diff options
| author | Steve McIntyre <steve@einval.com> | 2021-04-21 00:24:31 +0100 |
|---|---|---|
| committer | Steve McIntyre <steve@einval.com> | 2021-04-21 00:24:31 +0100 |
| commit | cf870e72b009106bd3de7227994203f8cf2dbb74 (patch) | |
| tree | ff82c0cfe10e796fc0398db87fc890293118dd34 | |
| parent | ae8c2e79ef733bd2ef81cac185f40890e185a71d (diff) | |
| download | efi-boot-shim-cf870e72b009106bd3de7227994203f8cf2dbb74.tar.gz efi-boot-shim-cf870e72b009106bd3de7227994203f8cf2dbb74.zip | |
Fix handling of ignore_db and user_insecure_mode
Extra patch from upstream
| -rw-r--r-- | debian/patches/fix-import_one_mok_state.patch | 36 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
2 files changed, 37 insertions, 0 deletions
diff --git a/debian/patches/fix-import_one_mok_state.patch b/debian/patches/fix-import_one_mok_state.patch new file mode 100644 index 00000000..995a8640 --- /dev/null +++ b/debian/patches/fix-import_one_mok_state.patch @@ -0,0 +1,36 @@ +commit 822d07ad4f07ef66fe447a130e1027c88d02a394 +Author: Adam Williamson <awilliam@redhat.com> +Date: Thu Apr 8 22:39:02 2021 -0700 + + Fix handling of ignore_db and user_insecure_mode + + In 65be350308783a8ef537246c8ad0545b4e6ad069, import_mok_state() is split + up into a function that manages the whole mok state, and one that + handles the state machine for an individual state variable. + Unfortunately, the code that initializes the global ignore_db and + user_insecure_mode was copied from import_mok_state() into the new + import_one_mok_state() function, and thus re-initializes that state each + time it processes a MoK state variable, before even assessing if that + variable is set. As a result, we never honor either flag, and the + machine owner cannot disable trusting the system firmware's db/dbx + databases or disable validation altogether. + + This patch removes the extra re-initialization, allowing those variables + to be set properly. + + Signed-off-by: Adam Williamson <awilliam@redhat.com> + +diff --git a/mok.c b/mok.c +index 5ad9072b..9e37d6ab 100644 +--- a/mok.c ++++ b/mok.c +@@ -888,9 +888,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v, + EFI_STATUS ret = EFI_SUCCESS; + EFI_STATUS efi_status; + +- user_insecure_mode = 0; +- ignore_db = 0; +- + UINT32 attrs = 0; + BOOLEAN delete = FALSE; + diff --git a/debian/patches/series b/debian/patches/series index 6e64743f..0ffe2a27 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ +fix-import_one_mok_state.patch fix-broken-ia32-reloc.patch MOK-BootServicesData.patch |