o', RTGETOPT_REQ_STRING },
618	{ "--kek", 'k', RTGETOPT_REQ_STRING },
619	{ "--kek-owner", 'w', RTGETOPT_REQ_STRING },
620	{ "--db", 'd', RTGETOPT_REQ_STRING },
621	{ "--secure-boot", 's', RTGETOPT_REQ_BOOL_ONOFF }
622	};
623
624	RTEXITCODE rcExit = RTEXITCODE_SUCCESS;
625	RTGETOPTSTATE State;
626	int rc = RTGetOptInit(&State, cArgs, papszArgs, &s_aOptions[0], RT_ELEMENTS(s_aOptions), 0, RTGETOPTINIT_FLAGS_OPTS_FIRST);
627	if (RT_FAILURE(rc))
628	return RTMsgErrorExit(RTEXITCODE_FAILURE, "RTGetOptInit failed: %Rrc", rc);
629
630	const char *pszNvram = NULL;
631	const char *pszPkPath = NULL;
632	const char *pszUuidPkOwner = NULL;
633	const char *pszKekPath = NULL;
634	const char *pszUuidKekOwner = NULL;
635	const char **papszDb = NULL;
636	bool fSecureBoot = true;
637	bool fSetSecureBoot = false;
638	uint32_t cDbEntries = 0;
639	uint32_t cDbEntriesMax = 0;
640
641	RTGETOPTUNION ValueUnion;
642	int chOpt;
643	while ((chOpt = RTGetOpt(&State, &ValueUnion)) != 0)
644	{
645	switch (chOpt)
646	{
647	case 'p':
648	pszPkPath = ValueUnion.psz;
649	break;
650	case 'o':
651	pszUuidPkOwner = ValueUnion.psz;
652	break;
653
654	case 'k':
655	pszKekPath = ValueUnion.psz;
656	break;
657	case 'w':
658	pszUuidKekOwner = ValueUnion.psz;
659	break;
660
661	case 'd':
662	{
663	if (cDbEntries == cDbEntriesMax)
664	{
665	uint32_t cDbEntriesMaxNew = cDbEntriesMax + 10;
666	const char papszDbNew = (const char )RTMemRealloc(papszDb, cDbEntriesMaxNew * sizeof(const char *));
667	if (!papszDbNew)
668	return RTMsgErrorExit(RTEXITCODE_FAILURE, "Out of memory allocating memory for '%s'", ValueUnion.psz);
669
670	papszDb = papszDbNew;
671	cDbEntriesMax = cDbEntriesMaxNew;
672	}
673
674	papszDb[cDbEntries++] = ValueUnion.psz;
675	break;
676	}
677
678	case 's':
679	fSecureBoot = ValueUnion.f;
680	fSetSecureBoot = true;
681	break;
682
683	case VINF_GETOPT_NOT_OPTION:
684	/* The first non-option is the NVRAM file. */
685	if (!pszNvram)
686	pszNvram = ValueUnion.psz;
687	else
688	return RTMsgErrorExit(RTEXITCODE_SYNTAX, "Invalid option '%s'", ValueUnion.psz);
689	break;
690
691	default:
692	return RTGetOptPrintError(chOpt, &ValueUnion);
693	}
694	}
695
696	if (!pszNvram)
697	return RTMsgErrorExit(RTEXITCODE_SYNTAX, "The NVRAM file path is missing");
698
699	if ( pszPkPath
700	&& !pszUuidPkOwner)
701	return RTMsgErrorExit(RTEXITCODE_SYNTAX, "The PK is missing the owner UUID");
702
703	if ( pszKekPath
704	&& !pszUuidKekOwner)
705	return RTMsgErrorExit(RTEXITCODE_SYNTAX, "The KEK is missing the owner UUID");
706
707	RTVFSFILE hVfsFileNvram = NIL_RTVFSFILE;
708	rc = RTVfsFileOpenNormal(pszNvram, RTFILE_O_READWRITE \| RTFILE_O_DENY_NONE \| RTFILE_O_OPEN,
709	&hVfsFileNvram);
710	if (RT_SUCCESS(rc))
711	{
712	RTVFS hVfsEfiVarStore = NIL_RTVFS;
713	rc = RTEfiVarStoreOpenAsVfs(hVfsFileNvram, 0 /fMntFlags/, 0 /fVarStoreFlags/, &hVfsEfiVarStore, RTErrInfoInitStatic(&ErrInfo));
714	if (RT_SUCCESS(rc))
715	{
716	EFI_GUID GuidSecurityDb = EFI_IMAGE_SECURITY_DATABASE_GUID;
717	EFI_GUID GuidGlobalVar = EFI_GLOBAL_VARIABLE_GUID;
718
719	if (pszPkPath)
720	rc = rtEfiSigDbVarStoreAddToDb(hVfsEfiVarStore, &GuidGlobalVar, "PK", true /fWipeDbBefore/, 1 /cSigs/, pszPkPath, "x509", pszUuidPkOwner);
721	if ( RT_SUCCESS(rc)
