summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitignore1
-rw-r--r--BUILDING61
-rw-r--r--Cryptlib/Makefile2
-rw-r--r--Cryptlib/OpenSSL/Makefile2
-rw-r--r--Makefile235
-rw-r--r--MokVars.txt5
-rw-r--r--README7
-rw-r--r--README.tpm22
-rw-r--r--TODO37
-rw-r--r--buildid.c192
-rw-r--r--commit2
-rw-r--r--debian/canonical-uefi-ca.derbin1080 -> 0 bytes
-rw-r--r--debian/changelog226
-rw-r--r--debian/compat1
-rw-r--r--debian/control18
-rw-r--r--debian/copyright254
-rw-r--r--debian/debian-uefi-ca.derbin930 -> 0 bytes
-rw-r--r--debian/patches/gcc-5.diff45
-rw-r--r--debian/patches/gcc5-includes-stdarg.patch129
-rw-r--r--debian/patches/prototypes191
-rw-r--r--debian/patches/sbsigntool-not-pesign26
-rw-r--r--debian/patches/series1
-rwxr-xr-xdebian/rules31
-rw-r--r--debian/shim.install3
-rw-r--r--debian/source/format1
-rw-r--r--debian/source/include-binaries2
-rw-r--r--debian/watch5
-rw-r--r--fallback.c125
-rw-r--r--shim.c122
-rw-r--r--tpm.c250
-rw-r--r--tpm.h32
31 files changed, 949 insertions, 1079 deletions
diff --git a/.gitignore b/.gitignore
index 586bc246..d0d91293 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
certdb
shim_cert.h
*.a
+*.CSV
*.cer
*.crl
*.crt
diff --git a/BUILDING b/BUILDING
new file mode 100644
index 00000000..461b85c4
--- /dev/null
+++ b/BUILDING
@@ -0,0 +1,61 @@
+It's pretty straightforward:
+
+cp $MY_DER_ENCODED_CERT pub.cer
+make VENDOR_CERT_FILE=pub.cer
+make EFIDIR=my_esp_dir_name install
+
+There are a couple of ways to customize the build:
+
+Install targets:
+- install
+ installs shim as if to a hard drive, including installing MokManager and
+ fallback appropriately.
+- install-as-data
+ installs shim files to /usr/share/shim/$(EFI_ARCH)-$(VERSION)/
+
+Variables you should set to customize the build:
+- EFIDIR
+ This is the name of the ESP directory. The install targets won't work
+ without it.
+- DESTDIR
+ This will be prepended to any install targets, so you don't have to
+ install to a live root directory.
+- DEFAULT_LOADER
+ defaults to \\\\grub$(EFI_ARCH).efi , but you could set it to whatever.
+ Be careful with the leading backslashes, they can be hard to get
+ correct.
+
+Variables you could set to customize the build:
+- ENABLE_SHIM_CERT
+ if this variable is defined one the make command line, shim will
+ generate keys during the build and sign MokManager and fallback with
+ them, and the signed version will be what gets installed with the
+ install targets
+- ENABLE_HTTPBOOT
+ build support for http booting
+- ARCH
+ This allows you to do a build for a different arch that we support. For
+ instance, on x86_64 you could do "setarch linux32 make ARCH=ia32" to get
+ the ia32 build instead. (DEFAULT_LOADER will be automatically adjusted
+ in that case.)
+- TOPDIR
+ You can use this along with make -f to build in a subdir. For instance,
+ on an x86_64 machine you could do:
+
+ mkdir build-ia32 build-x64 inst
+ cd build-ia32
+ setarch linux32 make TOPDIR=.. ARCH=ia32 -f ../Makefile
+ setarch linux32 make TOPDIR=.. ARCH=ia32 \
+ DESTDIR=../inst EFIDIR=debian \
+ -f ../Makefile install
+ cd ../build-x64
+ make TOPDIR=.. -f ../Makefile
+ make TOPDIR=.. DESTDIR=../inst EFIDIR=debian \
+ -f ../Makefile install
+
+ That would get you x86_64 and ia32 builds in the "inst" subdir.
+- OSLABEL
+ This is the label that will be put in BOOT$(EFI_ARCH).CSV for your OS.
+ By default this is the same value as EFIDIR .
