diff options
| author | Jan Setje-Eilers <jan.setjeeilers@oracle.com> | 2022-05-24 11:49:44 -0700 |
|---|---|---|
| committer | Peter Jones <pjones@redhat.com> | 2022-05-24 16:27:48 -0400 |
| commit | 77144e5a404df89b45941bfc54fd2f59e0ee607b (patch) | |
| tree | fab5a31103c04b7e2c190b788054945afd9318ba | |
| parent | c0bcd04f5abe9d6efe04e7d8727fa4afe4d46eff (diff) | |
| download | efi-boot-shim-77144e5a404df89b45941bfc54fd2f59e0ee607b.tar.gz efi-boot-shim-77144e5a404df89b45941bfc54fd2f59e0ee607b.zip | |
SBAT Policy latest should be a one-shot
Since booting from removable media can be hard to detect,
setting a persistent latest SBAT policy is risky in a typical
client system. This changes latest to be a one-shot operation
that could be set at the time of an OS update if desired.
Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
| -rw-r--r-- | sbat.c | 21 |
1 files changed, 13 insertions, 8 deletions
@@ -369,6 +369,16 @@ preserve_sbat_uefi_variable(UINT8 *sbat, UINTN sbatsize, UINT32 attributes, return false; } +static void +clear_sbat_policy() +{ + EFI_STATUS efi_status = EFI_SUCCESS; + + efi_status = del_variable(SBAT_POLICY, SHIM_LOCK_GUID); + if (EFI_ERROR(efi_status)) + console_error(L"Could not reset SBAT Policy", efi_status); +} + EFI_STATUS set_sbat_uefi_variable(void) { @@ -394,6 +404,7 @@ set_sbat_uefi_variable(void) case SBAT_POLICY_LATEST: dprint("Custom sbat policy: latest\n"); sbat_var = SBAT_VAR_LATEST; + clear_sbat_policy(); break; case SBAT_POLICY_PREVIOUS: dprint("Custom sbat policy: previous\n"); @@ -408,19 +419,13 @@ set_sbat_uefi_variable(void) reset_sbat = true; sbat_var = SBAT_VAR_ORIGINAL; } - efi_status = del_variable(SBAT_POLICY, SHIM_LOCK_GUID); - if (EFI_ERROR(efi_status)) - console_error(L"Could not reset SBAT Policy", - efi_status); + clear_sbat_policy(); break; default: console_error(L"SBAT policy state %llu is invalid", EFI_INVALID_PARAMETER); - efi_status = del_variable(SBAT_POLICY, SHIM_LOCK_GUID); - if (EFI_ERROR(efi_status)) - console_error(L"Could not reset SBAT Policy", - efi_status); sbat_var = SBAT_VAR_PREVIOUS; + clear_sbat_policy(); break; } } |