summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--MokManager.c34
-rw-r--r--include/variables.h2
-rw-r--r--lib/Makefile2
-rw-r--r--lib/variables.c1
-rw-r--r--shim.c78
5 files changed, 31 insertions, 86 deletions
diff --git a/MokManager.c b/MokManager.c
index b01c65ec..805017b6 100644
--- a/MokManager.c
+++ b/MokManager.c
@@ -9,6 +9,7 @@
#include "guid.h"
#include "console.h"
+#include "variables.h"
#include "simple_file.h"
#include "efiauthenticated.h"
@@ -50,32 +51,6 @@ typedef struct {
CHAR16 Password[SB_PASSWORD_LEN];
} __attribute__ ((packed)) MokSBvar;
-static EFI_STATUS get_variable (CHAR16 *name, EFI_GUID guid, UINT32 *attributes,
- UINTN *size, void **buffer)
-{
- EFI_STATUS efi_status;
- char allocate = !(*size);
-
- efi_status = uefi_call_wrapper(RT->GetVariable, 5, name, &guid,
- attributes, size, buffer);
-
- if (efi_status != EFI_BUFFER_TOO_SMALL || !allocate) {
- return efi_status;
- }
-
- *buffer = AllocatePool(*size);
-
- if (!*buffer) {
- console_notify(L"Unable to allocate variable buffer");
- return EFI_OUT_OF_RESOURCES;
- }
-
- efi_status = uefi_call_wrapper(RT->GetVariable, 5, name, &guid,
- attributes, size, *buffer);
-
- return efi_status;
-}
-
static EFI_STATUS get_sha1sum (void *Data, int DataSize, UINT8 *hash)
{
EFI_STATUS status;
@@ -904,7 +879,7 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize)
UINT8 auth[PASSWORD_CRYPT_SIZE];
UINTN auth_size = PASSWORD_CRYPT_SIZE;
UINT32 attributes;
- void *MokListData = NULL;
+ UINT8 *MokListData = NULL;
UINTN MokListDataSize = 0;
MokListNode *mok, *del_key;
INTN mok_num, del_num;
@@ -929,9 +904,8 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize)
if (efi_status != EFI_SUCCESS)
return EFI_ACCESS_DENIED;
- efi_status = get_variable(L"MokList", shim_lock_guid, &attributes,
- &MokListDataSize, &MokListData);
-
+ efi_status = get_variable_attr (L"MokList", &MokListData, &MokListDataSize,
+ shim_lock_guid, &attributes);
if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
console_alertbox((CHAR16 *[]){L"MokList is compromised!",
L"Erase all keys in MokList!",
diff --git a/include/variables.h b/include/variables.h
index c171bd53..b207dbf3 100644
--- a/include/variables.h
+++ b/include/variables.h
@@ -1,6 +1,6 @@
#include <efiauthenticated.h>
-#include <sha256.h> /* for SHA256_DIGEST_SIZE */
+#include <PeImage.h> /* for SHA256_DIGEST_SIZE */
#define certlist_for_each_certentry(cl, cl_init, s, s_init) \
for (cl = (EFI_SIGNATURE_LIST *)(cl_init), s = (s_init); \
diff --git a/lib/Makefile b/lib/Makefile
index 43907005..e85c1fd5 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -1,6 +1,6 @@
TARGET = lib.a
-LIBFILES = simple_file.o guid.o console.o execute.o configtable.o shell.o
+LIBFILES = simple_file.o guid.o console.o execute.o configtable.o shell.o variables.o
ARCH = $(shell uname -m | sed s,i[3456789]86,ia32,)
diff --git a/lib/variables.c b/lib/variables.c
index 9db64809..81bd34db 100644
--- a/lib/variables.c
+++ b/lib/variables.c
@@ -27,7 +27,6 @@
#include <variables.h>
#include <guid.h>
#include <console.h>
-#include <sha256.h>
#include <errors.h>
EFI_STATUS
diff --git a/shim.c b/shim.c
index 9ffc94a6..c2d54c44 100644
--- a/shim.c
+++ b/shim.c
@@ -43,6 +43,7 @@
#include "ucs2.h"
#include "guid.h"
+#include "variables.h"
#include "efiauthenticated.h"
#define FALLBACK L"\\fallback.efi"
@@ -81,32 +82,6 @@ typedef struct {
UINT8 *Mok;
} MokListNode;
-static EFI_STATUS get_variable (CHAR16 *name, EFI_GUID guid, UINT32 *attributes,
- UINTN *size, void **buffer)
-{
- EFI_STATUS efi_status;
- char allocate = !(*size);
-
- efi_status = uefi_call_wrapper(RT->GetVariable, 5, name, &guid,
- attributes, size, buffer);
-
- if (efi_status != EFI_BUFFER_TOO_SMALL || !allocate) {
- return efi_status;
- }
-
- *buffer = AllocatePool(*size);
-
- if (!*buffer) {
- Print(L"Unable to allocate variable buffer\n");
- return EFI_OUT_OF_RESOURCES;
- }
-
- efi_status = uefi_call_wrapper(RT->GetVariable, 5, name, &guid,
- attributes, size, *buffer);
-
- return efi_status;
-}
-
/*
* Perform basic bounds checking of the intra-image pointers
*/