+
+# vim:filetype=mail:tw=74
diff --git a/Cryptlib/Makefile b/Cryptlib/Makefile
index a5e02d4d..a025ac53 100644
--- a/Cryptlib/Makefile
+++ b/Cryptlib/Makefile
@@ -8,7 +8,7 @@ CFLAGS = -ggdb -O0 -I$(TOPDIR) -iquote $(TOPDIR) -fno-stack-protector -fno-stri
ifeq ($(ARCH),x86_64)
CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args \
-DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI -DNO_BUILTIN_VA_FUNCS \
- -DMDE_CPU_IA64
+ -DMDE_CPU_X64
endif
ifeq ($(ARCH),ia32)
CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args -m32 \
diff --git a/Cryptlib/OpenSSL/Makefile b/Cryptlib/OpenSSL/Makefile
index 4319afde..4c683bf5 100644
--- a/Cryptlib/OpenSSL/Makefile
+++ b/Cryptlib/OpenSSL/Makefile
@@ -11,7 +11,7 @@ CFLAGS = -ggdb -O0 -I$(TOPDIR) -I$(TOPDIR)/.. -I$(TOPDIR)/../Include/ -I$(TOPDI
ifeq ($(ARCH),x86_64)
CFLAGS += -mno-mmx -mno-sse -mno-red-zone -maccumulate-outgoing-args \
-DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI \
- -UNO_BUILTIN_VA_FUNCS -DMDE_CPU_IA64
+ -UNO_BUILTIN_VA_FUNCS -DMDE_CPU_X64
endif
ifeq ($(ARCH),ia32)
CFLAGS += -mno-mmx -mno-sse -mno-red-zone -maccumulate-outgoing-args \
diff --git a/Makefile b/Makefile
index fb5ab276..afd65045 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,8 @@
VERSION = 12
-RELEASE :=
-ifneq ($(RELEASE),"")
- RELEASE:="-$(RELEASE)"
+ifneq ($(origin RELEASE),undefined)
+DASHRELEASE ?= -$(RELEASE)
+else
+DASHRELEASE ?=
endif
ifeq ($(MAKELEVEL),0)
@@ -10,18 +11,31 @@ endif
override TOPDIR := $(abspath $(TOPDIR))
VPATH = $(TOPDIR)
-
CC = $(CROSS_COMPILE)gcc
LD = $(CROSS_COMPILE)ld
OBJCOPY = $(CROSS_COMPILE)objcopy
OPENSSL ?= openssl
HEXDUMP ?= hexdump
+INSTALL ?= install
PK12UTIL ?= pk12util
CERTUTIL ?= certutil
PESIGN ?= pesign
+SBSIGN ?= sbsign
+prefix ?= /usr
+prefix := $(abspath $(prefix))
+datadir ?= $(prefix)/share/
+PKGNAME ?= shim
+ESPROOTDIR ?= boot/efi/
+EFIBOOTDIR ?= $(ESPROOTDIR)EFI/BOOT/
+TARGETDIR ?= $(ESPROOTDIR)EFI/$(EFIDIR)/
+DATATARGETDIR ?= $(datadir)/$(PKGNAME)/$(VERSION)$(DASHRELEASE)/$(ARCH_SUFFIX)/
+DEBUGINFO ?= $(prefix)/lib/debug/
+DEBUGSOURCE ?= $(prefix)/src/debug/
+OSLABEL ?= $(EFIDIR)
+DEFAULT_LOADER ?= \\\\grub$(ARCH_SUFFIX).efi
ARCH ?= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
-OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.*\((.*)\|version\) //g' | cut -f1-2 -d.` \>= 2.24)
+OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.*\((.*)\|version\) //g' | cut -f1-2 -d.` \>= 2.24)
SUBDIRS = $(TOPDIR)/Cryptlib $(TOPDIR)/lib
@@ -36,7 +50,6 @@ EFI_LIBS = -lefi -lgnuefi --start-group Cryptlib/libcryptlib.a Cryptlib/OpenSSL/
EFI_CRT_OBJS = $(EFI_PATH)/crt0-efi-$(ARCH).o
EFI_LDS = $(TOPDIR)/elf_$(ARCH)_efi.lds
-DEFAULT_LOADER := \\\\grub.efi
CFLAGS = -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic \
-fshort-wchar -Wall -Wsign-compare -Werror -fno-builtin \
-Werror=sign-compare -ffreestanding -std=gnu89 \
@@ -44,9 +57,6 @@ CFLAGS = -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic \
"-DDEFAULT_LOADER=L\"$(DEFAULT_LOADER)\"" \
"-DDEFAULT_LOADER_CHAR=\"$(DEFAULT_LOADER)\"" \
$(EFI_INCLUDES)
-SHIMNAME = shim
-MMNAME = MokManager
-FBNAME = fallback
COMMITID ?= $(shell if [ -d .git ] ; then git log -1 --pretty=format:%H ; elif [ -f commit ]; then cat commit ; else echo commit id not available; fi)
@@ -60,39 +70,58 @@ endif
ifeq ($(ARCH),x86_64)
CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc \
- -maccumulate-outgoing-args \
- -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI \
- -DNO_BUILTIN_VA_FUNCS \
- -DMDE_CPU_X64 "-DEFI_ARCH=L\"x64\"" -DPAGE_SIZE=4096 \
- "-DDEBUGDIR=L\"/usr/lib/debug/usr/share/shim/x64-$(VERSION)$(RELEASE)/\""
- MMNAME = mmx64
- FBNAME = fbx64
- SHIMNAME= shimx64
- EFI_PATH:=/usr/lib64/gnuefi
- LIB_PATH:=/usr/lib64
-
+ -maccumulate-outgoing-args \
+ -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI \
+ -DNO_BUILTIN_VA_FUNCS -DMDE_CPU_X64 -DPAGE_SIZE=4096
+ LIBDIR ?= $(prefix)/lib64
+ ARCH_SUFFIX ?= x64
+ ARCH_SUFFIX_UPPER ?= X64
endif
ifeq ($(ARCH),ia32)
CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc \
- -maccumulate-outgoing-args -m32 \
- -DMDE_CPU_IA32 "-DEFI_ARCH=L\"ia32\"" -DPAGE_SIZE=4096 \
- "-DDEBUGDIR=L\"/usr/lib/debug/usr/share/shim/ia32-$(VERSION)$(RELEASE)/\""
- MMNAME = mmia32
- FBNAME = fbia32
- SHIMNAME= shimia32
- EFI_PATH:=/usr/lib/gnuefi
- LIB_PATH:=/usr/lib
+ -maccumulate-outgoing-args -m32 \
+ -DMDE_CPU_IA32 -DPAGE_SIZE=4096
+ LIBDIR ?= $(prefix)/lib
+ ARCH_SUFFIX ?= ia32
+ ARCH_SUFFIX_UPPER ?= IA32
endif
ifeq ($(ARCH),aarch64)
- CFLAGS += -DMDE_CPU_AARCH64 "-DEFI_ARCH=L\"aa64\"" -DPAGE_SIZE=4096 \
- "-DDEBUGDIR=L\"/usr/lib/debug/usr/share/shim/aa64-$(VERSION)$(RELEASE)/\""
- MMNAME = mmaa64
- FBNAME = fbaa64
- SHIMNAME= shimaa64
- EFI_PATH:=/usr/lib64/gnuefi
- LIB_PATH:=/usr/lib64
+ CFLAGS += -DMDE_CPU_AARCH64 -DPAGE_SIZE=4096 -mstrict-align
+ LIBDIR ?= $(prefix)/lib64
+ ARCH_SUFFIX ?= aa64
+ ARCH_SUFFIX_UPPER ?= AA64
+ FORMAT := -O binary
+ SUBSYSTEM := 0xa
+ LDFLAGS += --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
+endif
+ifeq ($(ARCH),arm)
+ CFLAGS += -DMDE_CPU_ARM -DPAGE_SIZE=4096 -mstrict-align
+ LIBDIR ?= $(prefix)/lib
+ ARCH_SUFFIX ?= arm
+ ARCH_SUFFIX_UPPER ?= ARM
+ FORMAT := -O binary
+ SUBSYSTEM := 0xa
+ LDFLAGS += --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
endif
+FORMAT ?= --target efi-app-$(ARCH)
+EFI_PATH ?= $(LIBDIR)/gnuefi
+
+MMSTEM ?= mm$(ARCH_SUFFIX)
+MMNAME = $(MMSTEM).efi
+MMSONAME = $(MMSTEM).so
+FBSTEM ?= fb$(ARCH_SUFFIX)
+FBNAME = $(FBSTEM).efi
+FBSONAME = $(FBSTEM).so
+SHIMSTEM ?= shim$(ARCH_SUFFIX)
+SHIMNAME = $(SHIMSTEM).efi
+SHIMSONAME = $(SHIMSTEM).so
+SHIMHASHNAME = $(SHIMSTEM).hash
+BOOTEFINAME ?= BOOT$(ARCH_SUFFIX_UPPER).EFI
+BOOTCSVNAME ?= BOOT$(ARCH_SUFFIX_UPPER).CSV
+
+CFLAGS += "-DEFI_ARCH=L\"$(ARCH_SUFFIX)\"" "-DDEBUGDIR=L\"/usr/lib/debug/usr/share/shim/$(ARCH_SUFFIX)-$(VERSION)$(DASHRELEASE)/\""
+
ifneq ($(origin VENDOR_CERT_FILE), undefined)
CFLAGS += -DVENDOR_CERT_FILE=\"$(VENDOR_CERT_FILE)\"
endif
@@ -100,15 +129,25 @@ ifneq ($(origin VENDOR_DBX_FILE), undefined)
CFLAGS += -DVENDOR_DBX_FILE=\"$(VENDOR_DBX_FILE)\"
endif
-LDFLAGS = --hash-style=sysv -nostdlib -znocombreloc -T $(EFI_LDS) -shared -Bsymbolic -L$(EFI_PATH) -L$(LIB_PATH) -LCryptlib -LCryptlib/OpenSSL $(EFI_CRT_OBJS) --build-id=sha1
+LDFLAGS = --hash-style=sysv -nostdlib -znocombreloc -T $(EFI_LDS) -shared -Bsymbolic -L$(EFI_PATH) -L$(LIBDIR) -LCryptlib -LCryptlib/OpenSSL $(EFI_CRT_OBJS) --build-id=sha1
