search

rhboot / shim-review

Reviews of shim
66 stars 128 forks source link

Shim 15.7 - shimx64.efi and shimia32.efi for OpenText(MicroFocus) ZENworks #320

Closed MuthuvelKuppusamy closed 7 months ago

MuthuvelKuppusamy commented 1 year ago

Confirm the following are included in your repo, checking each box:

What is the link to your tag in a repo cloned from rhboot/shim-review?

https://github.com/MuthuvelKuppusamy/shim-review/tree/opentext-shim-x64-ia32-20230929

What is the SHA256 hash of your final SHIM binary?

c11e597213af28f78c2f231ea9764748a84e49747993e7a9c24f73875516ef8b shimia32.efi f88931998d2ee41e50671ba2528d93b1fcad2aa25706fbfe8bc9720fb0764b73 shimx64.efi

What is the link to your previous shim review request (if any, otherwise N/A)?

https://github.com/rhboot/shim-review/issues/166

MuthuvelKuppusamy commented 1 year ago

Done all cleanup and raised this request and closed the old request https://github.com/rhboot/shim-review/issues/311

MuthuvelKuppusamy commented 1 year ago

@frozencemetery @steve-mcintyre @julian-klode - Kindly review this request. This is the very critical issue for many customers in the field for longtime to address the Boot Hole vulnerability.

MuthuvelKuppusamy commented 1 year ago

Kindly review this request and update the status.

dennis-tseng99 commented 1 year ago

I'm not an authorized reviewer, but I'd like to contribute a little bit effort to help @frozencemetery @steve-mcintyre @julian-klode:

MuthuvelKuppusamy commented 1 year ago

Kindly update the status for this review request.

Zenworksuser commented 1 year ago

hi, whats the current Status of this request??

aronowski commented 1 year ago

While I'm not an official reviewer, I can see a few curiosities:

*******************************************************************************
### Do you add a vendor-specific SBAT entry to the SBAT section in each binary that supports SBAT metadata ( grub2, fwupd, fwupdate, shim + all child shim binaries )?
### Please provide exact SBAT entries for all SBAT binaries you are booting or planning to boot directly through shim.
### Where your code is only slightly modified from an upstream vendor's, please also preserve their SBAT entries to simplify revocation.
*******************************************************************************
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.MFZENworks,3,MicroFocus,shim,15.7,https://www.microfocus.com/

[...]

I can see the earlier shim you got approved was 15.4 here. It had the entry shim,1,UEFI shim,shim,1,https://github.com/rhboot/shim.

Therefore if this is the first time 15.7 is used (i.e. with shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim), why is your product specific generation number set to 3? 

*******************************************************************************
### Do you add a vendor-specific SBAT entry to the SBAT section in each binary that supports SBAT metadata ( grub2, fwupd, fwupdate, shim + all child shim binaries )?
### Please provide exact SBAT entries for all SBAT binaries you are booting or planning to boot directly through shim.
### Where your code is only slightly modified from an upstream vendor's, please also preserve their SBAT entries to sim
plify revocation.
*******************************************************************************
[...]

grub:
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md                                            grub,3,Free Software Foundation,grub,2.06,https://www.gnu.org/software/grub/
grub.sle,3,SUSE Linux Enterprise,grub2,2.06,mail:security-team@suse.de
grub.MFZENworks,3,MicroFocus,grub2,2.06-0-ZENworks1,https://www.microfocus.com/
### Which modules are built into your signed grub image?
*******************************************************************************
grub-core all_video boot cat chain configfile echo true efinet font gfxmenu gfxterm gzio halt iso9660 jpeg
minicmd normal part_apple part_msdos part_gpt password_pbkdf2 png reboot search search_fs_uuid search_fs_file
search_label sleep test video fat loadenv linuxefi btrfs ext2 xfs jfs reiserfs efinet tftp http luks gcry_rijndael
gcry_sha1 gcry_sha256 mdraid09 mdraid1x lvm serial

*******************************************************************************
### What is the origin and full version number of your bootloader (GRUB or other)?
*******************************************************************************
http://download.opensuse.org/tumbleweed/repo/oss/src/grub2-2.06-28.3.src.rpm

The source RPM link doesn't work. Therefore I can't proceed with further verification.