@@ -270,15 +245,14 @@ static CHECK_STATUS check_db_cert(CHAR16 *dbname, EFI_GUID guid,
EFI_STATUS efi_status;
EFI_SIGNATURE_LIST *CertList;
UINTN dbsize = 0;
- UINT32 attributes;
- void *db;
+ UINT8 *db;
- efi_status = get_variable(dbname, guid, &attributes, &dbsize, &db);
+ efi_status = get_variable(dbname, &db, &dbsize, guid);
if (efi_status != EFI_SUCCESS)
return VAR_NOT_FOUND;
- CertList = db;
+ CertList = (EFI_SIGNATURE_LIST *)db;
rc = check_db_cert_in_ram(CertList, dbsize, data, hash);
@@ -336,17 +310,16 @@ static CHECK_STATUS check_db_hash(CHAR16 *dbname, EFI_GUID guid, UINT8 *data,
{
EFI_STATUS efi_status;
EFI_SIGNATURE_LIST *CertList;
- UINT32 attributes;
UINTN dbsize = 0;
- void *db;
+ UINT8 *db;
- efi_status = get_variable(dbname, guid, &attributes, &dbsize, &db);
+ efi_status = get_variable(dbname, &db, &dbsize, guid);
if (efi_status != EFI_SUCCESS) {
return VAR_NOT_FOUND;
}
- CertList = db;
+ CertList = (EFI_SIGNATURE_LIST *)db;
CHECK_STATUS rc = check_db_hash_in_ram(CertList, dbsize, data,
SignatureSize, CertType);
@@ -423,15 +396,16 @@ static BOOLEAN secure_mode (void)
{
EFI_STATUS status;
EFI_GUID global_var = EFI_GLOBAL_VARIABLE;
- UINTN charsize = sizeof(char);
+ UINTN len;
+ UINT8 *Data;
UINT8 sb, setupmode;
- UINT32 attributes;
if (insecure_mode)
return FALSE;
- status = get_variable(L"SecureBoot", global_var, &attributes, &charsize,
- (void *)&sb);
+ status = get_variable(L"SecureBoot", &Data, &len, global_var);
+ sb = *Data;
+ FreePool(Data);
/* FIXME - more paranoia here? */
if (status != EFI_SUCCESS || sb != 1) {
@@ -440,8 +414,9 @@ static BOOLEAN secure_mode (void)
return FALSE;
}
- status = get_variable(L"SetupMode", global_var, &attributes, &charsize,
- (void *)&setupmode);
+ status = get_variable(L"SetupMode", &Data, &len, global_var);
+ setupmode = *Data;
+ FreePool(Data);
if (status == EFI_SUCCESS && setupmode == 1) {
if (verbose)
@@ -629,12 +604,12 @@ done:
static EFI_STATUS verify_mok (void) {
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS status = EFI_SUCCESS;
- void *MokListData = NULL;
+ UINT8 *MokListData = NULL;
UINTN MokListDataSize = 0;
UINT32 attributes;
- status = get_variable(L"MokList", shim_lock_guid, &attributes,
- &MokListDataSize, &MokListData);
+ status = get_variable_attr(L"MokList", &MokListData, &MokListDataSize,
+ shim_lock_guid, &attributes);
if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
Print(L"MokList is compromised!\nErase all keys in MokList!\n");
@@ -1325,12 +1300,10 @@ EFI_STATUS mirror_mok_list()
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
- UINT32 attributes;
- void *Data = NULL;
+ UINT8 *Data = NULL;
UINTN DataSize = 0;
- efi_status = get_variable(L"MokList", shim_lock_guid, &attributes,
- &DataSize, &Data);
+ efi_status = get_variable(L"MokList", &Data, &DataSize, shim_lock_guid);
if (efi_status != EFI_SUCCESS) {
goto done;
@@ -1400,12 +1373,12 @@ static EFI_STATUS check_mok_sb (void)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS status = EFI_SUCCESS;
- void *MokSBState = NULL;
+ UINT8 *MokSBState = NULL;
UINTN MokSBStateSize = 0;
UINT32 attributes;
- status = get_variable(L"MokSBState", shim_lock_guid, &attributes,
- &MokSBStateSize, &MokSBState);
+ status = get_variable_attr(L"MokSBState", &MokSBState, &MokSBStateSize,
+ shim_lock_guid, &attributes);
if (status != EFI_SUCCESS)
return EFI_ACCESS_DENIED;
@@ -1517,7 +1490,6 @@ EFI_STATUS efi_main (EFI_HANDLE image_handle, EFI_SYSTEM_TABLE *passed_systab)
EFI_STATUS efi_status;
UINT8 verbose_check;
UINTN verbose_check_size;
- UINT32 attributes;
EFI_GUID global_var = EFI_GLOBAL_VARIABLE;
/*
@@ -1536,8 +1508,8 @@ EFI_STATUS efi_main (EFI_HANDLE image_handle, EFI_SYSTEM_TABLE *passed_systab)
InitializeLib(image_handle, systab);
verbose_check_size = 1;
- efi_status = get_variable(L"SHIM_VERBOSE", global_var, &attributes,
- &verbose_check_size, (void *)&verbose_check);
+ efi_status = get_variable(L"SHIM_VERBOSE", (void *)&verbose_check,
+ &verbose_check_size, global_var);
if (!EFI_ERROR(efi_status))
verbose = verbose_check;
generated by cgit v1.2.3 (git 2.39.1) at 2025-12-17 20:51:02 +0000