722	&& pszKekPath)
723	rc = rtEfiSigDbVarStoreAddToDb(hVfsEfiVarStore, &GuidGlobalVar ,"KEK", true /fWipeDbBefore/, 1 /cSigs/, pszKekPath, "x509", pszUuidKekOwner);
724
725	if ( RT_SUCCESS(rc)
726	&& cDbEntries)
727	{
728	/** @todo Optimize to avoid re-opening and re-parsing the database for every entry. */
729	for (uint32_t i = 0; i < cDbEntries && RT_SUCCESS(rc); i++)
730	{
731	const char *pszDbEntry = papszDb[i];
732
733	const char *pszSigType = pszDbEntry;
734	const char *pszUuidOwner = strchr(pszSigType, ':');
735	if (pszUuidOwner)
736	pszUuidOwner++;
737	const char *pszSigPath = pszUuidOwner ? strchr(pszUuidOwner, ':') : NULL;
738	if (pszSigPath)
739	pszSigPath++;
740
741	if ( pszUuidOwner
742	&& pszSigPath)
743	{
744	char *pszSigTypeFree = RTStrDupN(pszSigType, pszUuidOwner - pszSigType - 1);
745	char *pszUuidOwnerFree = RTStrDupN(pszUuidOwner, pszSigPath - pszUuidOwner - 1);
746
747	if ( pszSigTypeFree
748	&& pszUuidOwnerFree)
749	rc = rtEfiSigDbVarStoreAddToDb(hVfsEfiVarStore, &GuidSecurityDb, "db",
750	i == 0 ? true : false /fWipeDbBefore/,
751	1 /cSigs/,
752	pszSigPath, pszSigTypeFree, pszUuidOwnerFree);
753	else
754	rc = RTMsgErrorRc(VERR_NO_MEMORY, "Out of memory!");
755
756	if (pszSigTypeFree)
757	RTStrFree(pszSigTypeFree);
758	if (pszUuidOwnerFree)
759	RTStrFree(pszUuidOwnerFree);
760	}
761	else
762	rc = RTMsgErrorRc(VERR_INVALID_PARAMETER, "DB entry '%s' is malformed!", pszDbEntry);
763	}
764
765	if (RT_FAILURE(rc))
766	rcExit = RTMsgErrorExit(RTEXITCODE_FAILURE, "Initializing the NVRAM '%s' failed: %Rrc", pszNvram, rc);
767	}
768
769	if ( RT_SUCCESS(rc)
770	&& fSetSecureBoot)
771	{
772	EFI_GUID GuidSecureBootEnable = EFI_SECURE_BOOT_ENABLE_DISABLE_GUID;
773	uint8_t bVar = fSecureBoot ? 0x1 : 0x0;
774	rtEfiSigDbVarStoreSetVar(hVfsEfiVarStore, &GuidSecureBootEnable, "SecureBootEnable",
775	EFI_VAR_HEADER_ATTR_NON_VOLATILE
776	\| EFI_VAR_HEADER_ATTR_BOOTSERVICE_ACCESS
777	\| EFI_VAR_HEADER_ATTR_RUNTIME_ACCESS,
778	&bVar, sizeof(bVar));
779	}
780
781	RTVfsRelease(hVfsEfiVarStore);
782	}
783
784	RTVfsFileRelease(hVfsFileNvram);
785	}
786
787	if (papszDb)
788	RTMemFree(papszDb);
789	return rcExit;
790	}
791
792
793	int main(int argc, char **argv)
794	{
795	int rc = RTR3InitExe(argc, &argv, 0);
796	if (RT_FAILURE(rc))
797	return RTMsgInitFailure(rc);
798
799	/*
800	* Switch on the command.
801	*/
802	RTEXITCODE rcExit = RTEXITCODE_SYNTAX;
803	if (argc < 2)
804	rtEfiSigDbUsage(argv[0], NULL);
805	else if (!strcmp(argv[1], "list"))
806	rcExit = rtEfiSgDbCmdList(argv[0], argc - 2, argv + 2);
807	else if (!strcmp(argv[1], "add"))
808	rcExit = rtEfiSgDbCmdAdd(argv[0], argc - 2, argv + 2);
809	else if (!strcmp(argv[1], "initnvram"))
810	rcExit = rtEfiSgDbCmdInitNvram(argv[0], argc - 2, argv + 2);
811	else if ( !strcmp(argv[1], "-h")
812	\|\| !strcmp(argv[1], "-?")
813	\|\| !strcmp(argv[1], "--help"))
814	rcExit = rtEfiSigDbUsage(argv[0], NULL);
815	else if ( !strcmp(argv[1], "-V")
816	\|\| !strcmp(argv[1], "--version"))
817	rcExit = rtEfiSigDbVersion();
818	else
819	RTMsgError("Unknown command: '%s'", argv[1]);
820
821	return rcExit;
822	}
823

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/tools/RTEfiSigDb.cpp@ 94130

Download in other formats: