1 #ifndef _CHUNKLIST_H 2 #define _CHUNKLIST_H 3 4 #include <libkern/crypto/sha2.h> 5 6 /* 7 * Boot argument for disabling trust in rev2 development key(s) 8 * Set by boot.efi 9 */ 10 #define CHUNKLIST_NO_REV2_DEV "-chunklist-no-rev2-dev" 11 12 /* 13 * Boot argument for disabling trust in rev1 chunklists 14 * Set by boot.efi 15 */ 16 #define CHUNKLIST_NO_REV1 "-chunklist-no-rev1" 17 18 /* 19 * Boot argument for obtaining current security epoch 20 * Set by boot.efi 21 */ 22 #define CHUNKLIST_SECURITY_EPOCH "chunklist-security-epoch" 23 #define CHUNKLIST_MIN_SECURITY_EPOCH 0 24 25 /* 26 * Chunklist file format 27 */ 28 #define CHUNKLIST_MAGIC 0x4C4B4E43 29 #define CHUNKLIST_FILE_VERSION_10 1 30 #define CHUNKLIST_CHUNK_METHOD_10 1 31 #define CHUNKLIST_SIGNATURE_METHOD_REV1 1 32 #define CHUNKLIST_SIGNATURE_METHOD_REV2 3 33 #define CHUNKLIST_REV1_SIG_LEN 256 34 #define CHUNKLIST_REV2_SIG_LEN 808 35 #define CHUNKLIST_PUBKEY_LEN (2048/8) 36 #define CHUNKLIST_SIGNATURE_LEN (2048/8) 37 38 struct efi_guid_t { 39 uint32_t data1; 40 uint16_t data2; 41 uint16_t data3; 42 uint8_t data4[8]; 43 } __attribute__((packed)); 44 45 // 45E7BC51-913C-42AC-96A2-10712FFBEBA7 46 #define CHUNKLIST_REV2_SIG_HASH_GUID \ 47 { \ 48 0x45E7BC51, 0x913C, 0x42AC, { 0x96, 0xA2, 0x10, 0x71, 0x2F, 0xFB, 0xEB, 0xA7 } \ 49 }; 50 51 // A7717414-C616-4977-9420-844712A735BF 52 #define EFI_CERT_TYPE_RSA2048_SHA256 \ 53 { \ 54 0xa7717414, 0xc616, 0x4977, { 0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } \ 55 } 56 57 #define WIN_CERT_TYPE_EFI_GUID 0x0EF1 58 59 struct chunklist_hdr { 60 uint32_t cl_magic; 61 uint32_t cl_header_size; 62 uint8_t cl_file_ver; 63 uint8_t cl_chunk_method; 64 uint8_t cl_sig_method; 65 uint8_t __unused1; 66 uint64_t cl_chunk_count; 67 uint64_t cl_chunk_offset; 68 uint64_t cl_sig_offset; 69 } __attribute__((packed)); 70 71 struct chunklist_chunk { 72 uint32_t chunk_size; 73 uint8_t chunk_sha256[SHA256_DIGEST_LENGTH]; 74 } __attribute__((packed)); 75 76 struct rev2_chunklist_certificate { 77 uint32_t length; 78 uint8_t revision; 79 uint8_t security_epoch; 80 uint16_t certificate_type; 81 guid_t certificate_guid; 82 guid_t hash_type_guid; 83 uint8_t rsa_public_key[CHUNKLIST_PUBKEY_LEN]; 84 uint8_t rsa_signature[CHUNKLIST_SIGNATURE_LEN]; 85 } __attribute__((packed)); 86 87 struct chunklist_pubkey { 88 const boolean_t is_production; 89 const uint8_t key[CHUNKLIST_PUBKEY_LEN]; 90 }; 91 92 int authenticate_root_with_chunklist(const char *rootdmg_path, boolean_t *out_enforced); 93 int authenticate_root_version_check(void); 94 int authenticate_bootkc_uuid(void); 95 int authenticate_libkern_uuid(void); 96 #endif /* _CHUNKLIST_H */ 97