vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

verifiers: Framework core

Browse source 
Verifiers framework provides core file verification functionality which
can be used by various security mechanisms, e.g., UEFI secure boot, TPM,
PGP signature verification, etc.

The patch contains PGP code changes and probably they should be extracted
to separate patch for the sake of clarity.

Signed-off-by: Vladimir Serbinenko <phcoder@gmail.com>
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
This commit is contained in:
Vladimir Serbinenko 2017-02-05 14:25:47 +01:00 • committed by Vincent Batts
parent aebe31c375
commit 03a713b7ab
6 changed files with 542 additions and 283 deletions
Download patch file Download diff file Expand all files Collapse all files

2
include/grub/file.h
View file

@ -171,7 +171,7 @@ extern grub_disk_read_hook_t EXPORT_VAR(grub_file_progress_hook);
/* Filters with lower ID are executed first. */
typedef enum grub_file_filter_id
{
GRUB_FILE_FILTER_PUBKEY,
GRUB_FILE_FILTER_VERIFY,
GRUB_FILE_FILTER_GZIO,
GRUB_FILE_FILTER_XZIO,
GRUB_FILE_FILTER_LZOPIO,

1
include/grub/list.h
View file

@ -35,6 +35,7 @@ void EXPORT_FUNC(grub_list_push) (grub_list_t *head, grub_list_t item);
void EXPORT_FUNC(grub_list_remove) (grub_list_t item);
#define FOR_LIST_ELEMENTS(var, list) for ((var) = (list); (var); (var) = (var)->next)
#define FOR_LIST_ELEMENTS_NEXT(var, list) for ((var) = (var)->next; (var); (var) = (var)->next)
#define FOR_LIST_ELEMENTS_SAFE(var, nxt, list) for ((var) = (list), (nxt) = ((var) ? (var)->next : 0); (var); (var) = (nxt), ((nxt) = (var) ? (var)->next : 0))
static inline void *

65
include/grub/verify.h Normal file
View file

@ -0,0 +1,65 @@
/*
* GRUB -- GRand Unified Bootloader
* Copyright (C) 2017 Free Software Foundation, Inc.
*
* GRUB is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* GRUB is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
*/
#include <grub/file.h>
#include <grub/list.h>
enum grub_verify_flags
{
GRUB_VERIFY_FLAGS_SKIP_VERIFICATION = 1,
GRUB_VERIFY_FLAGS_SINGLE_CHUNK = 2
};
struct grub_file_verifier
{
struct grub_file_verifier *next;
struct grub_file_verifier **prev;
const char *name;
/*
* Check if file needs to be verified and set up context.
* init/read/fini is structured in the same way as hash interface.
*/
grub_err_t (*init) (grub_file_t io, enum grub_file_type type,
void **context, enum grub_verify_flags *flags);
/*
* Right now we pass the whole file in one call but it may
* change in the future. If you insist on single buffer you
* need to set GRUB_VERIFY_FLAGS_SINGLE_CHUNK in verify_flags.
*/
grub_err_t (*write) (void *context, void *buf, grub_size_t size);
grub_err_t (*fini) (void *context);
void (*close) (void *context);
};
extern struct grub_file_verifier *grub_file_verifiers;
static inline void
grub_verifier_register (struct grub_file_verifier *ver)
{
grub_list_push (GRUB_AS_LIST_P (&grub_file_verifiers), GRUB_AS_LIST (ver));
}
static inline void
grub_verifier_unregister (struct grub_file_verifier *ver)
{
grub_list_remove (GRUB_AS_LIST (ver));
}