VirtualBox

Changeset 99536 in vbox


Ignore:
Timestamp:
Apr 26, 2023 7:04:57 PM (19 months ago)
Author:
vboxsync
Message:

Linux: rcvboxdrv, rcvboxadd: Improved condition check when kernel modules need to be signed, bugref:10287.

Also fixed issue with parsing kernel config when scripts/config tool is not available.

Location:
trunk/src/VBox
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/Additions/linux/installer/vboxadd.sh

    r99525 r99536  
    397397kernel_get_config_opt()
    398398{
    399     opt_name="$1"
     399    kern_ver="$1"
     400    opt_name="$2"
     401
     402    [ -n "$kern_ver" ] || return
    400403    [ -n "$opt_name" ] || return
    401404
    402405    # Check if there is a kernel tool which can extract config option.
    403     if test -x /lib/modules/"$KERN_VER"/build/scripts/config; then
    404         /lib/modules/"$KERN_VER"/build/scripts/config \
    405             --file /lib/modules/"$KERN_VER"/build/.config \
     406    if test -x /lib/modules/"$kern_ver"/build/scripts/config; then
     407        /lib/modules/"$kern_ver"/build/scripts/config \
     408            --file /lib/modules/"$kern_ver"/build/.config \
    406409            --state "$opt_name" 2>/dev/null
    407     elif test -f /lib/modules/"$KERN_VER"/build/.config; then
     410    elif test -f /lib/modules/"$kern_ver"/build/.config; then
    408411        # Extract config option manually.
    409         grep "$opt_name" /lib/modules/"$KERN_VER"/build/.config | sed -e "s/^$opt_name=//" -e "s/\"//g"
     412        grep "$opt_name=" /lib/modules/"$kern_ver"/build/.config | sed -e "s/^$opt_name=//" -e "s/\"//g"
    410413    fi
    411414}
    … …  
    414417kernel_module_sig_hash()
    415418{
    416     kernel_get_config_opt "CONFIG_MODULE_SIG_HASH"
     419    kern_ver="$1"
     420    [ -n "$kern_ver" ] || return
     421
     422    kernel_get_config_opt "$kern_ver" "CONFIG_MODULE_SIG_HASH"
    417423}
    418424
    … …  
    434440}
    435441
     442# Check if kernel configuration requires modules signature.
     443kernel_requires_module_signature()
     444{
     445    kern_ver="$1"
     446    vbox_sys_lockdown_path="/sys/kernel/security/lockdown"
     447
     448    [ -n "$kern_ver" ] || return
     449
     450    requires=""
     451    # We consider that if kernel is running in the following configurations,
     452    # it will require modules to be signed.
     453    if [ "$(kernel_get_config_opt "$kern_ver" "CONFIG_MODULE_SIG")" = "y" ]; then
     454
     455        # Modules signature verification is hardcoded in kernel config.
     456        [ "$(kernel_get_config_opt "$kern_ver" "CONFIG_MODULE_SIG_FORCE")" = "y" ] && requires="1"
     457
     458        # Unsigned modules loading is restricted by "lockdown" feature in runtime.
     459        if [   "$(kernel_get_config_opt "$kern_ver" "CONFIG_SECURITY_LOCKDOWN_LSM")" = "y" \
     460            -o "$(kernel_get_config_opt "$kern_ver" "CONFIG_SECURITY_LOCKDOWN_LSM_EARLY")" = "y" ]; then
     461
     462            # Once lockdown level is set to something different from "none" (e.g., "integrity"
     463            # or "confidentiality"), kernel will reject unsigned modules loading.
     464            if [ -r "$vbox_sys_lockdown_path" ]; then
     465                [ -n "$(cat "$vbox_sys_lockdown_path" | grep "\[integrity\]")" ] && requires="1"
     466                [ -n "$(cat "$vbox_sys_lockdown_path" | grep "\[confidentiality\]")" ] && requires="1"
     467            fi
     468
     469            # This configuration is used by a number of modern Linux distributions and restricts
     470            # unsigned modules loading when Secure Boot mode is enabled.
     471            [ "$(kernel_get_config_opt "$kern_ver" "CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT")" = "y" -a -n "$HAVE_SEC_BOOT" ] && requires="1"
     472        fi
     473    fi
     474
     475    [ -n "$requires" ] && echo "1"
     476}
     477
    436478sign_modules()
    437479{
    … …  
    444486    [ -f "/lib/modules/"$KERN_VER"/misc/vboxvideo.ko" ] && MODULE_LIST="$MODULE_LIST vboxvideo"
    445487
    446     # Secure boot on Ubuntu, Debian and Oracle Linux.
    447     if test -n "$HAVE_SEC_BOOT"; then
     488    # Sign kernel modules if kernel configuration requires it.
     489    if test "$(kernel_requires_module_signature $KERN_VER)" = "1"; then
    448490        begin "Signing VirtualBox Guest Additions kernel modules"
    449491
    … …  
    475517
    476518        # Get kernel signature hash algorithm from kernel config and validate it.
    477         sig_hashalgo=$(kernel_module_sig_hash)
     519        sig_hashalgo=$(kernel_module_sig_hash "$KERN_VER")
    478520        [ "$(module_sig_hash_supported $sig_hashalgo)" = "1" ] \
    479521            || fail "Unsupported kernel signature hash algorithm $sig_hashalgo"
    … …  
    532574    # Detect if kernel was built with clang.
    533575    unset LLVM
    534     vbox_cc_is_clang=$(kernel_get_config_opt "CONFIG_CC_IS_CLANG")
     576    vbox_cc_is_clang=$(kernel_get_config_opt "$KERN_VER" "CONFIG_CC_IS_CLANG")
    535577    if test "${vbox_cc_is_clang}" = "y"; then
    536578        info "Using clang compiler."
    … …  
    795837    [ "$mod_dir" = "misc" ] || return
    796838
    797     # In case if system is running in Secure Boot mode, check if module is signed.
    798     if test -n "$HAVE_SEC_BOOT"; then
     839    # In case if kernel configuration (for currently loaded kernel) requires
     840    # module signature, check if module is signed.
     841    if test "$(kernel_requires_module_signature $(uname -r))" = "1"; then
    799842        [ "$(module_signed "$mod")" = "1" ] || return
    800843    fi
    … …  
    903946
    904947    # Warn if Secure Boot setup not yet complete.
    905     if test -n "$HAVE_SEC_BOOT" && test -z "$DEB_KEY_ENROLLED"; then
     948    if test "$(kernel_requires_module_signature)" = "1" && test -z "$DEB_KEY_ENROLLED"; then
    906949        if test -n "$HAVE_DEB_KEY"; then
    907950            info "You must re-start your system to finish secure boot set-up."

