Re: grub-mkrescue with pgp --pubkey might be broken in grub 2.12 on EFI

[Andrei Borzenkov]

On 07.03.2024 22:40, Reto Buerki wrote:
> Hi,
>
> I'm using grub-mkrescue in combination with the pgp --pubkey feature to
> put grub into check_signatures=enforce mode, and to only have signed
> data loaded and processed. Something like:
>
> grub-mkrescue --modules='normal pgp' -o test.iso
> boot/grub/grub.cfg=grub.cfg boot/grub/grub.cfg.sig=grub.cfg.sig --pubkey
> testkey.pub
>
> This used to work with GRUB 2.06 for both efi-x86_64 and pc-i386. With
> GRUB 2.12 however, efi-x86_64 does no longer work.
>
> I traced the problem by omitting the --pubkey argument to grub-mkrescue.
>
> It seems that with GRUB 2.12 a special file is used to determine root,
> e.g. '(hd0)/.disk/2024-03-07-18-32-41-00.uuid'. This can be seen in the
> attached backtrace starting from grub_env_write_root where the correct
> root is set in the check_signatures=no configuration.
>
> The relevant information in the backtrace is the command used to find
> and set root:
>
> search --set=root --file /.disk/2024-03-07-17-16-00-00.uuid
>
> This correctly sets root to (hd0), whereas with the --pubkey argument,
> root remains at (hd0,gpt2) (i.e. fwdevice). The problem seems to be that
> this file is not signed, so grub cannot open it. This results in the
> following error:
>
> error: no such device: /.disk/2024-03-07-19-09-45-00.uuid.
>
> The file is visible via the grub console however, but 'ls' on it returns:
>
> error: not a directory.
>
> Is this a bug/regression?

Both. It is regression because the same configuration worked in teh 
earlier version and it is a bug which was revealed by the code change in 
2.12.

The 2.06 used search by UUID to find its boot device. 2.12 was changed 
to search for a token file under some platforms:

Author: Pete Batard <pete@akeo.ie>
Date:   Fri Nov 25 17:22:17 2022 +0000

    util/grub-mkrescue: Search by file UUID rather than partition UUID 
for EFI boot

but the code that verifies signatures was only adjusted for Secure Boot 
verifier:

grub-core/commands/search.c:iterate_device()
...
      file = grub_file_open (buf, GRUB_FILE_TYPE_FS_SEARCH
                             | GRUB_FILE_TYPE_NO_DECOMPRESS);
...


grub-core/kern/efi/sb.c:shim_lock_verifier_init()
...
  switch (type & GRUB_FILE_TYPE_MASK)
    {
...
    case GRUB_FILE_TYPE_FS_SEARCH:
...
      *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
      return GRUB_ERR_NONE;



But PGP verifier does not have any special handling for different filetypes.

Arguably, at least in this case the check should be in the verifier 
framework itself and not pushed down into individual verifier.