Though I suspect the grub-core entry is an error the same as I mentioned here.

Regarding your product specific generation number, I can't verify if it's correct as I have no knowledge, if you just take SUSE Linux Enterprise GRUB2 and rebuild it or add custom patches, where security issues to your custom build were addressed twice.

MuthuvelKuppusamy commented 1 year ago

There was a review comment to increase the number to 3, which required to revoke the shim <=2. Please refer my previous request. https://github.com/rhboot/shim-review/issues/311#issuecomment-1378462212

With respect to grub source repo updated as below https://download.opensuse.org/repositories/openSUSE:/Factory/standard/src/grub2-2.06-49.1.src.rpm

aronowski commented 1 year ago

There was a review comment to increase the number to 3, which required to revoke the shim <=2. Please refer my previous request. #311 (comment)

This was about increasing the Red Hat Bootloader Team's shim global generation number to 3, not about MicroFocus's product specific generation number.

Normally it should be like this, assuming there were no security issues addressed beforehand

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.MFZENworks,1,MicroFocus,shim,15.7,https://www.microfocus.com/

There seems to be a difference between the modules listed in this review and your specfile.
(the ones with < are mentioned only in your review, the ones with > are mentioned only in specfile)

6a7
> crypttab
7a9
> efifwsetup
15a18
> gcry_sha512
18d20
< grub-core
26a29
> loopback
27a31
> luks2
35a40
> password
37a43
> read
47a54,55
> tpm
> tpm2

I was right about the grub-core error. Also, take look - some modules from the specfile haven't been provided in the review.

If they are unused, even though they are listed, let me know, how that's implemented.

PS: there are more modules in the specfile but seem to be architecture-specific (ppc/ppc64/ppc64le) so the macro parser I have in my head ignored these. ;)

MuthuvelKuppusamy commented 1 year ago

It is typo issue, grub-core is folder , where all the modules output files are placed as per below command. ./grub-mkimage -O x86_64-efi -o grub.efi --prefix= --sbat sbat.csv -d grub-core all_video boot cat chain configfile echo true efinet font gfxmenu gfxterm gzio halt iso9660 jpeg minicmd normal part_apple part_msdos part_gpt password_pbkdf2 png reboot search search_fs_uuid search_fs_file search_label sleep test video fat loadenv linuxefi btrfs ext2 xfs jfs reiserfs efinet tftp http luks gcry_rijndael gcry_sha1 gcry_sha256 mdraid09 mdraid1x lvm serial

jrbnovell commented 1 year ago

@frozencemetery @steve-mcintyre @julian-klode - Can you please provide any additional information regarding changes that need to be made or approve this review. As has been stated we have several thousand customers depending on this shim who have been broken since the fall of 2022. We need to be able to release this shim so that those customers can continue to provision their devices.

aronowski commented 1 year ago

@jrbnovell, the point of this project is that issues should be peer-reviewed:

shim-review is meant to be distros reviewing each other and right now it's very much not.

As far as I can see the best people can do to speed up the reviewing process is to help review other issues. I helped you with yours, please help me with mine as a token of appreciation (I wrote more on this in this comment).

Also, I pointed out some errors in the issue you posted. Please, fix these as it is pointless for official reviewers to spend more time on pointing out the same.

Thank you in advance.

THS-on commented 11 months ago

Review for microfocus-shim-x64-ia32-20230224.

