diff options
| author | Gary Ching-Pang Lin <glin@suse.com> | 2013-11-04 14:45:33 +0800 |
|---|---|---|
| committer | Peter Jones <pjones@redhat.com> | 2015-06-16 11:41:32 -0400 |
| commit | b8d1bc6e98e54f6fda87ba0a248de7cba5c78f96 (patch) | |
| tree | f74316fb3fb74dd5755eef600e8b6a944bf944c9 | |
| parent | 9a811c32337233005b613874beac952b712d77ef (diff) | |
| download | efi-boot-shim-b8d1bc6e98e54f6fda87ba0a248de7cba5c78f96.tar.gz efi-boot-shim-b8d1bc6e98e54f6fda87ba0a248de7cba5c78f96.zip | |
Verify the EFI images with MOK blacklist
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
| -rw-r--r-- | shim.c | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -519,6 +519,7 @@ static EFI_STATUS check_blacklist (WIN_CERTIFICATE_EFI_PKCS *cert, UINT8 *sha256hash, UINT8 *sha1hash) { EFI_GUID secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; + EFI_GUID shim_var = SHIM_LOCK_GUID; EFI_SIGNATURE_LIST *dbx = (EFI_SIGNATURE_LIST *)vendor_dbx; if (check_db_hash_in_ram(dbx, vendor_dbx_size, sha256hash, @@ -542,6 +543,14 @@ static EFI_STATUS check_blacklist (WIN_CERTIFICATE_EFI_PKCS *cert, if (cert && check_db_cert(L"dbx", secure_var, cert, sha256hash) == DATA_FOUND) return EFI_ACCESS_DENIED; + if (check_db_hash(L"MokListX", shim_var, sha256hash, SHA256_DIGEST_SIZE, + EFI_CERT_SHA256_GUID) == DATA_FOUND) { + return EFI_ACCESS_DENIED; + } + if (cert && check_db_cert(L"MokListX", shim_var, cert, sha256hash) == + DATA_FOUND) { + return EFI_ACCESS_DENIED; + } return EFI_SUCCESS; } |