-TARGET = $(SHIMNAME).efi $(MMNAME).efi.signed $(FBNAME).efi.signed
+TARGETS = $(SHIMNAME)
+TARGETS += $(SHIMNAME).debug $(MMNAME).debug $(FBNAME).debug
+ifneq ($(origin ENABLE_SHIM_HASH),undefined)
+TARGETS += $(SHIMHASHNAME)
+endif
+ifneq ($(origin ENABLE_SHIM_CERT),undefined)
+TARGETS += $(MMNAME).signed $(FBNAME).signed
+CFLAGS += -DENABLE_SHIM_CERT
+else
+TARGETS += $(MMNAME) $(FBNAME)
+endif
OBJS = shim.o netboot.o cert.o replacements.o tpm.o version.o
KEYS = shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer
ORIG_SOURCES = shim.c shim.h netboot.c include/PeImage.h include/wincert.h include/console.h replacements.c replacements.h tpm.c tpm.h version.h
MOK_OBJS = MokManager.o PasswordCrypt.o crypt_blowfish.o
ORIG_MOK_SOURCES = MokManager.c shim.h include/console.h PasswordCrypt.c PasswordCrypt.h crypt_blowfish.c crypt_blowfish.h
-FALLBACK_OBJS = fallback.o
+FALLBACK_OBJS = fallback.o tpm.o
ORIG_FALLBACK_SRCS = fallback.c
ifneq ($(origin ENABLE_HTTPBOOT), undefined)
@@ -120,7 +159,7 @@ SOURCES = $(foreach source,$(ORIG_SOURCES),$(TOPDIR)/$(source)) version.c
MOK_SOURCES = $(foreach source,$(ORIG_MOK_SOURCES),$(TOPDIR)/$(source))
FALLBACK_SRCS = $(foreach source,$(ORIG_FALLBACK_SRCS),$(TOPDIR)/$(source))
-all: $(TARGET)
+all: $(TARGETS)
shim.crt:
$(TOPDIR)/make-certs shim shim@xn--u4h.net all codesign 1.3.6.1.4.1.311.10.3.1 </dev/null
@@ -144,23 +183,30 @@ certdb/secmod.db: shim.crt
$(PK12UTIL) -d certdb/ -i shim.p12 -W "" -K ""
$(CERTUTIL) -d certdb/ -A -i shim.crt -n shim -t u
-shim.o: $(SOURCES) shim_cert.h
-shim.o: $(wildcard $(TOPDIR)/*.h *.h)
+shim.o: $(SOURCES)
+ifneq ($(origin ENABLE_SHIM_CERT),undefined)
+shim.o: shim_cert.h
+endif
+shim.o: $(wildcard $(TOPDIR)/*.h)
cert.o : $(TOPDIR)/cert.S
$(CC) $(CFLAGS) -c -o $@ $<
-$(SHIMNAME).so: $(OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
+$(SHIMNAME) : $(SHIMSONAME)
+$(MMNAME) : $(MMSONAME)
+$(FBNAME) : $(FBSONAME)
+
+$(SHIMSONAME): $(OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
$(LD) -o $@ $(LDFLAGS) $^ $(EFI_LIBS)
fallback.o: $(FALLBACK_SRCS)
-$(FBNAME).so: $(FALLBACK_OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
+$(FBSONAME): $(FALLBACK_OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
$(LD) -o $@ $(LDFLAGS) $^ $(EFI_LIBS)
MokManager.o: $(MOK_SOURCES)
-$(MMNAME).so: $(MOK_OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
+$(MMSONAME): $(MOK_OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
$(LD) -o $@ $(LDFLAGS) $^ $(EFI_LIBS) lib/lib.a
Cryptlib/libcryptlib.a:
@@ -175,39 +221,112 @@ lib/lib.a:
if [ ! -d lib ]; then mkdir lib ; fi
$(MAKE) VPATH=$(TOPDIR)/lib TOPDIR=$(TOPDIR) CFLAGS="$(CFLAGS)" -C lib -f $(TOPDIR)/lib/Makefile
-ifeq ($(ARCH),aarch64)
-FORMAT := -O binary
-SUBSYSTEM := 0xa
-LDFLAGS += --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
+buildid : $(TOPDIR)/buildid.c
+ $(CC) -Og -g3 -Wall -Werror -Wextra -o $@ $< -lelf
+
+$(BOOTCSVNAME) :
+ @echo Making $@
+ @( printf "\xff\xfe" ; echo "$(SHIMNAME),$(OSLABEL),,This is the boot entry for $(OSLABEL)" | sed -z 's/./&\x00/g' ) > $@
+
+install-check :
+ifeq ($(origin LIBDIR),undefined)
+ $(error Architecture $(ARCH) is not a supported build target.)