Hashes

#22 [18/19] RUN sha256sum /shimia32/build-ia32/shimia32.efi /shim-review/shimia32.efi /shimx64/build-x64/shimx64.efi /shim-review/shimx64.efi
#22 0.427 b80b3505ed0d9802b781e668989b2d41fbf7d9fffb5f5364350f93dbfb179585  /shimia32/build-ia32/shimia32.efi
#22 0.432 b80b3505ed0d9802b781e668989b2d41fbf7d9fffb5f5364350f93dbfb179585  /shim-review/shimia32.efi
#22 0.438 25c77ed8bdd494f080cfa8583298cb1a638c6f34c1734c47f4b0bb036bd4416a  /shimx64/build-x64/shimx64.efi
#22 0.443 25c77ed8bdd494f080cfa8583298cb1a638c6f34c1734c47f4b0bb036bd4416a  /shim-review/shimx64.efi
#22 DONE 0.5s

SBAT

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.MFZENworks,3,MicroFocus,shim,15.7,https://www.microfocus.com/

Notes/Questions

MuthuvelKuppusamy commented 11 months ago

Thanks for reviewing. Will update required details asap.

THS-on commented 11 months ago

@MuthuvelKuppusamy since the submission, two new questions were added:

Can you also include them in the updated submission?

MuthuvelKuppusamy commented 11 months ago
  1. SBAT updated as per review comment.
  2. grub2 source is cloned from SUSE project and build with our sbat.
  3. We will not alter kernel and modules. Using the same provided by SUSE.
  4. Shim154 is not released, as it has issues with most of the customer hardware's.
  5. Our shim is not patched in the machine, it will be provided thro PXE boot/Netboot/LiveCD.
  6. https://github.com/rhboot/shim-review/issues/166 is verified by using random string to primary mail.
THS-on commented 11 months ago

Ok

Notes

Questions

MuthuvelKuppusamy commented 11 months ago

Last submission validated by mailing random string to the both security contacts. Refer the below link. https://github.com/rhboot/shim-review/issues/166#issuecomment-862898875 https://github.com/rhboot/shim-review/issues/166#issuecomment-863754152

THS-on commented 11 months ago

@MuthuvelKuppusamy thank you. So this validation was done without any PGP keys then right?

MuthuvelKuppusamy commented 11 months ago

Yes, It was validated by sending random string to both mail-ids and pasting the same in the issue for verification.

MuthuvelKuppusamy commented 11 months ago

Kindly let me know, Is there any other information need to be provided. As the question label is not yet removed.

THS-on commented 11 months ago

What still needs to be figured out is how SUSE handles the signing of the kernel modules and if they are preventing older kernels to load older modules. At least for openSUSE Tumbleweed this seems not to be the case: https://github.com/rhboot/shim-review/issues/333#issuecomment-1740402073

MuthuvelKuppusamy commented 11 months ago

We will sign the kernel itself, using the shim embedded keys or else it will not be successful to chain load from our grub.

THS-on commented 11 months ago

Yes, but the kernel generally also has a certificate embedded to verify loaded kernel modules. The question is on how this is implemented e.g. new certificate for every build, kernel is build without module support etc.

MuthuvelKuppusamy commented 11 months ago

Thanks for the quick review and feedback.

Hi, I have looked in to sles15sp3 and sles15sp5 kernel signature and modules signatures. Each version of the kernel has different signature embedded in the kernel which is same as module signature. sp3_sp5_details_sig Hope this helps for your review. Let me know if any other information required.

THS-on commented 11 months ago

Thanks, also looking at https://github.com/SUSE/kernel-source it seems that they are using a new key for every build. Maybe @jsegitz can confirm this, but otherwise my questions are now answered.

Because the contacts have changed, I would like to do another round of contact verification (https://github.com/rhboot/shim-review/blob/main/docs/reviewer-guidelines.md#contact-verification). Can you provide me with which PGP keys I should use for those email addresses?

MuthuvelKuppusamy commented 10 months ago

Added the GPG key for contact verification. Please let me know if any other information required.

THS-on commented 10 months ago

@MuthuvelKuppusamy thanks, I sent out emails for contact verification.

