Fix pkgfs stat so it satisfies libsecurebootWe need a valid st_dev, st_ino and st_mtimeto correctly track which files have been verifiedand to update our notion of time.ve_utc_set(): ignore utc
Fix pkgfs stat so it satisfies libsecurebootWe need a valid st_dev, st_ino and st_mtimeto correctly track which files have been verifiedand to update our notion of time.ve_utc_set(): ignore utc if it would jump our current timeby more than VE_UTC_MAX_JUMP (20 years).Allow testing of install command via userboot.Need to fix its stat implementation too.bhyveload also needs stat fixed - due to change to userboot.hCall ve_error_get() from vectx_close() when hash is wrong.Track the names of files we have hashed into pcrFor the purposes of measured boot, it is importantto be able to reproduce the hash reflected inloader.ve.pcrso loader.ve.hashed provides a list of names in the order theywere added.Reviewed by: impMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org//D24027
show more ...
veloader use vectx API for kernel and modulesThe vectx API, computes the hash for verifying a file as it is read.This avoids the overhead of reading files twice - once to verify, thenagain to loa
veloader use vectx API for kernel and modulesThe vectx API, computes the hash for verifying a file as it is read.This avoids the overhead of reading files twice - once to verify, thenagain to load.For doing an install via loader, avoiding the need to rewindlarge files is critical.This API is only used for modules, kernel and mdimage as these are thebiggest files read by the loader.The reduction in boot time depends on how expensive the I/O ison any given platform. On a fast VM we see 6% improvement.For install via loader the first file to be verified is likely to be thekernel, so some of the prep work (finding manifest etc) done byverify_file() needs to be factored so it can be reused forvectx_open().For missing or unrecognized fingerprint entries, we failin vectx_open() unless verifying is disabled.Otherwise fingerprint check happens in vectx_close() andsince this API is only used for files which must be verified(VE_MUST) we panic if we get an incorrect hash.Reviewed by: imp,tsoomeMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org//D23827
libsecureboot: allow OpenPGP support to be dormantSince we can now add OpenPGP trust anchors at runtime,ensure the latent support is available.Ensure we do not add duplicate keys to trust store.
libsecureboot: allow OpenPGP support to be dormantSince we can now add OpenPGP trust anchors at runtime,ensure the latent support is available.Ensure we do not add duplicate keys to trust store.Also allow reporting names of trust anchors added/revokedWe only do this for loader and only after initializing trust store.Thus only changes to initial trust store will be logged.Reviewed by: stevekMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D20700
libsecureboot: allow control of when pseudo pcr is updatedDuring boot we only want to measure things which *must*be verified - this should provide more deterministic ordering.Reviewed by: stevek
libsecureboot: allow control of when pseudo pcr is updatedDuring boot we only want to measure things which *must*be verified - this should provide more deterministic ordering.Reviewed by: stevekMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D20297
Allow no_hash to appear in manifest.sbin/veriexec will ignore entries that have no hash anyway,but loader needs to be explicitly told that such files areok to ignore (not verify).We will report
Allow no_hash to appear in manifest.sbin/veriexec will ignore entries that have no hash anyway,but loader needs to be explicitly told that such files areok to ignore (not verify).We will report as Unverified depending on verbose level,but with no reason - because we are not rejecting the file.Reviewed by: imp, mindal_semihalfSponsored by: Juniper NetworksMFC After: 1 weekDifferential Revision: https://reviews.freebsd.org//D20018
Create kernel module to parse Veriexec manifest based on envsThe current approach of injecting manifest into mac_veriexec is toverify the integrity of it in userspace (veriexec (8)) and pass itse
Create kernel module to parse Veriexec manifest based on envsThe current approach of injecting manifest into mac_veriexec is toverify the integrity of it in userspace (veriexec (8)) and pass itsentries into kernel using a char device (/dev/veriexec).This requires verifying root partition integrity in loader,for example by using memory disk and checking its hash.Otherwise if rootfs is compromised an attacker could inject their own data.This patch introduces an option to parse manifest in kernel based on envs.The loader sets manifest path and digest.EVENTHANDLER is used to launch the module right after the rootfs is mounted.It has to be done this way, since one might want to verify integrity of the init file.This means that manifest is required to be present on the root partition.Note that the envs have to be set right before boot to make sure that no one can spoof them.Submitted by: Kornel Duleba <[email protected]>Reviewed by: sjgObtained from: SemihalfSponsored by: StormshieldDifferential Revision: https://reviews.freebsd.org/D19281
Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocationUEFI related headers were copied from edk2.A new build option "MK_LOADER_EFI_SECUREBOOT" was added
Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocationUEFI related headers were copied from edk2.A new build option "MK_LOADER_EFI_SECUREBOOT" was added to allowloading of trusted anchors from UEFI.Certificate revocation support is also introduced.The forbidden certificates are loaded from dbx variable.Verification fails in two cases:There is a direct match between cert in dbx and the one in the chain.The CA used to sign the chain is found in dbx.One can also insert a hash of TBS section of a certificate into dbx.In this case verifications fails only if a direct match with acertificate in chain is found.Submitted by: Kornel Duleba <[email protected]>Reviewed by: sjgObtained from: SemihalfSponsored by: StormshieldDifferential Revision: https://reviews.freebsd.org/D19093
Add libsecurebootUsed by loader and veriexecDepends on libbearsslReviewed by: emasteSponsored by: Juniper NetworksDifferential Revision: D16335