+endif
+ifeq ($(origin EFIDIR),undefined)
+ $(error EFIDIR must be set to your reserved EFI System Partition subdirectory name)
endif
-ifeq ($(ARCH),arm)
-FORMAT := -O binary
-SUBSYSTEM := 0xa
-LDFLAGS += --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
+install-deps : $(TARGETS)
+install-deps : $(SHIMNAME).debug $(MMNAME).debug $(FBNAME).debug buildid
+install-deps : $(BOOTCSVNAME)
+
+install-debugsource : install-deps
+ $(INSTALL) -d -m 0755 $(DESTDIR)/$(DEBUGSOURCE)/$(PKGNAME)-$(VERSION)$(DASHRELEASE)
+ find $(TOPDIR) -type f -a '(' -iname '*.c' -o -iname '*.h' -o -iname '*.S' ')' | while read file ; do \
+ outfile=$$(echo $${file} | sed -e "s,^$(TOPDIR),,") ; \
+ $(INSTALL) -d -m 0755 $(DESTDIR)/$(DEBUGSOURCE)/$(PKGNAME)-$(VERSION)$(DASHRELEASE)/$$(dirname $${outfile}) ; \
+ $(INSTALL) -m 0644 $${file} $(DESTDIR)/$(DEBUGSOURCE)/$(PKGNAME)-$(VERSION)$(DASHRELEASE)/$${outfile} ; \
+ done
+
+install-debuginfo : install-deps
+ $(INSTALL) -d -m 0755 $(DESTDIR)/
+ $(INSTALL) -d -m 0755 $(DESTDIR)/$(DEBUGINFO)$(TARGETDIR)/
+ @./buildid $(wildcard *.efi.debug) | while read file buildid ; do \
+ first=$$(echo $${buildid} | cut -b -2) ; \
+ rest=$$(echo $${buildid} | cut -b 3-) ; \
+ $(INSTALL) -d -m 0755 $(DESTDIR)/$(DEBUGINFO).build-id/$${first}/ ;\
+ $(INSTALL) -m 0644 $${file} $(DESTDIR)/$(DEBUGINFO)$(TARGETDIR) ; \
+ ln -s ../../../../..$(DEBUGINFO)$(TARGETDIR)$${file} $(DESTDIR)/$(DEBUGINFO).build-id/$${first}/$${rest}.debug ;\
+ ln -s ../../../.build-id/$${first}/$${rest} $(DESTDIR)/$(DEBUGINFO).build-id/$${first}/$${rest} ;\
+ done
+
+install : | install-check
+install : install-deps install-debuginfo install-debugsource
+ $(INSTALL) -d -m 0755 $(DESTDIR)/
+ $(INSTALL) -d -m 0700 $(DESTDIR)/$(ESPROOTDIR)
+ $(INSTALL) -d -m 0755 $(DESTDIR)/$(EFIBOOTDIR)
+ $(INSTALL) -d -m 0755 $(DESTDIR)/$(TARGETDIR)
+ $(INSTALL) -m 0644 $(SHIMNAME) $(DESTDIR)/$(EFIBOOTDIR)/$(BOOTEFINAME)
+ $(INSTALL) -m 0644 $(SHIMNAME) $(DESTDIR)/$(TARGETDIR)/
+ $(INSTALL) -m 0644 $(BOOTCSVNAME) $(DESTDIR)/$(TARGETDIR)/
+ifneq ($(origin ENABLE_SHIM_CERT),undefined)
+ $(INSTALL) -m 0644 $(FBNAME).signed $(DESTDIR)/$(EFIBOOTDIR)/$(FBNAME)
+ $(INSTALL) -m 0644 $(MMNAME).signed $(DESTDIR)/$(EFIBOOTDIR)/$(MMNAME)
+ $(INSTALL) -m 0644 $(MMNAME).signed $(DESTDIR)/$(TARGETDIR)/$(MMNAME)
+else
+ $(INSTALL) -m 0644 $(FBNAME) $(DESTDIR)/$(EFIBOOTDIR)/
+ $(INSTALL) -m 0644 $(MMNAME) $(DESTDIR)/$(EFIBOOTDIR)/
+ $(INSTALL) -m 0644 $(MMNAME) $(DESTDIR)/$(TARGETDIR)/
endif
-FORMAT ?= --target efi-app-$(ARCH)
+install-as-data : install-deps
+ $(INSTALL) -d -m 0755 $(DESTDIR)/$(DATATARGETDIR)
+ $(INSTALL) -m 0644 $(SHIMNAME) $(DESTDIR)/$(DATATARGETDIR)/
+ifneq ($(origin ENABLE_SHIM_HASH),undefined)
+ $(INSTALL) -m 0644 $(SHIMHASHNAME) $(DESTDIR)/$(DATATARGETDIR)/
+endif
+ifneq ($(origin ENABLE_SHIM_CERT),undefined)
+ $(INSTALL) -m 0644 $(MMNAME).signed $(DESTDIR)/$(DATATARGETDIR)/$(MMNAME)
+ $(INSTALL) -m 0644 $(FBNAME).signed $(DESTDIR)/$(DATATARGETDIR)/$(FBNAME)
+else
+ $(INSTALL) -m 0644 $(MMNAME) $(DESTDIR)/$(DATATARGETDIR)/$(MMNAME)
+ $(INSTALL) -m 0644 $(FBNAME) $(DESTDIR)/$(DATATARGETDIR)/$(FBNAME)
+endif
%.efi: %.so
ifneq ($(OBJCOPY_GTE224),1)
$(error objcopy >= 2.24 is required)
endif
$(OBJCOPY) -j .text -j .sdata -j .data -j .data.ident \
- -j .dynamic -j .dynsym -j .rel* \
+ -j .dynamic -j .dynsym -j .rel* \
-j .rela* -j .reloc -j .eh_frame \
-j .vendor_cert \
- $(FORMAT) $^ $@
+ $(FORMAT) $^ $@
+
+ifneq ($(origin ENABLE_SHIM_HASH),undefined)
+%.hash : %.efi
+ $(PESIGN) -i $< -P -h > $@
+endif
+
+%.efi.debug : %.so
+ifneq ($(OBJCOPY_GTE224),1)
+ $(error objcopy >= 2.24 is required)
+endif
