efi-boot-shim.git/sbat.c, branch rolling

Improve shortcut performance when comparing two boolean expressions

2025-01-15T21:41:38+00:00

In original sbat.c: ... else if (preserve_sbat_uefi_variable(sbat, sbatsize, attributes, sbat_var_candidate) && !reset_sbat) { ... The time omplexity of preserve_sbat_uefi_variable() is higher than reset_sbat. Maybe we could swap both of them to calculate reset_sbat first. Such that the shortcut performance can be improved. Signed-off-by: Dennis Tseng

Rename "previous" revocations to "automatic"

2024-01-22T19:17:20+00:00

When the term previous was introduced for revocations to be automatically applied there was a hope that everytime a new revocation was built into shim, the previous revocation could be applied automatically. Further experience has shown the real world to be more complex than that. The automatic payload will realistically contain a set of revocations governed by both the cadence at which a distro's customer base updates as well as the severity of the issue being revoked. This is not a functional change. Signed-off-by: Jan Setje-Eilers

Print message when refusing to apply SbatLevel

2023-12-05T18:20:00+00:00

If shim detects a self revocation in a new proposed SbatLevel and refuses to apply this new set of revocations a message should be printed even in non-verbose modes. Signed-off-by: Jan Setje-Eilers

shim should not self revoke

2023-12-05T18:20:00+00:00

Before applying an updated SbatLevel shim should re-run introspection and never apply a revocation level that would prevent the currently running shim from booting. The proper way forward is to update shim first. Signed-off-by: Jan Setje-Eilers

BS Variables for bootmgr revocations

2023-12-05T18:20:00+00:00

This adds support for applying SkuSiPolicy UEFI BS variables. These varaibles are needed for non-dbx based Windows revocations and are described here: https://support.microsoft.com/en-us/topic/kb5027455-guidance-for-blocking-vulnerable-windows-boot-managers-522bb851-0a61-44ad-aa94-ad11119c5e91 Signed-off-by: Jan Setje-Eilers

Always clear SbatLevel when Secure Boot is disabled

2023-12-05T18:20:00+00:00

Unless an explict sbat policy is specified, always delete SbatLevel when secure boot is disabled. Signed-off-by: Jan Setje-Eilers

Allow SbatLevel data from external binary

2023-12-05T18:20:00+00:00

Ingest SBAT Levels from revocations binary thereby allowing level requirements to be updated independently from shipping a new shim. Do not automatically apply any revocations from a stock shim at this point. Signed-off-by: Jan Setje-Eilers

Fix a 1-byte memory leak in .sbat parsing.

2023-06-29T18:35:50+00:00

On the occasion that .sbat is entirely made of characters that aren't meaningfully CSV /data/, but which the parser accepts (i.e. newline), we currently allocate a byte of memory which then gets leaked. This patch tests for that condition and skips the allocation when there aren't any actual /entries/ to parse. Signed-off-by: Peter Jones

Make SBAT variable payload introspectable

2022-08-03T18:54:57+00:00

Given a set of EFI variables and boot assets, it should be possible to compute what the value of PCR 7 will be on the next boot. As shim manages the contents of the SbatLevel variable and this is measured to PCR 7, export the payloads that shim contains in a new COFF section (.sbatlevel) so that it can be introspected by code outside of shim. The new section works a bit like .vendor_cert - it contains a header and then the payload. In this case, the header contains no size fields because the strings are NULL terminated. Shim uses this new section internally in set_sbat_uefi_variable. The .sbatlevel section starts with a 4 byte version field which is not used by shim but may be useful for external auditors if the format of the section contents change in the future. Signed-off-by: Chris Coulson

sbat: add the parsed SBAT variable entries to the debug log

2022-06-01T15:01:24+00:00

Signed-off-by: Peter Jones