diff options
| author | Matthew Garrett <mjg@redhat.com> | 2012-10-18 17:43:53 -0400 |
|---|---|---|
| committer | Matthew Garrett <mjg@redhat.com> | 2012-10-18 17:43:53 -0400 |
| commit | 801d1b936be96f0d22fd5b91af973cafc1fcb68c (patch) | |
| tree | 1beaeebe50cc02d06d2f3d1a675d8fc3b537f6a1 /shim.c | |
| parent | d08ea5363cec6f0159112aec1658d57fbaf1e471 (diff) | |
| download | efi-boot-shim-801d1b936be96f0d22fd5b91af973cafc1fcb68c.tar.gz efi-boot-shim-801d1b936be96f0d22fd5b91af973cafc1fcb68c.zip | |
Add MOK password auth
Add support for setting an MOK password. The OS passes down a password hash.
MokManager then presents an option for setting a password. Selecting it
prompts the user for the same password again. If they match, the hash is
enrolled into a boot services variable and MokManager will prompt for the
password whenever it's started.
Diffstat (limited to 'shim.c')
| -rw-r--r-- | shim.c | 16 |
1 files changed, 11 insertions, 5 deletions
@@ -1038,23 +1038,29 @@ done: EFI_STATUS check_mok_request(EFI_HANDLE image_handle) { EFI_GUID shim_lock_guid = SHIM_LOCK_GUID; - EFI_STATUS moknew_status, moksb_status, efi_status; + EFI_STATUS moknew_status, moksb_status, mokpw_status, efi_status; UINTN size = sizeof(UINT32); - UINT32 MokNew; + UINT32 MokVar; UINT32 attributes; moknew_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokNew", &shim_lock_guid, &attributes, - &size, (void *)&MokNew); + &size, (void *)&MokVar); moksb_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokSB", &shim_lock_guid, &attributes, - &size, (void *)&MokNew); + &size, (void *)&MokVar); + + mokpw_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokPW", + &shim_lock_guid, &attributes, + &size, (void *)&MokVar); if (moknew_status == EFI_SUCCESS || moknew_status == EFI_BUFFER_TOO_SMALL || moksb_status == EFI_SUCCESS || - moksb_status == EFI_BUFFER_TOO_SMALL) { + moksb_status == EFI_BUFFER_TOO_SMALL || + mokpw_status == EFI_SUCCESS || + mokpw_status == EFI_BUFFER_TOO_SMALL) { efi_status = start_image(image_handle, MOK_MANAGER); if (efi_status != EFI_SUCCESS) { |