$(OBJCOPY) -j .text -j .sdata -j .data \
- -j .dynamic -j .dynsym -j .rel* \
+ -j .dynamic -j .dynsym -j .rel* \
-j .rela* -j .reloc -j .eh_frame \
-j .debug_info -j .debug_abbrev -j .debug_aranges \
-j .debug_line -j .debug_str -j .debug_ranges \
-j .note.gnu.build-id \
- $(FORMAT) $^ $@.debug
+ $^ $@
+ifneq ($(origin ENABLE_SBSIGN),undefined)
+%.efi.signed: %.efi shim.key shim.crt
+ $(SBSIGN) --key shim.key --cert shim.crt --output $@ $<
+else
%.efi.signed: %.efi certdb/secmod.db
$(PESIGN) -n certdb -i $< -c "shim" -s -o $@ -f
+endif
clean:
$(MAKE) -C Cryptlib -f $(TOPDIR)/Cryptlib/Makefile clean
@@ -243,4 +362,6 @@ archive: tag
@rm -rf /tmp/shim-$(VERSION)
@echo "The archive is in shim-$(VERSION).tar.bz2"
+.PHONY : install-deps
+
export ARCH CC LD OBJCOPY EFI_INCLUDE
diff --git a/MokVars.txt b/MokVars.txt
index cac5349f..d57fd87d 100644
--- a/MokVars.txt
+++ b/MokVars.txt
@@ -60,6 +60,11 @@ as described in the UEFI specification. BS,NV
MokListRT: A copy of MokList made available to the kernel at runtime. RT
+MokListX: A list of blacklisted keys and hashes. An EFI_SIGNATURE_LIST
+as described in the UEFI specification. BS,NV
+
+MokListXRT: A copy of MokListX made available to the kernel at runtime. RT
+
MokSBState: An 8-bit unsigned integer. If 1, shim will switch to
insecure mode. BS,NV
diff --git a/README b/README
index 24a39df1..ec9403a1 100644
--- a/README
+++ b/README
@@ -12,5 +12,12 @@ in the shim.h header file and provides a single entry point. On 64-bit systems
this entry point expects to be called with SysV ABI rather than MSABI, and
so calls to it should not be wrapped.
+On systems with a TPM chip enabled and supported by the system firmware,
+shim will extend various PCRs with the digests of the targets it is
+loading. A full list is in the file README.tpm .
+
To use shim, simply place a DER-encoded public certificate in a file such as
pub.cer and build with "make VENDOR_CERT_FILE=pub.cer".
+
+There are a couple of build options, and a couple of ways to customize the
+build, described in BUILDING.
diff --git a/README.tpm b/README.tpm
new file mode 100644
index 00000000..261bcd05
--- /dev/null
+++ b/README.tpm
@@ -0,0 +1,22 @@
+The following PCRs are extended by shim:
+
+PCR4:
+- the Authenticode hash of the binary being loaded will be extended into
+ PCR4 before SB verification.
+
+PCR7:
+- Any certificate in one of our certificate databases that matches a binary
+ we try to load will be extended into PCR7. That includes:
+ - DBX - the system blacklist, logged as "dbx"
+ - MokListX - the Mok blacklist, logged as "MokListX"
+ - vendor_dbx - shim's built-in vendor blacklist, logged as "dbx"
+ - DB - the system whitelist, logged as "db"
+ - MokList the Mok whitelist, logged as "MokList"
+ - vendor_cert - shim's built-in vendor whitelist, logged as "Shim"
+ - shim_cert - shim's build-time generated whitelist, logged as "Shim"
+- MokSBState will be extended into PCR7 if it is set, logged as
+ "MokSBState".
+
+PCR14:
+- MokList, MokListX, and MokSBState will be extended into PCR14 if they are
+ set.
diff --git a/TODO b/TODO
index 029b0bf2..c86c94d1 100644
--- a/TODO
+++ b/TODO
@@ -1,23 +1,14 @@
-Versioned protocol:
-- Make shim and the bootloaders using it express how enlightened they
- are to one another, so we can stop earlier without tricks like
- the one above
-MokListRT signing:
-- For kexec and hybernate to work right, MokListRT probably needs to
- be an authenticated variable. It's probable this needs to be done
- in the kernel boot stub instead, just because it'll need an
- ephemeral key to be generated, and that means we need some entropy
- to build up.
