diff options
| author | Jan Setje-Eilers <jan.setjeeilers@oracle.com> | 2025-02-03 20:15:09 -0500 |
|---|---|---|
| committer | Peter Jones <pjones@redhat.com> | 2025-02-05 09:10:35 -0500 |
| commit | 5ae408aede0a410f28de92a5fdc5ce406f2c4515 (patch) | |
| tree | f565bbdf4f77bf06fe3b8da5e4db1ba95229e422 /include | |
| parent | 743f3fa0e40c3971b3ea9c5eb7724cbf2a91c282 (diff) | |
| download | efi-boot-shim-5ae408aede0a410f28de92a5fdc5ce406f2c4515.tar.gz efi-boot-shim-5ae408aede0a410f28de92a5fdc5ce406f2c4515.zip | |
Generate and use generated_sbat_var_defs.h
Build changes to generate include/generated_sbat_var_defs.h from
SbatLevel_Variable.txt and use that header file. From here on
forward SbatLevel_Variable.txt should be the only place a new
revocation needs to be recorded.
Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/sbat_var_defs.h | 47 |
1 files changed, 4 insertions, 43 deletions
diff --git a/include/sbat_var_defs.h b/include/sbat_var_defs.h index 5c7115b9..f4f5a27b 100644 --- a/include/sbat_var_defs.h +++ b/include/sbat_var_defs.h @@ -7,7 +7,9 @@ #define QUOTE(s) #s /* - * This is the entry for the sbat data format + * SbatLevel Epoch and SHIM_DEVEL definitions are here + * Actual revocations are now soley defined in + * SbatLevel_Variable.txt */ #define SBAT_VAR_SIG "sbat," #define SBAT_VAR_VERSION "1," @@ -22,51 +24,10 @@ #define SBAT_VAR_LATEST_DATE "2022050100" #define SBAT_VAR_LATEST_REVOCATIONS "component,2\nothercomponent,2\n" -#define SBAT_VAR_LATEST \ - SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \ - SBAT_VAR_LATEST_REVOCATIONS -#else /* !ENABLE_SHIM_DEVEL */ - -/* - * Some distros may want to apply revocations from 2022052400 - * or 2022111500 automatically. They can be selected by setting - * SBAT_AUTOMATIC_DATE=<datestamp> at build time. Otherwise the - * default is to apply the second to most recent revocations - * automatically. Distros that need to manage automatic updates - * externally from shim can choose the epoch 2021030218 emtpy - * revocations. - */ -#ifndef SBAT_AUTOMATIC_DATE -#define SBAT_AUTOMATIC_DATE 2023012900 -#endif /* SBAT_AUTOMATIC_DATE */ -#if SBAT_AUTOMATIC_DATE == 2021030218 -#define SBAT_VAR_AUTOMATIC_REVOCATIONS -#elif SBAT_AUTOMATIC_DATE == 2022052400 -#define SBAT_VAR_AUTOMATIC_REVOCATIONS "grub,2\n" -#elif SBAT_AUTOMATIC_DATE == 2022111500 -#define SBAT_VAR_AUTOMATIC_REVOCATIONS "shim,2\ngrub,3\n" -#elif SBAT_AUTOMATIC_DATE == 2023012900 -#define SBAT_VAR_AUTOMATIC_REVOCATIONS "shim,2\ngrub,3\ngrub.debian,4\n" -#elif SBAT_AUTOMATIC_DATE == 2024010900 -#define SBAT_VAR_AUTOMATIC_REVOCATIONS "shim,4\ngrub,3\ngrub.debian,4\n" -#else -#error "Unknown SBAT_AUTOMATIC_DATE" -#endif /* SBAT_AUTOMATIC_DATE == */ -#define SBAT_VAR_AUTOMATIC_DATE QUOTEVAL(SBAT_AUTOMATIC_DATE) -#define SBAT_VAR_AUTOMATIC \ - SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_AUTOMATIC_DATE "\n" \ - SBAT_VAR_AUTOMATIC_REVOCATIONS -/* - * Revocations for: - * - January 2024 shim CVEs - * - October 2023 grub CVEs - * - Debian/Ubuntu (peimage) CVE-2024-2312 - */ -#define SBAT_VAR_LATEST_DATE "2024040900" -#define SBAT_VAR_LATEST_REVOCATIONS "shim,4\ngrub,4\ngrub.peimage,2\n" #define SBAT_VAR_LATEST \ SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \ SBAT_VAR_LATEST_REVOCATIONS #endif /* ENABLE_SHIM_DEVEL */ + #endif /* !SBAT_VAR_DEFS_H_ */ |