efi-boot-shim.git/README.tpm, branch rolling

README.tpm: Update MokList entry to MokListRT

2025-03-18T13:56:58+00:00

Commit 092c2b2bbed950727e41cf450b61c794881c33e7 switched to using MokListRT instead of MokList during PCR7 measurement. Updating the README to reflect the correct behaviour. Signed-off-by: Thien Trung Vuong

README.tpm: reflect that vendor_db is in fact logged as "vendor_db"

2025-02-26T00:43:12+00:00

README.tpm incorrectly stated that vendor_db is logged as "db" when in fact it logs as "vendor_db". This caused confusion like https://github.com/keylime/keylime/issues/1725 Fixing the code risks breaking existing logs, so we're updating the doc instead. vendor_dbx is in fact logged as "dbx", so that remains unchanged. Thanks to Morten Linderud for raising this. Signed-off-by: Jan Setje-Eilers

SBAT: mirror SBAT to SbatRT and extend to PCR7 + log

2021-02-22T16:22:36+00:00

This adds SBAT to our table of variables to mirror with our MoK state. Currently it mirrors "SBAT" to a variable named "SbatRT", both using the SHIM GUID. Currently we enforce the current policy WRT these variables: - we always delete SbatRT if it's present, for a couple of reasons: - If we got here either something created it before us during boot, which isn't a thing we believe anything should be doing, or it's an NV variable, which it shouldn't be. - we want to raise the error if it's NV+Authenticated - we always delete SBAT (and do not mirror it) if it either - doesn't have BS|NV set or - does have RT set - we're requiring !RT because we can't actually tell if it's an authenticated variable or not, and we want to get the error if RT is set and it is authenticated, because that means we've lost the race between us and an attacker to create it. - we always measure SBAT into PCR7 and add a log extension with the measured hash Signed-off-by: Peter Jones

Rename check_{white,black}list to check_{allow,deny}list

2021-02-16T08:12:48+00:00

v2 - updated for conflicts and to include documentation (pjones)

Fix a bunch of trivial trailing whitespace issues.

2021-02-16T08:12:48+00:00

Signed-off-by: Peter Jones

Add support for vendor_db built-in shim authorized list.

2020-07-24T02:22:04+00:00

Potential new signing strategies ( for example signing grub, fwupdate and vmlinuz with separate certificates ) require shim to support a vendor provided bundle of trusted certificates and hashes, which allows shim to trust EFI binaries matching either certificate by signature or hash in the vendor_db. Functionality is similar to vendor_dbx. This also improves the mirroring quite a bit. Upstream: pr#206

Update README.tpm

2020-07-24T00:53:24+00:00

typo Upstream-commit-id: bc24c9eb1d4

Add GRUB's PCR Usage to README.tpm

2020-07-24T00:51:49+00:00

This didn't seem to get documented anywhere, and this is as good a place as any. Upstream-commit-id: 4fab7281a8c

Log measurements in PCR4 for applications being verified through shim_lock

2018-03-06T19:37:07+00:00

Currently the only measurement the shim logs in the TPM is that of the EFI application it directly loads. However, there are no measurements being taken of application that are being verified through the shim_lock protocol. In this patch we extend PCR4 for any binary for which Verify is being called through the shim_lock protocol. Signed-off-by: Tamas K Lengyel

Add README.tpm to explain which PCRs we extend things to.

2017-08-03T15:24:56+00:00

Signed-off-by: Peter Jones