efi-boot-shim.git/mok.c, branch rolling

mirror_mok_db(): Free our mok variable name correctly

2025-03-14T15:05:05+00:00

When we've split a mok variable into name0..nameN, we re-use the same buffer over and over, but we never free it at the end. This frees it. Resolves: Coverity CID 457501 Signed-off-by: Peter Jones

mirror_one_mok_variable(): fix a memory leak on TPM log error.

2025-03-14T15:05:05+00:00

If measuring a mok variable to the TPM returns failure, this function returns, but never frees the data intended to be measured. This frees it. Resolves: Coverity CID 457503 Signed-off-by: Peter Jones

mirror_mok_db(): get rid of an unused variable+allocation

2025-03-14T15:05:05+00:00

Coverity identified a resource leak of namen8 in mirror_mok_db(), and upon further examination nothing is even using it any more; we're allocating it and populating it for nothing. This removes all that. Resolves: Coverity CID 457510 Signed-off-by: Peter Jones

Some save_logs() improvements.

2025-02-26T14:39:46+00:00

In d972515e608e ("Save the debug and error logs in mok-variables") had a few deficiencies: 1) the size of the result table isn't correctly computed when either errlog or dbglog is 0 sized (much more likely for the former), 2) when we save the error log we leak the allocation for the previous mok variables, and 3) original mok variables were allocated with AllocatePages(), but the new ones were allocated with AllocateZeroPool(). The former guarantees page alignment, which we want here. This fixes all three of these. Signed-off-by: Peter Jones

Add shim's current NX_COMPAT status to HSIStatus

2025-02-26T00:40:54+00:00

hughsie asked me to also make it observable at runtime whether the shim binary that was used to boot was set as NX_COMPAT or not. This adds that into the HSIStatus data as "shim-has-nx-compat-set". Signed-off-by: Peter Jones

Add DXE Services information to HSI

2025-02-24T20:58:16+00:00

This adds three more entries to our HSI data: has-dxe-services-table: technically only tells us if UEFI's LocateProtocol will give us a DXE services table, but practically also tells us if the machine is implementing DXE in any way. has-get-memory-space-descriptor: tells us if DXE->GetMemorySpaceDescriptor is populated has-set-memory-space-descriptor: tells us if DXE->SetMemorySpaceDescriptor is populated Signed-off-by: Peter Jones

Mirror some more efi variables to mok-variables

2025-02-24T20:26:20+00:00

Some machines have EFI Boot Services variables but not Runtime variables, and thus it can be quite difficult to figure out what's going on once the system is booted. This changes mok variable mirroring to also mirror the following variables to the mok variable config table: AuditMode BootOrder BootCurrent BootNext Boot0000 Boot0001 Boot0002 Boot0003 Boot0004 Boot0005 Boot0006 DeployedMode SecureBoot SetupMode SignatureSupport Timeout PK KEK db dbx Kernel_SkuSiStatus There's no attempt to do anything involving creating runtime or boot-services only variables, it just mirrors them into the config table so they'll be exposed there. Signed-off-by: Peter Jones

Move mok state variable data flag definitions to the header.

2025-02-24T20:26:20+00:00

Previously the mok mirror state flags were only used in the mok mirroring code. But there are other consumers of that data, namely our variable test cases, and it's useful for them to be able to check the flags. Signed-off-by: Peter Jones

shim: add HSIStatus feature

2025-02-24T20:24:24+00:00

hughsie asked me if I can make shim tell userland what kinds of accesses are allowed to the heap, stack, and allocations on the running platform, so that these could be reported up through fwupd's Host Security ID program (see https://fwupd.github.io/libfwupdplugin/hsi.html ). This adds a new config-only (i.e. not a UEFI variable) variable generated during boot, "/sys/firmware/efi/mok-variables/HSIStatus", which tells us those properties as well as if the EFI Memory Attribute Protocol is present. Signed-off-by: Peter Jones

mok variables: add a format callback

2025-02-24T20:24:24+00:00

This adds a member to the mok_state_variable struct to provide a callback function for formatting external data. It basically has snprintf()-like semantics for filling the buffer, but without the actual printf-like formatting bits. Signed-off-by: Peter Jones