efi-boot-shim.git/include, branch 15.8

Try to load revocations.efi even if directory read fails

2024-01-22T19:17:20+00:00

Network booting tends to expose things like a tfpt server as a filesystem that doesn't implement directory listing This will blindly try to ingest a revocations.efi file in those cases, even if that may result in some console noise when the file does not exist. Signed-off-by: Jan Setje-Eilers

netboot read_image() should not hardcode DEFAULT_LOADER

2024-01-22T19:17:20+00:00

The netboot path up until now hardcodes DEFAULT_LOADER as the only possible filename to load. This is pretty limiting and needs to be fixed. Signed-off-by: Jan Setje-Eilers

Build time selectable automatic SBATLevel revocations

2024-01-22T19:17:20+00:00

The ability to automatically apply SBATLevel revocations varies from distro to distro. This allows distros that are able to automatically apply SBATLevel revocations when shim is updated to select a level by supplying SBAT_AUTOMATIC_DATE= on the make command line. Currently the following options are available: 2021030218 no revocations - useful for distros that need to rely on an externally delivered revocations.efi 2022052400 grub,2 2022111500 shim,2 grub,3 2023012900 shim,2 grub,3 grub.debian,4 If no datestamp is specified the build will default to the most recent 2023012900. Signed-off-by: Jan Setje-Eilers

Rename "previous" revocations to "automatic"

2024-01-22T19:17:20+00:00

When the term previous was introduced for revocations to be automatically applied there was a hope that everytime a new revocation was built into shim, the previous revocation could be applied automatically. Further experience has shown the real world to be more complex than that. The automatic payload will realistically contain a set of revocations governed by both the cadence at which a distro's customer base updates as well as the severity of the issue being revoked. This is not a functional change. Signed-off-by: Jan Setje-Eilers

pe-relocate: Avoid __builtin_add_overflow() on GCC < 5

2024-01-22T19:17:20+00:00

GCC 4 doesn't have __builtin_add_overflow() and friends, so this results in a compiler error. On platforms using that version, do the arithmetic without it. Signed-off-by: Peter Jones

Updated Revocations for January 2024 CVEs

2024-01-17T19:49:38+00:00

Since shim is inherently updated by shipping a new shim, the latest built in revocations can include the most recent shim revocations. Since CVE-2023-40547 is high impact, this revocation should be available to everyone as soon as possible. GRUB2 CVE-2023-4692 and CVE-2023-4693 are in the ntfs module that only some vendors ship. Since some vendors did not ship an updated GRUB2 for these issues, the revocation for these CVEs is not included in the payload at this time. Signed-off-by: Jan Setje-Eilers

shim should not self revoke

2023-12-05T18:20:00+00:00

Before applying an updated SbatLevel shim should re-run introspection and never apply a revocation level that would prevent the currently running shim from booting. The proper way forward is to update shim first. Signed-off-by: Jan Setje-Eilers

BS Variables for bootmgr revocations

2023-12-05T18:20:00+00:00

This adds support for applying SkuSiPolicy UEFI BS variables. These varaibles are needed for non-dbx based Windows revocations and are described here: https://support.microsoft.com/en-us/topic/kb5027455-guidance-for-blocking-vulnerable-windows-boot-managers-522bb851-0a61-44ad-aa94-ad11119c5e91 Signed-off-by: Jan Setje-Eilers

Allow SbatLevel data from external binary

2023-12-05T18:20:00+00:00

Ingest SBAT Levels from revocations binary thereby allowing level requirements to be updated independently from shipping a new shim. Do not automatically apply any revocations from a stock shim at this point. Signed-off-by: Jan Setje-Eilers

Add primitives for overflow-checked arithmetic operations.

2023-12-05T18:17:19+00:00

We need to do arithmetic on untrusted values sometimes, so this patch adds the following primitives as macros that wrap the compiler builtins. bool checked_add(TYPE addend0, TYPE addend1, TYPE *sum) bool checked_sub(TYPE minuend, TYPE subtrahend, TYPE *difference) bool checked_mul(TYPE factor0, TYPE factor1, TYPE *product) And also the following primitive which returns True if divisor is 0 and False otherwise: bool checked_div(TYPE dividend, TYPE divisor, TYPE *quotient) Signed-off-by: Peter Jones