-New security protocol:
-- TBD
-kexec MoK Management:
-Modsign enforcement mgmt MoK:
-- This is part of the plan for SecureBoot patches. Basically these
- features need to be disableable/enableable in MokManager.
-Variable for debug:
-- basically we need to be able to set a UEFI variable and get debug
- output. Right now some code uses SHIM_VERBOSE but that needs a fair
- amount of work to actually be useful.
-Hashing of option roms:
-- hash option roms and add them to MokListRT
-- probably belongs in MokManager
+- Versioned protocol:
+ - Make shim and the bootloaders using it express how enlightened they
+ are to one another, so we can stop earlier without tricks like the one
+ above
+ - Make a LoadImage/CheckImage/StartImage based protocol
+- Hashing of option roms:
+ - hash option roms and add them to MokListRT
+ - probably belongs in MokManager
+- Ability to specify second stage as a device path
+ - including vendor path that means "parent of this image's path"
+ - including vendor path that means "this image"
+ - including path that's like Fv() to embed images.
+
+# vim:filetype=mail:tw=74
diff --git a/buildid.c b/buildid.c
new file mode 100644
index 00000000..b27aa1fe
--- /dev/null
+++ b/buildid.c
@@ -0,0 +1,192 @@
+/*
+ * Walk a list of input files, printing the name and buildid of any file
+ * that has one.
+ *
+ * This program is licensed under the GNU Public License version 2.
+ */
+
+#include <err.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <getopt.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <libelf.h>
+#include <gelf.h>
+
+static Elf_Scn *get_scn_named(Elf * elf, char *goal, GElf_Shdr * shdrp_out)
+{
+ int rc;
+ size_t shstrndx = -1;
+ int scn_no = 0;
+ Elf_Scn *scn = NULL;
+ GElf_Shdr shdr_data, *shdrp;
+
+ shdrp = shdrp_out ? shdrp_out : &shdr_data;
+
+ rc = elf_getshdrstrndx(elf, &shstrndx);
+ if (rc < 0)
+ return NULL;
+
+ do {
+ GElf_Shdr *shdr;
+ char *name;
+
+ scn = elf_getscn(elf, ++scn_no);
+ if (!scn)
+ break;
+
+ shdr = gelf_getshdr(scn, shdrp);
+ if (!shdr)
+ /*
+ * the binary is malformed, but hey, maybe the next
+ * one is fine, why not...
+ */
+ continue;
+
+ name = elf_strptr(elf, shstrndx, shdr->sh_name);
+ if (name && !strcmp(name, goal))
+ return scn;
+ } while (scn != NULL);
+ return NULL;
+}
+
+static void *get_buildid(Elf * elf, size_t * sz)
+{
+ Elf_Scn *scn;
+ size_t notesz;
+ size_t offset = 0;
+ Elf_Data *data;
+ GElf_Shdr shdr;
+
+ scn = get_scn_named(elf, ".note.gnu.build-id", &shdr);
+ if (!scn)
+ return NULL;
+
+ data = elf_getdata(scn, NULL);
+ if (!data)
+ return NULL;
+
+ do {
+ size_t nameoff;
+ size_t descoff;
+ GElf_Nhdr nhdr;
+ char *name;
+
+ notesz = gelf_getnote(data, offset, &nhdr, &nameoff, &descoff);
+ if (!notesz)
+ break;
+ offset += notesz;
+
+ if (nhdr.n_type != NT_GNU_BUILD_ID)
+ continue;
+
+ name = data->d_buf + nameoff;
+ if (!name || strcmp(name, ELF_NOTE_GNU))
+ continue;
+
+ *sz = nhdr.n_descsz;
+ return data->d_buf + descoff;
+ } while (notesz);
+ return NULL;
+}
+
+static void data2hex(uint8_t * data, size_t ds, char *str)
+{
+ const char hex[] = "0123456789abcdef";
+ int s;
+ unsigned int d;
+ for (d = 0, s = 0; d < ds; d += 1, s += 2) {
+ str[s + 0] = hex[(data[d] >> 4) & 0x0f];
+ str[s + 1] = hex[(data[d] >> 0) & 0x0f];
+ }
+ str[s] = '\0';
+}
+
+static void handle_one(char *f)
+{
+ int fd;
+ Elf *elf;
+ char *b = NULL;
+ size_t sz;
+ uint8_t *data;
+
+ if (!strcmp(f, "-")) {
+ fd = STDIN_FILENO;
+
+ if ((elf = elf_begin(fd, ELF_C_READ, NULL)) == NULL)
+ errx(1, "Couldn't read ELF data from \"%s\"", f);
+ } else {
+ if ((fd = open(f, O_RDONLY)) < 0)
+ err(1, "Couldn't open \"%s\"", f);
+
+ if ((elf = elf_begin(fd, ELF_C_READ_MMAP, NULL)) == NULL)
+ errx(1, "Couldn't read ELF data from \"%s\"", f);
