diff options
| author | Peter Jones <pjones@redhat.com> | 2021-02-14 11:21:27 -0500 |
|---|---|---|
| committer | Javier Martinez Canillas <javier@dowhile0.org> | 2021-02-16 09:12:48 +0100 |
| commit | a6c726fc81e53fff07942d0d50a7d274bedb4cb6 (patch) | |
| tree | 6827f673e09bcd709f4c53d5982166678073c077 | |
| parent | d230d02f990f02293736dca78b108f86c86d1bd0 (diff) | |
| download | efi-boot-shim-a6c726fc81e53fff07942d0d50a7d274bedb4cb6.tar.gz efi-boot-shim-a6c726fc81e53fff07942d0d50a7d274bedb4cb6.zip | |
Fix a bunch of trivial trailing whitespace issues.
Signed-off-by: Peter Jones <pjones@redhat.com>
| -rw-r--r-- | MokVars.txt | 60 | ||||
| -rw-r--r-- | README.tpm | 2 | ||||
| -rw-r--r-- | elf_x86_64_efi.lds | 4 | ||||
| -rw-r--r-- | include/configtable.h | 21 | ||||
| -rw-r--r-- | include/variables.h | 2 | ||||
| -rw-r--r-- | include/wincert.h | 17 | ||||
| -rw-r--r-- | lib/configtable.c | 16 | ||||
| -rw-r--r-- | lib/execute.c | 2 | ||||
| -rw-r--r-- | lib/security_policy.c | 6 | ||||
| -rw-r--r-- | testplan.txt | 4 |
10 files changed, 66 insertions, 68 deletions
diff --git a/MokVars.txt b/MokVars.txt index d57fd87d..64fe846b 100644 --- a/MokVars.txt +++ b/MokVars.txt @@ -2,13 +2,13 @@ Variables used by Shim and Mokmanager Request variables: -MokPW: Set by MokUtil when setting a password. A SHA-256 hash of the -UCS-2 representation of the password. The user will be asked to -re-enter the password to confirm. If the hash of the entered password -matches the contents of MokPW, the user will be prompted to copy MokPW +MokPW: Set by MokUtil when setting a password. A SHA-256 hash of the +UCS-2 representation of the password. The user will be asked to +re-enter the password to confirm. If the hash of the entered password +matches the contents of MokPW, the user will be prompted to copy MokPW into MokPWState. BS,RT,NV -MokSB: Set by MokUtil when requesting a change in state of signature +MokSB: Set by MokUtil when requesting a change in state of signature validation. A packed structure as follows: typedef struct { @@ -17,15 +17,15 @@ typedef struct { CHAR16 Password[PASSWORD_MAX]; } __attribute__ ((packed)) MokSBvar; -If MokSBState is 0, the user will be prompted to disable signature -validation. Otherwise, the user will be prompted to enable it. PWLen -is the length of the password, in characters. Password is a UCS-2 -representation of the password. The user will be prompted to enter -three randomly chosen characters from the password. If successful, -they will then be prompted to change the signature validation +If MokSBState is 0, the user will be prompted to disable signature +validation. Otherwise, the user will be prompted to enable it. PWLen +is the length of the password, in characters. Password is a UCS-2 +representation of the password. The user will be prompted to enter +three randomly chosen characters from the password. If successful, +they will then be prompted to change the signature validation according to MokSBState. BS,RT,NV -MokDB: Set by MokUtil when requesting a change in state of validation +MokDB: Set by MokUtil when requesting a change in state of validation using db hashes and certs. A packed structure as follows: typedef struct { @@ -34,28 +34,28 @@ typedef struct { CHAR16 Password[PASSWORD_MAX]; } __attribute__ ((packed)) MokDBvar; -If MokDBState is 0, the user will be prompted to disable usage of db for -validation. Otherwise, the user will be prompted to allow it. PWLen -is the length of the password, in characters. Password is a UCS-2 -representation of the password. The user will be prompted to enter -three randomly chosen characters from the password. If successful, -they will then be prompted to change the signature validation +If MokDBState is 0, the user will be prompted to disable usage of db for +validation. Otherwise, the user will be prompted to allow it. PWLen +is the length of the