b0fefb25c5
The current approach of injecting manifest into mac_veriexec is to verify the integrity of it in userspace (veriexec (8)) and pass its entries into kernel using a char device (/dev/veriexec). This requires verifying root partition integrity in loader, for example by using memory disk and checking its hash. Otherwise if rootfs is compromised an attacker could inject their own data. This patch introduces an option to parse manifest in kernel based on envs. The loader sets manifest path and digest. EVENTHANDLER is used to launch the module right after the rootfs is mounted. It has to be done this way, since one might want to verify integrity of the init file. This means that manifest is required to be present on the root partition. Note that the envs have to be set right before boot to make sure that no one can spoof them. Submitted by: Kornel Duleba <mindal@semihalf.com> Reviewed by: sjg Obtained from: Semihalf Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D19281
59 lines
1.5 KiB
PHP
59 lines
1.5 KiB
PHP
# $FreeBSD$
|
|
|
|
BRSSL_CFLAGS+= -DNO_STDIO
|
|
|
|
.include "Makefile.inc"
|
|
|
|
# for "measured boot"
|
|
# loader puts the equivalent of TPM's PCR register into kenv
|
|
# this is not as good but *way* simpler than talking to TPM
|
|
CFLAGS+= -DVE_PCR_SUPPORT
|
|
|
|
# sources that only apply to libsa
|
|
SRCS+= \
|
|
vectx.c \
|
|
veopen.c \
|
|
vepcr.c \
|
|
verify_file.c \
|
|
|
|
# Build library with support for the UEFI based authentication
|
|
.if ${MK_LOADER_EFI_SECUREBOOT} == "yes"
|
|
SRCS+= \
|
|
efi/efi_variables.c \
|
|
efi/efi_init.c
|
|
|
|
# Add includes required by efi part
|
|
CFLAGS+= \
|
|
-I${SRCTOP}/stand/efi/include \
|
|
-I${SRCTOP}/lib/libsecureboot/efi/include \
|
|
-I${SRCTOP}/stand/efi/include/${MACHINE}
|
|
.endif
|
|
|
|
.if ${MK_LOADER_VERIEXEC_PASS_MANIFEST} == "yes"
|
|
SRCS+= \
|
|
pass_manifest.c
|
|
.endif
|
|
|
|
# this is the list of paths (relative to a file
|
|
# that we need to verify) used to find a signed manifest.
|
|
# the signature extensions in VE_SIGNATURE_EXT_LIST
|
|
# will be applied to each.
|
|
VE_MANIFEST_LIST?= manifest ../manifest
|
|
|
|
verify_file.o: manifests.h
|
|
manifests.h:
|
|
@( echo '/* Autogenerated - DO NOT EDIT!!! */'; echo; \
|
|
echo "static const char *manifest_names[] = {"; \
|
|
echo '${VE_MANIFEST_LIST:@m@"$m",${.newline}@}'; \
|
|
echo 'NULL };' ) > ${.TARGET}
|
|
|
|
XCFLAGS.verify_file+= \
|
|
-DVE_DEBUG_LEVEL=${VE_DEBUG_LEVEL:U0} \
|
|
-DVE_VERBOSE_DEFAULT=${VE_VERBOSE_DEFAULT:U0} \
|
|
|
|
.if !empty(MANIFEST_SKIP_ALWAYS)
|
|
XCFLAGS.verify_file+= -DMANIFEST_SKIP_ALWAYS=\"${MANIFEST_SKIP_ALWAYS}\"
|
|
.elif !empty(MANIFEST_SKIP)
|
|
XCFLAGS.verify_file+= -DMANIFEST_SKIP=\"${MANIFEST_SKIP}\"
|
|
.endif
|