Shim 15.8 for ZeronsoftN (patch added)

[joseph-zeronsoftn]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/zeronsoftn/shim-review/tree/zeronsoftn-shim-x86_64_ia32_aarch64-20240730

---

What is the SHA256 hash of your final SHIM binary?

---

43989d3a59ff074ec9013cc000797f2139cf9fa24b30f38fee415d4daa0a41c0  shimaa64.efi
6c0c1b656c382823c9fe37110f0bf484783aa55db380664437654020fa33150b  shimia32.efi
6d47d6e3949084b7a93c4c9332ced82ad58e985ff6431e172af12072ab3d5490  shimx64.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#408

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

no changed: #408

REVIEW HELPER

https://github.com/jclab-joseph/other-shim-reviews.git can help you for review.

$ git clone https://github.com/jclab-joseph/other-shim-reviews.git
$ cd other-shim-reviews
$ ./clone.sh https://github.com/zeronsoftn/shim-review/tree/zeronsoftn-shim-x86_64_ia32_aarch64-20240730

[THS-on]

This is currently blocked on the patches getting reviewed upstream. I'll try to ping people to have a look at it.

[steve-mcintyre]

@vathpela could you take a look at the patches here please?

[steve-mcintyre]

@vathpela ping?

[vathpela]

I don't have a problem with any of these patches.

[af-kulow]

Helper Review for ZeronsoftN shim-x86_64_ia32_aarch64-20240730

Build is reproducible:

Step 18/19 : RUN for name in $(find /work/output/ -type f -name "shim*.efi"); do echo "PESIGN($name): "; pesign --hash --padding --in=$name; echo "SHA256SUM:"; sha256sum $name; echo; done
 ---> Running in 413fa22c1901
PESIGN(/work/output/aarch64/boot/efi/EFI/ZeronsoftN/shimaa64.efi):
hash: 31e4dda42082535ef244918bb3386627f7f6d5fdd6c1eb71e10d6a7b667ff997
SHA256SUM:
43989d3a59ff074ec9013cc000797f2139cf9fa24b30f38fee415d4daa0a41c0  /work/output/aarch64/boot/efi/EFI/ZeronsoftN/shimaa64.efi

PESIGN(/work/output/ia32/boot/efi/EFI/ZeronsoftN/shimia32.efi):
hash: c23c3178cbe4ded0946382826b3314285d26274e781e413deafe528acb57b67d
SHA256SUM:
6c0c1b656c382823c9fe37110f0bf484783aa55db380664437654020fa33150b  /work/output/ia32/boot/efi/EFI/ZeronsoftN/shimia32.efi

PESIGN(/work/output/x86_64/boot/efi/EFI/ZeronsoftN/shimx64.efi):
hash: 497e26d477aa5b8895a47a17357461bab629ae19477baf55ae6847c77bca931a
SHA256SUM:
6d47d6e3949084b7a93c4c9332ced82ad58e985ff6431e172af12072ab3d5490  /work/output/x86_64/boot/efi/EFI/ZeronsoftN/shimx64.efi

Removing intermediate container 413fa22c1901
 ---> b7b090b396a0
Step 19/19 : RUN echo "::review hash-start" &&     for name in $(find /work/output/ -type f -name "shim*.efi"); do sha256sum $name; done &&     echo "::review hash-end"
 ---> Running in cbfa685f1f6a
::review hash-start
43989d3a59ff074ec9013cc000797f2139cf9fa24b30f38fee415d4daa0a41c0  /work/output/aarch64/boot/efi/EFI/ZeronsoftN/shimaa64.efi
6c0c1b656c382823c9fe37110f0bf484783aa55db380664437654020fa33150b  /work/output/ia32/boot/efi/EFI/ZeronsoftN/shimia32.efi
6d47d6e3949084b7a93c4c9332ced82ad58e985ff6431e172af12072ab3d5490  /work/output/x86_64/boot/efi/EFI/ZeronsoftN/shimx64.efi
::review hash-end
Removing intermediate container cbfa685f1f6a
 ---> e44ecafbab20
Successfully built e44ecafbab20

NX is not set:

objdump -x shimx64.efi | grep DllCharacteristics
DllCharacteristics	00000000
objdump -x shimia32.efi | grep DllCharacteristics
DllCharacteristics	00000000
aarch64-linux-gnu-objdump -x shimaa64.efi | grep DllCharacteristics
DllCharacteristics	00000000

SBAT sections:

$ objcopy --only-section .sbat -O binary shimx64.efi /dev/stdout
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.zeronsoftn,1,ZeronsoftN,shim,15.8-0zeron2,https://github.com/zeronsoftn/shim-release

$ objcopy --only-section .sbat -O binary shimia32.efi /dev/stdout
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.zeronsoftn,1,ZeronsoftN,shim,15.8-0zeron2,https://github.com/zeronsoftn/shim-release

$ aarch64-linux-gnu-objcopy --only-section .sbat -O binary shimaa64.efi /dev/stdout
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.zeronsoftn,1,ZeronsoftN,shim,15.8-0zeron2,https://github.com/zeronsoftn/shim-release

matches the section mentioned in the request.

Patch 0004

approved here: #621

UEFI SecureBoot Kernel Lockdown patches - 1 Finding

Found the activated LOCKDOWN config options:

CONFIG_SECURITY_LOCKDOWN_LSM=y
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y

here: x86_64 config aarch64 config

but this worries me: patch 0008

specifically:

@@ -1388,6 +1389,11 @@ static inline int security_locked_down(e
 {
 	return 0;
 }
+static inline int
+lock_kernel_down(const char *where, enum lockdown_reason level)
+{
+	return -EOPNOTSUPP;
+}

this lock down function looks like a no-op to me.

Kernel upstream looks different, and also includes the function for lockdown in security/lockdown.c. Can you please double check that?

Certficate

$ openssl x509 -noout -inform DER -in vendor_cert.der -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7230298064905535070 (0x64572dc842e37e5e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = ZeronsoftN CA, O = ZeronsoftN, C = KR
        Validity
            Not Before: Jun 27 04:35:17 2022 GMT
            Not After : Jun 25 04:35:17 2029 GMT
        Subject: CN = ZeronsoftN Secure Boot Signing (2022), OU = Secure Boot, O = ZeronsoftN, C = KR
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
       ...
    X509v3 extensions:
        X509v3 Subject Key Identifier:
            08:16:0B:68:89:6D:A7:F9:3E:81:18:5B:36:F8:7E:6F:47:4B:DE:52
        X509v3 Basic Constraints: critical
            CA:FALSE

• valid 7 years
• RSA 2048
• CA is false.

[jclab-joseph]

@af-kulow Thank you for your review.

patch 0008 is same as https://sources.debian.org/src/linux/6.6.13-1~bpo12%2B1/debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch/

The dummy function is only for when CONFIG_SECURITY is false.

[af-kulow]

I see. That was not visible from the patch itself, so I wanted to make sure. No further questions on that then. Thank you for the quick response.

[lorddoskias]

• Build is reproducible:

#18 [14/14] RUN echo "::review hash-start" &&     for name in $(find /work/output/ -type f -name "shim*.efi"); do sha256sum $name; done &&     echo "::review hash-end"
#18 0.183 ::review hash-start
#18 0.199 43989d3a59ff074ec9013cc000797f2139cf9fa24b30f38fee415d4daa0a41c0  /work/output/aarch64/boot/efi/EFI/ZeronsoftN/shimaa64.efi
#18 0.201 6c0c1b656c382823c9fe37110f0bf484783aa55db380664437654020fa33150b  /work/output/ia32/boot/efi/EFI/ZeronsoftN/shimia32.efi
#18 0.207 6d47d6e3949084b7a93c4c9332ced82ad58e985ff6431e172af12072ab3d5490  /work/output/x86_64/boot/efi/EFI/ZeronsoftN/shimx64.efi
#18 0.207 ::review hash-end

• The sources used for building are the upstream 15.8 and the hash inside the docker file is checked against the well-known sha256 sum

• Certificate seem sane, however the CA flag is indeed not set:

 Issuer: CN = ZeronsoftN CA, O = ZeronsoftN, C = KR
        Validity
            Not Before: Jun 27 04:35:17 2022 GMT
            Not After : Jun 25 04:35:17 2029 GMT
        Subject: CN = ZeronsoftN Secure Boot Signing (2022), OU = Secure Boot, O = ZeronsoftN, C = KR
...
X509v3 Basic Constraints: critical
                CA:FALSE

• The signing keys are being protected via an HSM
• sbat for shim/grub/systemd look sane.
• grub2 modules look sane as well
• nxcompat is not set:

objdump -x review/shimx64.efi | grep -E 'DllCharacteristics'
DllCharacteristics	00000000