password, in characters. Password is a UCS-2 +representation of the password. The user will be prompted to enter +three randomly chosen characters from the password. If successful, +they will then be prompted to change the signature validation according to MokDBState. BS,RT,NV -MokNew: Set by MokUtil when requesting the addition or removal of keys -from MokList. Is an EFI_SIGNATURE_LIST as described in the UEFI +MokNew: Set by MokUtil when requesting the addition or removal of keys +from MokList. Is an EFI_SIGNATURE_LIST as described in the UEFI specification. BS,RT,NV -MokAuth: A hash dependent upon the contents of MokNew and the sealing -password. The user's password in UCS-2 form should be appended to the -contents of MokNew and a SHA-256 hash generated and stored in MokAuth. -The hash will be regenerated by MokManager after the user is requested -to enter their password to confirm enrolment of the keys. If the hash +MokAuth: A hash dependent upon the contents of MokNew and the sealing +password. The user's password in UCS-2 form should be appended to the +contents of MokNew and a SHA-256 hash generated and stored in MokAuth. +The hash will be regenerated by MokManager after the user is requested +to enter their password to confirm enrolment of the keys. If the hash matches MokAuth, the user will be prompted to enrol the keys. BS,RT,NV State variables: -MokList: A list of whitelisted keys and hashes. An EFI_SIGNATURE_LIST +MokList: A list of whitelisted keys and hashes. An EFI_SIGNATURE_LIST as described in the UEFI specification. BS,NV MokListRT: A copy of MokList made available to the kernel at runtime. RT @@ -65,15 +65,15 @@ as described in the UEFI specification. BS,NV MokListXRT: A copy of MokListX made available to the kernel at runtime. RT -MokSBState: An 8-bit unsigned integer. If 1, shim will switch to +MokSBState: An 8-bit unsigned integer. If 1, shim will switch to insecure mode. BS,NV -MokDBState: An 8-bit unsigned integer. If 1, shim will not use db for +MokDBState: An 8-bit unsigned integer. If 1, shim will not use db for verification. BS,NV MokIgnoreDB: An 8-bit unsigned integer. This allows the OS to query whether or not to import DB certs for its own verification purposes. -MokPWStore: A SHA-256 representation of the password set by the user -via MokPW. The user will be prompted to enter this password in order +MokPWStore: A SHA-256 representation of the password set by the user +via MokPW. The user will be prompted to enter this password in order to interact with MokManager. @@ -24,7 +24,7 @@ PCR8: - If you're using the grub2 TPM patchset we cary in Fedora, the kernel command line and all grub commands (including all of grub.cfg that gets run) are measured into PCR8. - + PCR9: - If you're using the grub2 TPM patchset we carry in Fedora, the kernel, initramfs, and any multiboot modules loaded are measured into PCR9. diff --git a/elf_x86_64_efi.lds b/elf_x86_64_efi.lds index af3a0714..1be23cbc 100644 --- a/elf_x86_64_efi.lds +++ b/elf_x86_64_efi.lds @@ -8,8 +8,8 @@ SECTIONS ImageBase = .; .hash : { *(.hash) } /* this MUST come first! */ . = ALIGN(4096); - .eh_frame : - { + .eh_frame : + { *(.eh_frame) } . = ALIGN(4096); diff --git a/include/configtable.h b/include/configtable.h index 5e201fbe..e44bbbae 100644 --- a/include/configtable.h +++ b/include/configtable.h @@ -7,7 +7,7 @@ typedef UINT32 EFI_IMAGE_EXECUTION_ACTION; -#define EFI_IMAGE_EXECUTION_AUTHENTICATION 0x00000007 +#define EFI_IMAGE_EXECUTION_AUTHENTICATION 0x00000007 #define EFI_IMAGE_EXECUTION_AUTH_UNTESTED 0x00000000 #define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED 0x00000001 #define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED 0x00000002 @@ -26,24 +26,24 @@ typedef struct { /// UINT32 InfoSize; /// - /// If this image was a UEFI device driver (for option ROM, for example) this is the - /// null-terminated, user-friendly