ff1edd9752
When creating the core image with an unaligned appended signature size,
e.g. 479, for PowerPC, the grub-mkimage aligns the appended signature
size to a multiple of 4 bytes, but it does not add a padding needed to
align to multiple of 4 bytes appended signature size in the appended
signature ELF note. Therefore, after signing and installing this core
image, the firmware tries to read the magic string "~Module signature
appended~" from the appended signature ELF note but gets the partial
magic string like "Module signature appended~". It leads to the appended
signature magic string match failure.
Example:
grub-mkimage -O powerpc-ieee1275 -o core.elf -p /grub -x \
kernel.der --appended-signature-size 479 ...
sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed
Without padding: hexdump -C ./core.elf.signed
...
00383550 00 00 00 13 00 00 01 e0 41 53 69 67 41 70 70 65 |........ASigAppe|
00383560 6e 64 65 64 2d 53 69 67 6e 61 74 75 72 65 00 00 |nded-Signature..|
...
003836f0 dd 47 cd ed 02 8e 15 af 5b 09 2e 44 6f da 67 88 |.G......[..Do.g.|
00383700 4d 94 17 31 26 9d 47 95 d8 7c ad 36 00 d2 9c 53 |M..1&.G..|.6...S|
00383710 20 e0 af 60 78 cd 22 e6 ed 45 1e b1 e7 7e cf b5 | ..`x."..E...~..|
00383720 fc 58 ec df 1b ab 7a 00 00 02 00 00 00 00 00 00 |.X....z.........|
00383730 00 01 b7 7e 4d 6f 64 75 6c 65 20 73 69 67 6e 61 |...~Module signa|
00383740 74 75 72 65 20 61 70 70 65 6e 64 65 64 7e 0a |ture appended~.|
Fix this by adding a padding required to align appended signature size in the
appended signature ELF note to multiple of 4 bytes.
Example:
grub-mkimage -O powerpc-ieee1275 -o core.elf -p /grub -x \
kernel.der --appended-signature-size 479 ...
sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed
With padding: hexdump -C ./core.elf.signed
...
00137460 62 00 00 00 00 00 00 13 00 00 01 ec 41 53 69 67 |b...........ASig|
00137470 41 70 70 65 6e 64 65 64 2d 53 69 67 6e 61 74 75 |Appended-Signatu|
...
00137610 b7 07 cd b6 c8 ca 9a 5b 7c 13 8c 75 1d 1c 54 81 |.......[|..u..T.|
00137620 7f c4 9a 8b bd d7 73 8d 2f 7d d2 e6 d1 3c 52 a9 |......s./}...<R.|
00137630 4e 0b e5 24 ba 0a 82 aa 8e c5 86 fa e1 19 50 ec |N..$..........P.|
00137640 9f a7 9a ed e5 ed 13 35 00 00 02 00 00 00 00 00 |.......5........|
00137650 00 00 01 c2 7e 4d 6f 64 75 6c 65 20 73 69 67 6e |....~Module sign|
00137660 61 74 75 72 65 20 61 70 70 65 6e 64 65 64 7e 0a |ature appended~.|
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This is GRUB 2, the second version of the GRand Unified Bootloader. GRUB 2 is rewritten from scratch to make GNU GRUB cleaner, safer, more robust, more powerful, and more portable. See the file NEWS for a description of recent changes to GRUB 2. See the file INSTALL for instructions on how to build and install the GRUB 2 data and program files. See the file MAINTAINERS for information about the GRUB maintainers, etc. If you found a security vulnerability in the GRUB please check the SECURITY file to get more information how to properly report this kind of bugs to the maintainers. Please visit the official web page of GRUB 2, for more information. The URL is <http://www.gnu.org/software/grub/grub.html>. More extensive documentation is available in the Info manual, accessible using 'info grub' after building and installing GRUB 2. There are a number of important user-visible differences from the first version of GRUB, now known as GRUB Legacy. For a summary, please see: info grub Introduction 'Changes from GRUB Legacy'