efi-boot-shim.git/MokManager.c, branch rolling

MokManager: remove redundant logical constraints

2025-01-17T19:48:54+00:00

CertList->SignatureSize is of type UINT32 which is always positive. If CertList->SignatureListSize == 0, then CertList->SignatureListSize <= CertList->SignatureSize is also true. Remove the redundant CertList->SignatureListSize == 0 checks. A message "Corrupted signature list" is better suited then "Invalid MOK detected! Ignoring MOK List." in this case. Signed-off-by: Heinrich Schuchardt

Allow MokListTrusted to be enabled by default

2022-05-04T18:58:23+00:00

Within previous versions of shim the MokListTrusted var did not exist. The user had to opt in to using the feature. Change the default behavior to an opt out model. Since old shims will not have the BS MokListTrusted set, use inverse logic that sets the MokListTrustedRT to 1 when the boot service variable is missing. Many Linux distros carry out of tree patches to trust the mok keys by default. These out of tree patches can be dropped when using a Linux kernel that supports MokListTrustedRT. Signed-off-by: Eric Snowberg

Minor coverity fixes

2021-12-10T22:08:21+00:00

- one missing free - one minor deadcode issue - two unchecked allocations - one debug hexdump of a variable we just freed Signed-off-by: Peter Jones

Introduce a new MOK variable called MokListTrustedRT

2021-11-03T15:30:28+00:00

Introduce a new MOK variable called MokListTrustedRT. It allows an end-user to decide if they want to trust MOKList keys within the soon to be booted Linux kernel. This variable does not change any functionality within shim itself. When Linux boots, if MokListTrustedRT is set and EFI_VARIABLE_NON_VOLATILE is not set, keys in MokListRT are loaded into the .machine keyring instead of the .platform keyring. Signed-off-by: Eric Snowberg

console: add a clear_screen() primitive

2021-10-12T14:40:13+00:00

Several places in e.g. MokManager and our console library use ST->ConOut->ClearScreen directly, without checking for the existence of a console output device. This patch adds function to our console library to do that correctly, instead of using the bug-prone ad hoc implementation everywhere. Signed-off-by: Peter Jones

cleanup: always use BS and RT, not gBS and gRT

2021-09-07T21:05:04+00:00

This just makes one less thing we have to make sure is the same between the test harnesses and the runtime code. Signed-off-by: Peter Jones

Restructure our includes.

2021-03-10T20:54:20+00:00

This re-structures our includes so we can be sure everything is always including all the system headers in a uniform, predictable way. Temporarily it also adds a bunch of junk at all the places we use variadic functions to specifically pick either the MS (cdecl) or ELF ABIs. I'm not 100% sure that's all correct (see later patch) but it's enough to allow this to build. Signed-off-by: Peter Jones

Fix all the places we need UNUSED on arguments.

2021-02-25T15:15:14+00:00

Signed-off-by: Peter Jones

console: Move the countdown function to console.c

2021-02-16T08:12:48+00:00

Move the countdown function from MokManager to console.c to make the function public Also make console_save_and_set_mode() and console_restore_mode() public Signed-off-by: Gary Lin

Fix up a bunch of our license statements and add SPDX most places

2021-02-16T08:12:48+00:00

The license statements in our source files were getting to be a giant mess, and mostly they all just say the same thing. I've switched most of it to SPDX labels, but left copyright statements in place (where they were not obviously incorrect copy-paste jobs that I did...). If there's some change here you don't think is valid, let me know and we can fix it up together. Signed-off-by: Peter Jones