@dennis-tseng99 @aronowski can you have another look at this? Once the contact verification is done, it is ready to go from my side

aronowski commented 10 months ago

@THS-on, I'm kind of tied up at the moment and will be able to review the application as early as of November 18.

MuthuvelKuppusamy commented 9 months ago

wakings angostura reappraising linkage mainspring might've deletes cords hangouts quizzes

anavale-ot commented 9 months ago

semaphores colloquiums adaptors breakfast anatomical microcode bleep microcode outsourced grade

MuthuvelKuppusamy commented 9 months ago

Updated the random strings for contacts verification.

THS-on commented 9 months ago

@MuthuvelKuppusamy contact verification is complete. What is now left is at least one (also unofficial) review from another person. There are also currently a lot of reviews that need one more review which are tagged with "extra review wanted". I would like to encourage you to have a look at a couple of them and do an unofficial review (the guide can be found here: https://github.com/rhboot/shim-review/blob/main/docs/reviewer-guidelines.md). This helps us out, to keep the queue moving and catching mistakes.

ClaudioGranatiero-10zig commented 9 months ago

I'm not an authorized reviewer, I'm just trying to help and learn.

shimx64.efi


=== SECTIONS ===

  NAME          RVA      VSZ   RAW_SZ  RAW_PTR  nREL  REL_PTR nLINE LINE_PTR     FLAGS
  "/4"         5000    1d744    1d800      400     0        0     0        0  40400040  R-- IDATA
  .text       23000    6148e    61600    1dc00     0        0     0        0  60300020  R-X CODE
  .reloc      85000        a      200    7f200     0        0     0        0  42100040  R-- IDATA DISCARDABLE
  "/14"       87000       86      200    7f400     0        0     0        0  c0600040  RW- IDATA
  "/26"       88000       47      200    7f600     0        0     0        0  40300040  R-- IDATA
  .data       89000    2cef8    2d000    7f800     0        0     0        0  c0600040  RW- IDATA
  "/37"       b6000      316      400    ac800     0        0     0        0  40300040  R-- IDATA
  .dynamic    b7000      100      200    acc00     0        0     0        0  c0400040  RW- IDATA
  .rela       b8000    1b468    1b600    ace00     0        0     0        0  40400040  R-- IDATA
  .sbat       d4000       c6      200    c8400     0        0     0        0  40100040  R-- IDATA

Code section is not writable: OK

shimia32.efi


=== SECTIONS ===

  NAME          RVA      VSZ   RAW_SZ  RAW_PTR  nREL  REL_PTR nLINE LINE_PTR     FLAGS
  .text        5000    684bd    68600      400     0        0     0        0  60300020  R-X CODE
  .reloc      6e000        a      200    68a00     0        0     0        0  42100040  R-- IDATA DISCARDABLE
  "/4"        70000       86      200    68c00     0        0     0        0  c0600040  RW- IDATA
  "/16"       71000       47      200    68e00     0        0     0        0  40300040  R-- IDATA
  .data       72000    242b4    24400    69000     0        0     0        0  c0600040  RW- IDATA
  "/27"       97000      316      400    8d400     0        0     0        0  40300040  R-- IDATA
  .dynamic    98000       80      200    8d800     0        0     0        0  c0300040  RW- IDATA
  .rel        99000     96f8     9800    8da00     0        0     0        0  40300040  R-- IDATA
  .sbat       a3000       c6      200    97200     0        0     0        0  40100040  R-- IDATA

