From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 4BA1B15800A for ; Fri, 14 Jul 2023 08:44:54 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id DC761E08AD; Fri, 14 Jul 2023 08:44:47 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 5133EE08A8 for ; Fri, 14 Jul 2023 08:44:47 +0000 (UTC) Message-ID: <5d102e6d-b854-57a7-e4b1-4688c62a9556@gentoo.org> Date: Fri, 14 Jul 2023 10:44:44 +0200 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 Content-Language: en-US, nl-NL To: gentoo-dev@lists.gentoo.org From: Andrew Ammerlaan Organization: Gentoo Linux Subject: [gentoo-dev] [PATCH 1/5]: secureboot.eclass: add new eclass Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Archives-Salt: ff6cec0c-a2e2-41bc-a131-311fbc9c7a92 X-Archives-Hash: 2328d3bc9952f0de60b1dce7e67d5aaf From 3116d64388a5381b5ad1d200eb2e01a8194cf631 Mon Sep 17 00:00:00 2001 From: Andrew Ammerlaan Date: Tue, 11 Jul 2023 19:47:52 +0200 Subject: [PATCH 01/13] eclass/secureboot.eclass: add new eclass Signed-off-by: Andrew Ammerlaan --- eclass/secureboot.eclass | 179 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 179 insertions(+) create mode 100644 eclass/secureboot.eclass diff --git a/eclass/secureboot.eclass b/eclass/secureboot.eclass new file mode 100644 index 000000000000..3cae2faf9711 --- /dev/null +++ b/eclass/secureboot.eclass @@ -0,0 +1,179 @@ +# Copyright 1999-2023 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +# @ECLASS: secureboot.eclass +# @MAINTAINER: +# Andrew Ammerlaan +# @AUTHOR: +# Author: Andrew Ammerlaan +# @SUPPORTED_EAPIS: 7 8 +# @BLURB: A small eclass to sign efi files for Secure Boot +# @DESCRIPTION: +# Eclass for packages that install .efi files. A use flag and two user +# variables allow signing these .efi files for use on systems with Secure Boot +# enabled. +# +# Signing the files during emerge ensures that any tooling that actually +# installs the bootloaders and kernels to ESP always uses a signed version. +# This prevents Secure Boot from accidentally breaking when upgrading the +# kernel or the bootloader. +# +# Example use +# @CODE +# src_install() { +# default +# secureboot_sign_efi_file in.efi out.efi.signed +# } +# @CODE +# +# Or +# @CODE +# src_install() { +# default +# secureboot_auto_sign +# } +# @CODE +# +# Some tools will automatically detect and use EFI executables with the .signed +# file extentsion. For tools that do not do this the --in-place argument for +# secureboot_auto_sign can be used to ensure that the signed version is used. +# Additionally it is possible to use a custom file extentsion with the --ext +# argument. + +case ${EAPI} in + 7|8) ;; + *) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;; +esac + +IUSE="secureboot" +BDEPEND="secureboot? ( app-crypt/sbsigntools )" + +# @ECLASS_VARIABLE: SECUREBOOT_SIGN_KEY +# @USER_VARIABLE +# @DEFAULT_UNSET +# @DESCRIPTION: +# Used with USE=secureboot. Should be set to the path of the private +# key in PEM format to use, or a PKCS#11 URI. +# +# @ECLASS_VARIABLE: SECUREBOOT_SIGN_CERT +# @USER_VARIABLE +# @DEFAULT_UNSET +# @DESCRIPTION: +# Used with USE=secureboot. Should be set to the path of the public +# key certificate in PEM format to use. + +if [[ -z ${_SECUREBOOT_ECLASS} ]]; then +_SECUREBOOT_ECLASS=1 + +# @FUNCTION: _secureboot_die_if_unset +# @INTERNAL +# @DESCRIPTION: +# If USE=secureboot