Differential D18799 Diff 52829 usr.sbin/binsign/binsign.8

Changeset View

Standalone View

usr.sbin/binsign/binsign.8

This file was added.

				.\"
				.\" Copyright (c) 2019 Stormshield.
				0mpUnsubmitted Not Done Inline Actions I am not sure if it is important, but it's missing the SPDX tag. 0mp: I am not sure if it is important, but it's missing the SPDX tag.
				.\" Copyright (c) 2019 Semihalf.
				.\"
				.\" Redistribution and use in source and binary forms, with or without
				0mpUnsubmitted Not Done Inline Actions No longer needed. See D15370 for example. 0mp: No longer needed. See D15370 for example.
				.\" modification, are permitted provided that the following conditions
				.\" are met:
				.\" 1. Redistributions of source code must retain the above copyright
				.\" notice, this list of conditions and the following disclaimer.
				.\" 2. Redistributions in binary form must reproduce the above copyright
				.\" notice, this list of conditions and the following disclaimer in the
				.\" documentation and/or other materials provided with the distribution.
				.\"
				.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
				.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
				.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
				.\" DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
				.\" INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
				.\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
				.\" SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
				.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
				.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
				.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
				.\" POSSIBILITY OF SUCH DAMAGE.
				.\"
				.\"$FreeBSD$
				.Dd January 10, 2019
				0mpUnsubmitted Not Done Inline Actions Missing $FreeBSD$ 0mp: Missing $FreeBSD$
				.Dt BINSIGN 8
				.Os
				.Sh NAME
				.Nm binsign
				.Nd Secure Boot signing utility
				.Sh SYNOPSIS
				.Nm
				.Fl c Ar cert
				.Fl k Ar key
				.Op Fl o Ar output
				.Ar file
				.Sh DESCRIPTION
				The
				.Nm
				utility signs any type of file by appending a signature in PKCS#1 v1.5 standard
				together with a certificate used for the signing to its end.
				emasteUnsubmitted Not Done Inline Actions So the result is an ELF file with extra stuff tacked on the end. How do existing tools (kernel, rtld, readelf, objcopy, etc.) treat this? emaste: So the result is an ELF file with extra stuff tacked on the end. How do existing tools (kernel…
				kdAuthorUnsubmitted Not Done Inline Actions Yes, that's essentially how it works. So far it seems that it doesn't break anything, that is signed files are loading and working properly. The readelf tool also processes them without complaining. Having said that the "cleaner" solution would be to create a new section, lets say ".signature" and store it there. The problem is that it would complicate the code and bear in mind that we have to process said signature in loader. Integrating a new library(probably libelf) with the loader would most likely be problematic. kd: Yes, that's essentially how it works. So far it seems that it doesn't break anything, that is…
				.Pp
				0mpUnsubmitted Not Done Inline Actions `.Xr loader 8` instead of `Loader`? Also, should we describe how to configure the loader? 0mp: `.Xr loader 8` instead of `Loader`? Also, should we describe how to configure the loader?
				It is different from
				.Xr uefisign 8
				in that the former is used to sign PE binaries that are supposed to be verified
				and run directly by
				.Xr UEFI 8
				.Pp
				.Xr loader 8 can be configured by to verify the kernel and modules integrity
				0mpUnsubmitted Not Done Inline Actions Could you have a look at `src/share/man/man5/style.mdoc.5` and try to format the examples sections similarly? 0mp: Could you have a look at `src/share/man/man5/style.mdoc.5` and try to format the examples…
				signed with this tool. To do that one needs to compile it with
				.Nm -MK_SECUREBOOT="yes"
				.Sh EXIT STATUS
				0mpUnsubmitted Not Done Inline Actions .Pa cert.key and .Pa cert.der 0mp: .Pa cert.key and .Pa cert.der
				The
				.Nm
				0mpUnsubmitted Not Done Inline Actions Would it be beneficial to reference the PKCS#1 v2 standard here? Similarly to how its done in CMSG_DATA(3) for example. 0mp: Would it be beneficial to reference the PKCS#1 v2 standard here? Similarly to how its done in…
				utility exits 0 on success, and 1 if an error occurs.
				0mpUnsubmitted Not Done Inline Actions It would be great to cross-reference this manual page from loader(8) and other related manuals (like uefisign(8) perhaps?). 0mp: It would be great to cross-reference this manual page from loader(8) and other related manuals…
				.Sh EXAMPLES
				.Bl -tag -width 0n
				.Pp
				.Li binsign -c cert.der -k cert.key file
				.Pp
				The
				.Pa cert.key
				and
				.Pa cert.der
				have to contain a DER encoded
				RSA private key and X509 certificate respectively, those can be generated with
				.Xr openssl 1
				.Sh SEE ALSO
				.Xr openssl 1
				.Xr loader 8
				.Xr uefisign 8
				.Xr UEFI 8
				.Sh STANDARDS
				.Bl -item
				.It
				.Rs
				.%A B. Kaliski
				.%T "PKCS #1: RSA Encryption Version 1.5"
				.%R RFC 2313
				.%D March 1998
				.Re
				.El
				.Sh HISTORY
				The
				.Nm
				command appeared in
				.Fx 13.0 .
				.Sh AUTHORS
				The
				.Nm
				utility was developed by
				.An Kornel Duleba Aq Mt mindal@semihalf.com
				under sponsorship from Stormshield.