SBAT: mirror SBAT to SbatRT and extend to PCR7 + log

This adds SBAT to our table of variables to mirror with our MoK state.
Currently it mirrors "SBAT" to a variable named "SbatRT", both using the
SHIM GUID.

Currently we enforce the current policy WRT these variables:

- we always delete SbatRT if it's present, for a couple of reasons:
 - If we got here either something created it before us during boot,
   which isn't a thing we believe anything should be doing, or it's an
   NV variable, which it shouldn't be.
 - we want to raise the error if it's NV+Authenticated
- we always delete SBAT (and do not mirror it) if it either
  - doesn't have BS|NV set or
  - does have RT set
    - we're requiring !RT because we can't actually tell if it's an
      authenticated variable or not, and we want to get the error if RT
      is set and it is authenticated, because that means we've lost the
      race between us and an attacker to create it.
- we always measure SBAT into PCR7 and add a log extension with the
  measured hash

Signed-off-by: Peter Jones <pjones@redhat.com>

0 files changed, 0 insertions, 0 deletions