  • trunk/src/VBox/Installer/linux/vboxdrv.sh

    r98565 r99536  
    355355    elif test -f /lib/modules/"$KERN_VER"/build/.config; then
    356356        # Extract config option manually.
    357         grep "$opt_name" /lib/modules/"$KERN_VER"/build/.config | sed -e "s/^$opt_name=//" -e "s/\"//g"
     357        grep "$opt_name=" /lib/modules/"$KERN_VER"/build/.config | sed -e "s/^$opt_name=//" -e "s/\"//g"
    358358    fi
    359359}
    … …  
    380380
    381381    echo "1"
     382}
     383
     384# Check if kernel configuration requires modules signature.
     385kernel_requires_module_signature()
     386{
     387    vbox_sys_lockdown_path="/sys/kernel/security/lockdown"
     388
     389    requires=""
     390    # We consider that if kernel is running in the following configurations,
     391    # it will require modules to be signed.
     392    if [ "$(kernel_get_config_opt "CONFIG_MODULE_SIG")" = "y" ]; then
     393
     394        # Modules signature verification is hardcoded in kernel config.
     395        [ "$(kernel_get_config_opt "CONFIG_MODULE_SIG_FORCE")" = "y" ] && requires="1"
     396
     397        # Unsigned modules loading is restricted by "lockdown" feature in runtime.
     398        if [   "$(kernel_get_config_opt "CONFIG_SECURITY_LOCKDOWN_LSM")" = "y" \
     399            -o "$(kernel_get_config_opt "CONFIG_SECURITY_LOCKDOWN_LSM_EARLY")" = "y" ]; then
     400
     401            # Once lockdown level is set to something different than "none" (e.g., "integrity"
     402            # or "confidentiality"), kernel will reject unsigned modules loading.
     403            if [ -r "$vbox_sys_lockdown_path" ]; then
     404                [ -n "$(cat "$vbox_sys_lockdown_path" | grep "\[integrity\]")" ] && requires="1"
     405                [ -n "$(cat "$vbox_sys_lockdown_path" | grep "\[confidentiality\]")" ] && requires="1"
     406            fi
     407
     408            # This configuration is used by a number of modern Linux distributions and restricts
     409            # unsigned modules loading when Secure Boot mode is enabled.
     410            [ "$(kernel_get_config_opt "CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT")" = "y" -a -n "$HAVE_SEC_BOOT" ] && requires="1"
     411        fi
     412    fi
     413
     414    [ -n "$requires" ] && echo "1"
    382415}
    383416
    … …  
    467500    [ "$mod_dir" = "misc" ] || return
    468501
    469     # In case if system is running in Secure Boot mode, check if module is signed.
    470     if test -n "$HAVE_SEC_BOOT"; then
     502    # In case if kernel configuration requires module signature, check if module is signed.
     503    if test "$(kernel_requires_module_signature)" = "1"; then
    471504        [ "$(module_signed "$mod")" = "1" ] || return
    472505    fi
    … …  
    492525        failure "Running VirtualBox in a Xen environment is not supported"
    493526    fi
    494     if test -n "$HAVE_SEC_BOOT" && test -z "$DEB_KEY_ENROLLED"; then
     527    if test "$(kernel_requires_module_signature)" = "1" && test -z "$DEB_KEY_ENROLLED"; then
    495528        if test -n "$HAVE_DEB_KEY"; then
    496529            begin_msg "You must re-start your system to finish Debian secure boot set-up." console
    … …  
    553586    fi
    554587    # Create the /dev/vboxusb directory if the host supports that method
    555     # of USB access.  The USB code checks for the existance of that path.
     588    # of USB access.  The USB code checks for the existence of that path.
    556589    if grep -q usb_device /proc/devices; then
    557590        mkdir -p -m 0750 /dev/vboxusb 2>/dev/null
    … …  
    701734        failure "Look at $LOG to find out what went wrong"
    702735    fi
    703     log "Building the net adaptor module."
     736    log "Building the net adapter module."
    704737    if ! myerr=`$BUILDINTMP \
    705738        --use-module-symvers /tmp/vboxdrv-Module.symvers \
    … …  
    726759    succ_msg "VirtualBox kernel modules built"
    727760
    728     # Secure boot on Ubuntu, Debian and Oracle Linux.
    729     if test -n "$HAVE_SEC_BOOT"; then
     761    # Sign kernel modules if kernel configuration requires it.
     762    if test "$(kernel_requires_module_signature)" = "1"; then
    730763        begin_msg "Signing VirtualBox kernel modules" console
    731764
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette