1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
// -*- Mode: Go; indent-tabs-mode: t -*-
/*
* Copyright (C) 2024 Canonical Ltd
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 3 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
package daemon
import (
"encoding/base64"
"encoding/json"
"errors"
"fmt"
"net/http"
"github.com/snapcore/snapd/overlord/auth"
"github.com/snapcore/snapd/overlord/fdestate"
)
var systemSecurebootCmd = &Command{
// TODO:FDEM: GET returning whether secure boot is relevant for the system?
Path: "/v2/system-secureboot",
POST: postSystemSecurebootAction,
WriteAccess: interfaceProviderRootAccess{
// TODO:FDEM: find a specialized interface for this, but for now assume that
// requests will come only from snaps plugging fwupd interface on the
// slot side, which also allows manipulation of EFI variables
Interfaces: []string{"fwupd"},
},
}
func postSystemSecurebootAction(c *Command, r *http.Request, user *auth.UserState) Response {
contentType := r.Header.Get("Content-Type")
switch contentType {
case "application/json":
return postSystemSecurebootActionJSON(c, r)
default:
return BadRequest("unexpected content type: %q", contentType)
}
}
type securebootRequest struct {
Action string `json:"action,omitempty"`
// Payload is a base64 encoded binary blob, is used in
// efi-secureboot-db-prepare action, and carries the DBX update content. The
// blob is in the range from few kB to tens of kBs
Payload string `json:"payload,omitempty"`
// KeyDatabase is used with efi-secureboot-db-prepare action, and indicates the
// secureboot keys database which is a target of the action, possible values are
// PK, KEK, DB, DBX
KeyDatabase string `json:"key-database,omitempty"`
}
func (r *securebootRequest) Validate() error {
switch r.Action {
case "efi-secureboot-update-startup", "efi-secureboot-update-db-cleanup":
if r.KeyDatabase != "" {
return fmt.Errorf("unexpected key database for action %q", r.Action)
}
if len(r.Payload) > 0 {
return fmt.Errorf("unexpected payload for action %q", r.Action)
}
case "efi-secureboot-update-db-prepare":
switch r.KeyDatabase {
case "PK", "KEK", "DB", "DBX":
default:
return fmt.Errorf("invalid key database %q", r.KeyDatabase)
}
if len(r.Payload) == 0 {
return errors.New("update payload not provided")
}
default:
return fmt.Errorf("unsupported EFI secure boot action %q", r.Action)
}
return nil
}
func postSystemSecurebootActionJSON(c *Command, r *http.Request) Response {
var req securebootRequest
decoder := json.NewDecoder(r.Body)
if err := decoder.Decode(&req); err != nil {
return BadRequest("cannot decode request body: %v", err)
}
if decoder.More() {
return BadRequest("extra content found in request body")
}
if err := req.Validate(); err != nil {
return BadRequest(err.Error())
}
switch req.Action {
case "efi-secureboot-update-startup":
return postSystemActionEFISecurebootUpdateStartup(c)
case "efi-secureboot-update-db-cleanup":
return postSystemActionEFISecurebootUpdateDBCleanup(c)
case "efi-secureboot-update-db-prepare":
return postSystemActionEFISecurebootUpdateDBPrepare(c, &req)
default:
return InternalError("support for EFI secure boot action %q is not implemented", req.Action)
}
}
var fdestateEFISecureBootDBUpdatePrepare = fdestate.EFISecureBootDBUpdatePrepare
func postSystemActionEFISecurebootUpdateDBPrepare(c *Command, req *securebootRequest) Response {
if req.KeyDatabase != "DBX" {
return InternalError("support for key database %q is not implemented", req.KeyDatabase)
}
payload, err := base64.StdEncoding.DecodeString(req.Payload)
if err != nil {
return BadRequest("cannot decode payload: %v", err)
}
err = fdestateEFISecureBootDBUpdatePrepare(c.d.state,
fdestate.EFISecurebootDBX, // only DBX updates are supported
payload)
if err != nil {
return BadRequest("cannot notify of update prepare: %v", err)
}
return SyncResponse(nil)
}
var fdestateEFISecureBootDBUpdateCleanup = fdestate.EFISecureBootDBUpdateCleanup
func postSystemActionEFISecurebootUpdateDBCleanup(c *Command) Response {
if err := fdestateEFISecureBootDBUpdateCleanup(c.d.state); err != nil {
return BadRequest("cannot notify of update cleanup: %v", err)
}
return SyncResponse(nil)
}
var fdestateEFISecureBootDBManagerStartup = fdestate.EFISecureBootDBManagerStartup
func postSystemActionEFISecurebootUpdateStartup(c *Command) Response {
if err := fdestateEFISecureBootDBManagerStartup(c.d.state); err != nil {
return BadRequest("cannot notify of manager startup: %v", err)
}
return SyncResponse(nil)
}
|