Code section is not writable: OK

SBAT:

shimx64.efi


shimx64.efi:     file format pei-x86-64

Contents of section .sbat:
 d4000 73626174 2c312c53 42415420 56657273  sbat,1,SBAT Vers
 d4010 696f6e2c 73626174 2c312c68 74747073  ion,sbat,1,https
 d4020 3a2f2f67 69746875 622e636f 6d2f7268  ://github.com/rh
 d4030 626f6f74 2f736869 6d2f626c 6f622f6d  boot/shim/blob/m
 d4040 61696e2f 53424154 2e6d640a 7368696d  ain/SBAT.md.shim
 d4050 2c332c55 45464920 7368696d 2c736869  ,3,UEFI shim,shi
 d4060 6d2c312c 68747470 733a2f2f 67697468  m,1,https://gith
 d4070 75622e63 6f6d2f72 68626f6f 742f7368  ub.com/rhboot/sh
 d4080 696d0a73 68696d2e 4d465a45 4e776f72  im.shim.MFZENwor
 d4090 6b732c31 2c4d6963 726f466f 6375732c  ks,1,MicroFocus,
 d40a0 7368696d 2c31352e 372c6874 7470733a  shim,15.7,https:
 d40b0 2f2f7777 772e6d69 63726f66 6f637573  //www.microfocus
 d40c0 2e636f6d 2f0a                        .com/.          

shimx64.efi:     file format pei-x86-64

Contents of section .sbatlevel:
 88000 00000000 08000000 22000000 73626174  ........"...sbat
 88010 2c312c32 30323230 35323430 300a6772  ,1,2022052400.gr
 88020 75622c32 0a007362 61742c31 2c323032  ub,2..sbat,1,202
 88030 32313131 3530300a 7368696d 2c320a67  2111500.shim,2.g
 88040 7275622c 330a00                      rub,3..

shimx64.efi


shimia32.efi:     file format pei-i386

Contents of section .sbat:
 a3000 73626174 2c312c53 42415420 56657273  sbat,1,SBAT Vers
 a3010 696f6e2c 73626174 2c312c68 74747073  ion,sbat,1,https
 a3020 3a2f2f67 69746875 622e636f 6d2f7268  ://github.com/rh
 a3030 626f6f74 2f736869 6d2f626c 6f622f6d  boot/shim/blob/m
 a3040 61696e2f 53424154 2e6d640a 7368696d  ain/SBAT.md.shim
 a3050 2c332c55 45464920 7368696d 2c736869  ,3,UEFI shim,shi
 a3060 6d2c312c 68747470 733a2f2f 67697468  m,1,https://gith
 a3070 75622e63 6f6d2f72 68626f6f 742f7368  ub.com/rhboot/sh
 a3080 696d0a73 68696d2e 4d465a45 4e776f72  im.shim.MFZENwor
 a3090 6b732c31 2c4d6963 726f466f 6375732c  ks,1,MicroFocus,
 a30a0 7368696d 2c31352e 372c6874 7470733a  shim,15.7,https:
 a30b0 2f2f7777 772e6d69 63726f66 6f637573  //www.microfocus
 a30c0 2e636f6d 2f0a                        .com/.          

shimia32.efi:     file format pei-i386

Contents of section .sbatlevel:
 71000 00000000 08000000 22000000 73626174  ........"...sbat
 71010 2c312c32 30323230 35323430 300a6772  ,1,2022052400.gr
 71020 75622c32 0a007362 61742c31 2c323032  ub,2..sbat,1,202
 71030 32313131 3530300a 7368696d 2c320a67  2111500.shim,2.g
 71040 7275622c 330a00                      rub,3..         
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.MFZENworks,1,MicroFocus,shim,15.7,https://www.microfocus.com/

Certificate:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fc:dc:0d:af:d2:cf:c3:bc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Micro Focus
        Validity
            Not Before: Apr 14 00:13:05 2021 GMT
            Not After : Apr 12 00:13:05 2031 GMT
        Subject: CN = Micro Focus
        Subject Public Key Info:
THS-on commented 9 months ago

@ClaudioGranatiero-10zig thanks for taking a look. Marking now as accepted

THS-on commented 7 months ago

What is the status of this? Did you get a signed shim back or are you creating a new submission for 15.8?

MuthuvelKuppusamy commented 7 months ago

We are going to submit the new request for 15.8.