name for the device. If the image was for an application, - /// then this is the name of the application. If this cannot be determined, then a simple + /// If this image was a UEFI device driver (for option ROM, for example) this is the + /// null-terminated, user-friendly name for the device. If the image was for an application, + /// then this is the name of the application. If this cannot be determined, then a simple /// NULL character should be put in this position. /// CHAR16 Name[]; /// /// - /// For device drivers, this is the device path of the device for which this device driver - /// was intended. In some cases, the driver itself may be stored as part of the system - /// firmware, but this field should record the device's path, not the firmware path. For - /// applications, this is the device path of the application. If this cannot be determined, + /// For device drivers, this is the device path of the device for which this device driver + /// was intended. In some cases, the driver itself may be stored as part of the system + /// firmware, but this field should record the device's path, not the firmware path. For + /// applications, this is the device path of the application. If this cannot be determined, /// a simple end-of-path device node should be put in this position. /// EFI_DEVICE_PATH_PROTOCOL DevicePath; /// /// - /// Zero or more image signatures. If the image contained no signatures, + /// Zero or more image signatures. If the image contained no signatures, /// then this field is empty. /// ///EFI_SIGNATURE_LIST Signature; @@ -54,14 +54,13 @@ typedef struct { /// /// Number of EFI_IMAGE_EXECUTION_INFO structures. /// - UINTN NumberOfImages; + UINTN NumberOfImages; /// /// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures. /// EFI_IMAGE_EXECUTION_INFO InformationInfo[]; } EFI_IMAGE_EXECUTION_INFO_TABLE; - void * configtable_get_table(EFI_GUID *guid); EFI_IMAGE_EXECUTION_INFO_TABLE * diff --git a/include/variables.h b/include/variables.h index 0f2e17fd..c65f062f 100644 --- a/include/variables.h +++ b/include/variables.h @@ -26,7 +26,7 @@ CreatePkX509SignatureList ( IN UINT8 *X509Data, IN UINTN X509DataSize, IN EFI_GUID owner, - OUT EFI_SIGNATURE_LIST **PkCert + OUT EFI_SIGNATURE_LIST **PkCert ); EFI_STATUS CreateTimeBasedPayload ( diff --git a/include/wincert.h b/include/wincert.h index 5b6c1fb0..9a5953a5 100644 --- a/include/wincert.h +++ b/include/wincert.h @@ -8,28 +8,27 @@ /// typedef struct { /// - /// The length of the entire certificate, - /// including the length of the header, in bytes. + /// The length of the entire certificate, + /// including the length of the header, in bytes. /// UINT32 dwLength; /// - /// The revision level of the WIN_CERTIFICATE - /// structure. The current revision level is 0x0200. + /// The revision level of the WIN_CERTIFICATE + /// structure. The current revision level is 0x0200. /// UINT16 wRevision; /// - /// The certificate type. See WIN_CERT_TYPE_xxx for the UEFI - /// certificate types. The UEFI specification reserves the range of - /// certificate type values from 0x0EF0 to 0x0EFF. + /// The certificate type. See WIN_CERT_TYPE_xxx for the UEFI + /// certificate types. The UEFI specification reserves the range of + /// certificate type values from 0x0EF0 to 0x0EFF. /// UINT16 wCertificateType; /// - /// The following is the actual certificate. The format of + /// The following is the actual certificate. The format of /// the certificate depends on wCertificateType. /// /// UINT8 bCertificate[ANYSIZE_ARRAY]; /// } WIN_CERTIFICATE; - #endif /* SHIM_WINCERT_H */ diff --git a/lib/configtable.c b/lib/configtable.c index 3d0e1a85..8675fad1 100644 --- a/lib/configtable.c +++ b/lib/configtable.c @@ -49,22 +49,22 @@ configtable_find_image(const EFI_DEVICE_PATH *DevicePath) /* print what we have for debugging */ UINT8 *d = (UINT8 *)e; // + sizeof(UINT32)*2; console_print(L"Data: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n", - d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); + d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); d += 16; console_print(L"Data: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n", - d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); + d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); d += 16; console_print(L"Data: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n", - d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); + d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); d += 16; console_print(L"Data: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n", - d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); + d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); d += 16; console_print(L"Data: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n", - d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); + d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); d += 16; console_print(L"Data: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n", - d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); + d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]); #endif CHAR16 *name = (CHAR16 *)(e->Data); int skip = 0; @@ -93,12 +93,12 @@ configtable_find_image(const EFI_DEVICE_PATH *DevicePath) console_print(L"Device Path Size %d\n", Size); #endif if (Size > e->InfoSize) { - /* parse error; the platform obviously has a + /* parse error; the platform obviously has a * corrupted image table; bail */ console_print(L"Image Execution Information table corrupt\n"); break; } - + if (CompareMem(dp, (void *)DevicePath, Size) == 0) { #ifdef DEBUG_CONFIG console_print(L"***FOUND\n"); diff --git a/lib/execute.c b/lib/execute.c index 40b4005a..f57a6321 100644 --- a/lib/execute.c +++ b/lib/execute.c @@ -49,7 +49,7 @@ generate_path(CHAR16* name, EFI_LOADED_IMAGE *li, EFI_DEVICE_PATH **path, CHAR16 if (name[0] != '\\') StrCat(*PathName, L"\\"); StrCat(*PathName, name); - + *path = FileDevicePath(li->DeviceHandle, *PathName); error: diff --git a/lib/security_policy.c b/lib/security_policy.c index da3cdcd3..6a9b13ed 100644 --- a/lib/security_policy.c +++ b/lib/security_policy.c @@ -54,7 +54,7 @@ extern EFI_STATUS thunk_security_policy_authentication( const EFI_SECURITY_PROTOCOL *This, UINT32 AuthenticationStatus, const EFI_DEVICE_PATH_PROTOCOL *DevicePath - ) + ) __attribute__((unused)); extern EFI_STATUS thunk_security2_policy_authentication( @@ -63,7 +63,7 @@ extern EFI_STATUS thunk_security2_policy_authentication( VOID *FileBuffer, UINTN FileSize, BOOLEAN BootPolicy - ) + ) __attribute__((unused)); static __attribute__((used)) EFI_STATUS @@ -106,7 +106,7 @@ security_policy_authentication ( ) { EFI_STATUS efi_status, fail_status; - EFI_DEVICE_PATH *DevPath + EFI_DEVICE_PATH *DevPath = DuplicateDevicePath((EFI_DEVICE_PATH *)DevicePathConst), *OrigDevPath = DevPath; EFI_HANDLE h; diff --git a/testplan.txt b/testplan.txt index 0b0569e7..1b70e3ee 100644 --- a/testplan.txt +++ b/testplan.txt @@ -27,7 +27,7 @@ How to test a new shim build for RHEL/fedora: -c "Red Hat Test Certificate" 9) copy grub.cfg to our test directory: cp /boot/efi/EFI/redhat/grub.cfg /boot/efi/EFI/test/grub.cfg -10) *move* \EFI\redhat\BOOT.CSV to \EFI\test +10) *move* \EFI\redhat\BOOT.CSV to \EFI\test rm -rf /boot/efi/EFI/BOOT/ mkdir /boot/efi/EFI/BOOT/ mv /boot/efi/EFI/redhat/BOOT.CSV /boot/efi/EFI/test/BOOT.CSV @@ -73,7 +73,7 @@ How to test a new shim build for RHEL/fedora: removed ‘Boot0002-8be4df61-93ca-11d2-aa0d-00e098032b8c’ removed ‘Boot2001-8be4df61-93ca-11d2-aa0d-00e098032b8c’ removed ‘BootOrder-8be4df61-93ca-11d2-aa0d-00e098032b8c’ - [root@uefi efivars]# + [root@uefi efivars]# 25) reboot 26) the system should run \EFI\BOOT\BOOTX64.EFI . If it doesn't, you may just have an old machine. In that case, go to the EFI shell and run: |