is enabled die if the required user variables are unset +# and die if the keys can't be found. +_secureboot_die_if_unset() { + use secureboot || return + debug-print-function ${FUNCNAME[0]} "${@}" + if [[ -z ${SECUREBOOT_SIGN_KEY} || -z ${SECUREBOOT_SIGN_CERT} ]]; then + die "USE=secureboot enabled but SECUREBOOT_SIGN_KEY and/or SECUREBOOT_SIGN_CERT not set." + fi + if [[ ! ${SECUREBOOT_SIGN_KEY} == pkcs11:* && ! -f ${SECUREBOOT_SIGN_KEY} ]]; then + die "SECUREBOOT_SIGN_KEY=${SECUREBOOT_SIGN_KEY} not found" + fi + if [[ ! -f ${SECUREBOOT_SIGN_CERT} ]];then + die "SECUREBOOT_SIGN_CERT=${SECUREBOOT_SIGN_CERT} not found" + fi +} + +# @FUNCTION: secureboot_pkg_setup +# @DESCRIPTION: +# Checks if required user variables are set before starting the build +secureboot_pkg_setup() { + use secureboot || return + debug-print-function ${FUNCNAME[0]} "${@}" + # If we are merging a binary then the files in this binary + # are already signed, no need to check the variables. + if [[ ${MERGE_TYPE} != binary ]]; then + _secureboot_die_if_unset + fi +} + +# @FUNCTION: secureboot_sign_efi_file +# @USAGE: +# @DESCRIPTION: +# Sign a file using sbsign and the requested key/certificate. +# If the file is already signed with our key then skip. +secureboot_sign_efi_file() { + use secureboot || return + debug-print-function ${FUNCNAME[0]} "${@}" + local input_file=${1} + local output_file=${2} + + _secureboot_die_if_unset + + if has_version app-crypt/sbsigntools; then + ebegin "Signing ${input_file}" + local return=1 + if sbverify "${input_file}" --cert "${SECUREBOOT_SIGN_CERT}" &> /dev/null; then + ewarn "${input_file} already signed, skipping" + return=0 + else + local args=( + "--key=${SECUREBOOT_SIGN_KEY}" + "--cert=${SECUREBOOT_SIGN_CERT}" + ) + if [[ ${SECUREBOOT_SIGN_KEY} == pkcs11:* ]]; then + args+=( --engine=pkcs11 ) + fi + + sbsign "${args[@]}" "${input_file}" --output "${output_file}" + return=${?} + fi + eend ${return} || die -n "Signing ${input_file} failed" + else + die "secureboot signing requested but app-crypt/sbsigntools not installed" + fi +} + +# @FUNCTION: secureboot_auto_sign +# @USAGE: [--in-place | --ext ] +# @DESCRIPTION: +# Automatically discover and sign efi files in the image directory. +# +# By default signed files gain the .signed extension. If the --in-place +# argument is given the efi files are replaced with a signed version in place. +# The --ext argument allows for overriding the default .signed file extension. +secureboot_auto_sign() { + use secureboot || return + debug-print-function ${FUNCNAME[0]} "${@}" + + [[ ${EBUILD_PHASE} == install ]] || + die "${FUNCNAME[0]} can only be called in the src_install phase" + + local path=${ED} + local -a efi_execs + [[ -d ${path} ]] && mapfile -td '' efi_execs < <( + find "${path}" -type f -iname '*.efi' -print0 || die + ) + (( ${#efi_execs[@]} )) || + die "${FUNCNAME[0]} was called but no efi executables were found" + + local ext + if [[ ${1} == --in-place ]]; then + ext="" + elif [[ ${1} == --ext ]]; then + [[ -z ${2} ]] || die "Expected second argument with option --ext" + ext=${2} + elif [[ -n ${1} ]]; then + die "Invalid argument ${1}" + else + ext=".signed" + fi + + for efi_exec in "${efi_execs[@]}"; do + secureboot_sign_efi_file "${efi_exec}" "${efi_exec}${ext}" + done +} + +fi + +EXPORT_FUNCTIONS pkg_setup -- 2.41.0