loader: ignore some variable settings if input unverified

[sjg]

Summary

libsecureboot can tell us if the most recent file opened was
verfied or not.
If it's state is VE_UNVERIFIED_OK, skip if variable
matches one of the restricted prefixes.

[sjg]

This change prevents an unverified loader.conf from setting sensitive values

[kd]

How about the "chain" command?
Files loaded by it bypass verification, so we might to fix it by adding a hook to the veriexec instead.

[sjg]

In D20909#453326, @mindal_semihalf.com wrote:

How about the "chain" command?
Files loaded by it bypass verification, so we might to fix it by adding a hook to the veriexec instead.

Sorry not familiar with that one.
Got a pointer?
Also that would be a separate change no?

[kd]

In D20909#453439, @sjg wrote:

In D20909#453326, @mindal_semihalf.com wrote:

How about the "chain" command?
Files loaded by it bypass verification, so we might to fix it by adding a hook to the veriexec instead.

Sorry not familiar with that one.
Got a pointer?
Also that would be a separate change no?

Take a look at i386/loader/chain.c, or for EFI version efi/loader/main.c:1418.
On EFI system I was able to chainload an EFI Shell without including any information about it in the manifest.
Accidentally the EFI version of chain command uses LoadImage/StartImage calls, which means that with Secure Boot enabled in firmware the binary will be verified there.

[sjg]

Take a look at i386/loader/chain.c, or for EFI version efi/loader/main.c:1418.
On EFI system I was able to chainload an EFI Shell without including any information about it in the manifest.
Accidentally the EFI version of chain command uses LoadImage/StartImage calls, which means that with Secure Boot enabled in firmware the binary will be verified there.

Ok that chain.c must be more recent than stable/11. I'm not clear on where a verify_file check would make sense.
If you have a clue, feel free to have a go at it.

[stevek]

If additional things are found necessary to be added to the list (or handled otherwise), they can be added after the fact. But this gets the ball rolling and is definitely needed.