|
HTML rendering created 2024-06-26 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|
|
NAME | SYNOPSIS | DESCRIPTION | COMPANION FILES | TPM PCR NOTES | EFI VARIABLES | INITRD RESOURCES | SMBIOS TYPE 11 STRINGS | ASSEMBLING KERNEL IMAGES | SEE ALSO | NOTES | COLOPHON |
|
|
|
SYSTEMD-STUB(7) systemd-stub SYSTEMD-STUB(7)
systemd-stub, sd-stub, linuxx64.efi.stub, linuxia32.efi.stub,
linuxaa64.efi.stub - A simple UEFI kernel boot stub
/usr/lib/systemd/boot/efi/linuxx64.efi.stub
/usr/lib/systemd/boot/efi/linuxia32.efi.stub
/usr/lib/systemd/boot/efi/linuxaa64.efi.stub
ESP/.../foo.efi.extra.d/*.addon.efi
ESP/.../foo.efi.extra.d/*.cred
ESP/.../foo.efi.extra.d/*.raw
ESP/.../foo.efi.extra.d/*.sysext.raw
ESP/.../foo.efi.extra.d/*.confext.raw
ESP/loader/addons/*.addon.efi
ESP/loader/credentials/*.cred
systemd-stub (stored in per-architecture files linuxx64.efi.stub,
linuxia32.efi.stub, linuxaa64.efi.stub on disk) is a simple UEFI
boot stub. An UEFI boot stub is attached to a Linux kernel binary
image, and is a piece of code that runs in the UEFI firmware
environment before transitioning into the Linux kernel
environment. The UEFI boot stub ensures a Linux kernel is
executable as regular UEFI binary, and is able to do various
preparations before switching the system into the Linux world.
The UEFI boot stub looks for various resources for the kernel
invocation inside the UEFI PE binary itself. This allows
combining various resources inside a single PE binary image
(usually called "Unified Kernel Image", or "UKI" for short),
which may then be signed via UEFI SecureBoot as a whole, covering
all individual resources at once. Specifically it may include:
• A ".linux" section with the ELF Linux kernel image.
• An ".osrel" section with OS release information, i.e. the
contents of the os-release(5) file of the OS the kernel
belongs to.
• A ".cmdline" section with the kernel command line to pass to
the invoked kernel.
• An ".initrd" section with the initrd.
• A ".ucode" section with an initrd containing microcode, to be
handed to the kernel before any other initrd. This initrd
must not be compressed.
• A ".splash" section with an image (in the Windows .BMP
format) to show on screen before invoking the kernel.
• A ".dtb" section with a compiled binary DeviceTree.
• A ".uname" section with the kernel version information, i.e.
the output of uname -r for the kernel included in the
".linux" section.
• An ".sbat" section with SBAT[1] revocation metadata.
• A ".pcrsig" section with a set of cryptographic signatures
for the expected TPM2 PCR values after the kernel has been
booted, in JSON format. This is useful for implementing TPM2
policies that bind disk encryption and similar to kernels
that are signed by a specific key.
• A ".pcrpkey" section with a public key in the PEM format
matching the signature data in the ".pcrsig" section.
If UEFI SecureBoot is enabled and the ".cmdline" section is
present in the executed image, any attempts to override the
kernel command line by passing one as invocation parameters to
the EFI binary are ignored. Thus, in order to allow overriding
the kernel command line, either disable UEFI SecureBoot, or don't
include a kernel command line PE section in the kernel image
file. If a command line is accepted via EFI invocation parameters
to the EFI binary it is measured into TPM PCR 12 (if a TPM is
present).
If a DeviceTree is embedded in the ".dtb" section, it replaces an
existing DeviceTree in the corresponding EFI configuration table.
systemd-stub will ask the firmware via the
"EFI_DT_FIXUP_PROTOCOL" for hardware specific fixups to the
DeviceTree.
The contents of eight of these nine sections are measured into
TPM PCR 11. It is otherwise not used and thus the result can be
pre-calculated without too much effort. The ".pcrsig" section is
not included in this PCR measurement, since it is supposed to
contain signatures for the output of the measurement operation,
and thus cannot also be input to it.
When ".pcrsig" and/or ".pcrpkey" sections are present in a
unified kernel image their contents are passed to the booted
kernel in an synthetic initrd cpio archive that places them in
the /.extra/tpm2-pcr-signature.json and
/.extra/tpm2-pcr-public-key.pem files. Typically, a tmpfiles.d(5)
line then ensures they are copied into
/run/systemd/tpm2-pcr-signature.json and
/run/systemd/tpm2-pcr-public-key.pem where they remain accessible
even after the system transitions out of the initrd environment
into the host file system. Tools such
[email protected](8), systemd-cryptenroll(1) and
systemd-creds(1) will automatically use files present under these
paths to unlock protected resources (encrypted storage or
credentials) or bind encryption to booted kernels.
For further details about the UKI concept, see the UKI
specification[2].
The systemd-stub UEFI boot stub automatically collects three
types of auxiliary companion files optionally placed in drop-in
directories on the same partition as the EFI binary, dynamically
generates cpio initrd archives from them, and passes them to the
kernel. Specifically:
• For a kernel binary called foo.efi, it will look for files
with the .cred suffix in a directory named foo.efi.extra.d/
next to it. If the kernel binary uses a counter for the
purpose of Automatic Boot Assessment[3], this counter will be
ignored. For example, foo+3-0.efi will look in directory
foo.efi.extra.d/. A cpio archive is generated from all files
found that way, placing them in the /.extra/credentials/
directory of the initrd file hierarchy. The main initrd may
then access them in this directory. This is supposed to be
used to store auxiliary, encrypted, authenticated credentials
for use with LoadCredentialEncrypted= in the UEFI System
Partition. See systemd.exec(5) and systemd-creds(1) for
details on encrypted credentials. The generated cpio archive
is measured into TPM PCR 12 (if a TPM is present).
• Similarly, files foo.efi.extra.d/*.sysext.raw are packed up
in a cpio archive and placed in the /.extra/sysext/ directory
in the initrd file hierarchy. This is supposed to be used to
pass additional system extension images to the initrd. See
systemd-sysext(8) for details on system extension images. The
generated cpio archive containing these system extension
images is measured into TPM PCR 13 (if a TPM is present).
• Similarly, files foo.efi.extra.d/*.confext.raw are packed up
in a cpio archive and placed in the /.extra/confext/
directory in the initrd file hierarchy. This is supposed to
be used to pass additional configuration extension images to
the initrd. See systemd-confext(8) for details on
configuration extension images. The generated cpio archive
containing these system extension images is measured into TPM
PCR 12 (if a TPM is present).
• Similarly, files foo.efi.extra.d/*.addon.efi are loaded and
verified as PE binaries, and a ".cmdline" section is parsed
from them. Addons are supposed to be used to pass additional
kernel command line parameters or Devicetree blobs,
regardless of the kernel image being booted, for example to
allow platform vendors to ship platform-specific
configuration.
In case Secure Boot is enabled, these files will be validated
using keys in UEFI DB, Shim's DB or Shim's MOK, and will be
rejected otherwise. Additionally, if both the addon and the
UKI contain a ".uname" section, the addon will be rejected if
they do not match exactly. It is recommended to always add a
".sbat" section to all signed addons, so that they may be
revoked with a SBAT policy update, without requiring
blocklisting via DBX/MOKX. The ukify(1) tool will add a SBAT
policy by default if none is passed when building addons. For
more information on SBAT see Shim documentation[1].
Addon files are sorted, loaded, and measured into TPM PCR 12
(if a TPM is present) and appended to the kernel command
line. UKI command line options are listed first, then options
from addons in /loader/addons/*.addon.efi, and finally
UKI-specific addons. Device tree blobs are loaded and
measured following the same algorithm. Addons are always
loaded in the same order based on the filename, so that,
given the same set of addons, the same set of measurements
can be expected in PCR12. However, note that the filename is
not protected by the PE signature, and as such an attacker
with write access to the ESP could potentially rename these
files to change the order in which they are loaded, in a way
that could alter the functionality of the kernel, as some
options might be order-dependent. If you sign such addons,
you should pay attention to the PCR12 values and make use of
an attestation service so that improper use of your signed
addons can be detected and dealt with using one of the
aforementioned revocation mechanisms.
• Files /loader/credentials/*.cred are packed up in a cpio
archive and placed in the /.extra/global_credentials/
directory of the initrd file hierarchy. This is supposed to
be used to pass additional credentials to the initrd,
regardless of the kernel being booted. The generated cpio
archive is measured into TPM PCR 12 (if a TPM is present).
• Additionally, files /loader/addons/*.addon.efi are loaded and
verified as PE binaries, and ".cmdline" and/or ".dtb"
sections are parsed from them. This is supposed to be used to
pass additional command line parameters or Devicetree blobs
to the kernel, regardless of the kernel being booted.
These mechanisms may be used to parameterize and extend trusted
(i.e. signed), immutable initrd images in a reasonably safe way:
all data they contain is measured into TPM PCRs. On access they
should be further validated: in case of the credentials case by
encrypting/authenticating them via TPM, as exposed by
systemd-creds encrypt -T (see systemd-creds(1) for details); in
case of the system extension images by using signed Verity
images.
Note that when a unified kernel using systemd-stub is invoked the
firmware will measure it as a whole to TPM PCR 4, covering all
embedded resources, such as the stub code itself, the core
kernel, the embedded initrd and kernel command line (see above
for a full list).
Also note that the Linux kernel will measure all initrds it
receives into TPM PCR 9. This means every type of initrd will be
measured two or three times: the initrds embedded in the kernel
image will be measured to PCR 4, PCR 9 and PCR 11; the initrd
synthesized from credentials (and the one synthesized from
configuration extensions) will be measured to both PCR 9 and PCR
12; the initrd synthesized from system extensions will be
measured to both PCR 4 and PCR 9. Let's summarize the OS
resources and the PCRs they are measured to:
Table 1. OS Resource PCR Summary
┌──────────────────────────┬─────────────────┐
│ OS Resource │ Measurement PCR │
├──────────────────────────┼─────────────────┤
│ systemd-stub code (the │ 4 │
│ entry point of the │ │
│ unified PE binary) │ │
├──────────────────────────┼─────────────────┤
│ Core kernel code │ 4 + 11 │
│ (embedded in unified PE │ │
│ binary) │ │
├──────────────────────────┼─────────────────┤
│ OS release information │ 4 + 11 │
│ (embedded in the unified │ │
│ PE binary) │ │
├──────────────────────────┼─────────────────┤
│ Main initrd (embedded in │ 4 + 9 + 11 │
│ unified PE binary) │ │
├──────────────────────────┼─────────────────┤
│ Microcode initrd │ 4 + 9 + 11 │
│ (embedded in unified PE │ │
│ binary) │ │
├──────────────────────────┼─────────────────┤
│ Default kernel command │ 4 + 11 │
│ line (embedded in │ │
│ unified PE binary) │ │
├──────────────────────────┼─────────────────┤
│ Overridden kernel │ 12 │
│ command line │ │
├──────────────────────────┼─────────────────┤
│ Boot splash (embedded in │ 4 + 11 │
│ the unified PE binary) │ │
├──────────────────────────┼─────────────────┤
│ TPM2 PCR signature JSON │ 4 + 9 │
│ (embedded in unified PE │ │
│ binary, synthesized into │ │
│ initrd) │ │
├──────────────────────────┼─────────────────┤
│ TPM2 PCR PEM public key │ 4 + 9 + 11 │
│ (embedded in unified PE │ │
│ binary, synthesized into │ │
│ initrd) │ │
├──────────────────────────┼─────────────────┤
│ Credentials (synthesized │ 9 + 12 │
│ initrd from companion │ │
│ files) │ │
├──────────────────────────┼─────────────────┤
│ System Extensions │ 9 + 13 │
│ (synthesized initrd from │ │
│ companion files) │ │
├──────────────────────────┼─────────────────┤
│ Configuration Extensions │ 9 + 12 │
│ (synthesized initrd from │ │
│ companion files) │ │
└──────────────────────────┴─────────────────┘
The following EFI variables are defined, set and read by
systemd-stub, under the vendor UUID
"4a67b082-0a4c-41cf-b6c7-440b29bb8c4f", for communication between
the boot stub and the OS:
LoaderDevicePartUUID
Contains the partition UUID of the EFI System Partition the
EFI image was run from. systemd-gpt-auto-generator(8) uses
this information to automatically find the disk booted from,
in order to discover various other partitions on the same
disk automatically.
Added in version 250.
LoaderFirmwareInfo, LoaderFirmwareType
Brief firmware information. Use bootctl(1) to view this data.
Added in version 250.
LoaderImageIdentifier
The path of EFI executable, relative to the EFI System
Partition's root directory. Use bootctl(1) to view this data.
Added in version 250.
StubInfo
Brief stub information. Use bootctl(1) to view this data.
Added in version 250.
StubPcrKernelImage
The PCR register index the kernel image, initrd image, boot
splash, devicetree database, and the embedded command line
are measured into, formatted as decimal ASCII string (e.g.
"11"). This variable is set if a measurement was successfully
completed, and remains unset otherwise.
Added in version 252.
StubPcrKernelParameters
The PCR register index the kernel command line and
credentials are measured into, formatted as decimal ASCII
string (e.g. "12"). This variable is set if a measurement
was successfully completed, and remains unset otherwise.
Added in version 252.
StubPcrInitRDSysExts
The PCR register index the system extensions for the initrd,
which are picked up from the file system the kernel image is
located on. Formatted as decimal ASCII string (e.g. "13").
This variable is set if a measurement was successfully
completed, and remains unset otherwise.
Added in version 252.
StubPcrInitRDConfExts
The PCR register index the configuration extensions for the
initrd, which are picked up from the file system the kernel
image is located on. Formatted as decimal ASCII string (e.g.
"12"). This variable is set if a measurement was successfully
completed, and remains unset otherwise.
Added in version 255.
Note that some of the variables above may also be set by the boot
loader. The stub will only set them if they aren't set already.
Some of these variables are defined by the Boot Loader
Interface[4].
The following resources are passed as initrd cpio archives to the
booted kernel, and thus make up the initial file system hierarchy
in the initrd execution environment:
/
The main initrd from the ".initrd" PE section of the unified
kernel image.
Added in version 252.
/.extra/credentials/*.cred
Credential files (suffix ".cred") that are placed next to the
unified kernel image (as described above) are copied into the
/.extra/credentials/ directory in the initrd execution
environment.
Added in version 252.
/.extra/global_credentials/*.cred
Similarly, credential files in the /loader/credentials/
directory in the file system the unified kernel image is
placed in are copied into the /.extra/global_credentials/
directory in the initrd execution environment.
Added in version 252.
/.extra/sysext/*.sysext.raw
System extension image files (suffix ".sysext.raw") that are
placed next to the unified kernel image (as described above)
are copied into the /.extra/sysext/ directory in the initrd
execution environment.
Added in version 252.
/.extra/confext/*.confext.raw
Configuration extension image files (suffix ".confext.raw")
that are placed next to the unified kernel image (as
described above) are copied into the /.extra/confext/
directory in the initrd execution environment.
Added in version 255.
/.extra/tpm2-pcr-signature.json
The TPM2 PCR signature JSON object included in the ".pcrsig"
PE section of the unified kernel image is copied into the
/.extra/tpm2-pcr-signature.json file in the initrd execution
environment.
Added in version 252.
/.extra/tpm2-pcr-pkey.pem
The PEM public key included in the ".pcrpkey" PE section of
the unified kernel image is copied into the
/.extra/tpm2-pcr-public-key.pem file in the initrd execution
environment.
Added in version 252.
Note that all these files are located in the "tmpfs" file system
the kernel sets up for the initrd file hierarchy and are thus
lost when the system transitions from the initrd execution
environment into the host file system. If these resources shall
be kept around over this transition they need to be copied to a
place that survives the transition first, for example via a
suitable tmpfiles.d(5) line. By default, this is done for the
TPM2 PCR signature and public key files.
systemd-stub can be configured using SMBIOS Type 11 strings.
Applicable strings consist of a name, followed by "=", followed
by the value. Unless systemd-stub detects it is running inside a
confidential computing environment, systemd-stub will search the
table for a string with a specific name, and if found, use its
value. The following strings are read:
io.systemd.stub.kernel-cmdline-extra
If set, the value of this string is added to the list of
kernel command line arguments that are measured in PCR12 and
passed to the kernel.
Added in version 254.
In order to assemble a bootable Unified Kernel Image from various
components as described above, use ukify(1).
systemd-boot(7), systemd.exec(5), systemd-creds(1),
systemd-sysext(8), Boot Loader Specification[5], Boot Loader
Interface[4], ukify(1), systemd-measure(1), TPM2 PCR Measurements
Made by systemd[6]
1. SBAT
https://github.com/rhboot/shim/blob/main/SBAT.md
2. UKI specification
https://uapi-group.org/specifications/specs/unified_kernel_image/
3. Automatic Boot Assessment
https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT
4. Boot Loader Interface
https://systemd.io/BOOT_LOADER_INTERFACE
5. Boot Loader Specification
https://uapi-group.org/specifications/specs/boot_loader_specification
6. TPM2 PCR Measurements Made by systemd
https://systemd.io/TPM2_PCR_MEASUREMENTS
This page is part of the systemd (systemd system and service
manager) project. Information about the project can be found at
⟨http://www.freedesktop.org/wiki/Software/systemd⟩. If you have
a bug report for this manual page, see
⟨http://www.freedesktop.org/wiki/Software/systemd/#bugreports⟩.
This page was obtained from the project's upstream Git repository
⟨https://github.com/systemd/systemd.git⟩ on 2024-06-14. (At that
time, the date of the most recent commit that was found in the
repository was 2024-06-13.) If you discover any rendering
problems in this HTML version of the page, or you believe there
is a better or more up-to-date source for the page, or you have
corrections or improvements to the information in this COLOPHON
(which is not part of the original manual page), send a mail to
[email protected]
systemd 257~devel SYSTEMD-STUB(7)
Pages that refer to this page: systemd(1), systemd-cryptenroll(1), systemd-measure(1), ukify(1), systemd.exec(5), systemd.unit(5), systemd-boot(7), systemd.directives(7), systemd.index(7), systemd-boot-random-seed.service(8), systemd-gpt-auto-generator(8), systemd-pcrlock(8), systemd-pcrphase.service(8), systemd-random-seed.service(8), systemd-sysext(8)
|
HTML rendering created 2024-06-26 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|