+ }
+
+ data = get_buildid(elf, &sz);
+ if (data) {
+ b = alloca(sz * 2 + 1);
+ data2hex(data, sz, b);
+ if (b) {
+ write(1, f, strlen(f));
+ write(1, " ", 1);
+ write(1, b, strlen(b));
+ write(1, "\n", 1);
+ }
+ }
+ elf_end(elf);
+ close(fd);
+}
+
+static void
+ __attribute__ ((__noreturn__))
+ usage(int status)
+{
+ FILE *out = status ? stderr : stdout;
+
+ fprintf(out, "Usage: buildid [ flags | file0 [file1 [.. fileN]]]\n");
+ fprintf(out, "Flags:\n");
+ fprintf(out, " -h Print this help text and exit\n");
+
+ exit(status);
+}
+
+int main(int argc, char **argv)
+{
+ int i;
+ struct option options[] = {
+ {.name = "help",
+ .val = '?',
+ },
+ {.name = "usage",
+ .val = '?',
+ },
+ {.name = ""}
+ };
+ int longindex = -1;
+
+ while ((i = getopt_long(argc, argv, "h", options, &longindex)) != -1) {
+ switch (i) {
+ case 'h':
+ case '?':
+ usage(longindex == -1 ? 1 : 0);
+ break;
+ }
+ }
+
+ elf_version(EV_CURRENT);
+
+ if (optind == argc)
+ usage(1);
+
+ for (i = optind; i < argc; i++)
+ handle_one(argv[i]);
+
+ return 0;
+}
+
+// vim:fenc=utf-8:tw=75
diff --git a/commit b/commit
index afa07ac4..9922e3f4 100644
--- a/commit
+++ b/commit
@@ -1 +1 @@
-478f9bb2ea91b361ab52dac6604fdfb47e1e963c \ No newline at end of file
+5202f80c32bdcab0469785e953bf9fa8dd4eaaa1 \ No newline at end of file
diff --git a/debian/canonical-uefi-ca.der b/debian/canonical-uefi-ca.der
deleted file mode 100644
index b4098d9c..00000000
--- a/debian/canonical-uefi-ca.der
+++ /dev/null
Binary files differ
diff --git a/debian/changelog b/debian/changelog
deleted file mode 100644
index 8b81400a..00000000
--- a/debian/changelog
+++ /dev/null
@@ -1,226 +0,0 @@
-shim (12+1502324945.478f9bb-0) UNRELEASED; urgency=medium
-
- * New upstream snapshot: 12+1502324945.478f9bb.
- * debian/control: add a Build-Depends on libnss3-tools for pk12-util.
- * debian/rules:
- - Update dh_auto_build/dh_auto_clean for new upstream options: set
- MAKELEVEL.
- - Set DEFAULT_LOADER; this makes second-stage-path unnecessary.
- - Define an EFI_ARCH variable, and use that for paths to shim. This
- makes it possible to build a shim for other architectures than amd64.
- * debian/patches/second-stage-path: dropped.
- * debian/patches/sbsigntool-no-pesign: refreshed.
- * debian/patches/0001-shim-fix-the-mirroring-MokSBState-fail.patch: dropped,
- included upstream.
-
- -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com> Wed, 09 Aug 2017 20:39:15 -0400
-
-shim (0.9+1474479173.6c180c6-1ubuntu1) zesty; urgency=medium
-
- [ Steve Langasek ]
- * Merge (not yet NEW cleared) changes from Debian branch.
-
- [ Mathieu Trudel-Lapierre ]
- * debian/patches/0001-shim-fix-the-mirroring-MokSBState-fail.patch: guard
- against errors in mirroring MokSBState to MokSBStateRT. Thanks to Ivan Hu
- for the patch. This will fix issues updating MokSBStateRT if the variable
- already exists with different attributes. (LP: #1644806)
-
- -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com> Thu, 01 Dec 2016 16:55:50 -0500
-
-shim (0.9+1474479173.6c180c6-1) unstable; urgency=medium
-
- [ Steve Langasek ]
- * Initial Debian upload. Closes: #820052.
- * Update Standards-Version.
- * Embed the newly-minted Debian CA certificate.
- * Vendorize debian/rules so that the same package can be used in both
- Debian and Ubuntu without modification.
- * Fix debian/copyright to match the spec (last match wins, not first)
- * Fix shim.efi to not be executable.
- * Add watchfile.
- * Support parallel builds, because eh why not
- * Update Vcs-Bzr.
- * Resync with Ubuntu, including patch to fix debian/copyright.
-
- [ Julien Cristau ]
- * Add some missing copyright holders in d/copyright, update
- Upstream-Contact. Thanks to Helen Koike for the help.
-
- -- Julien Cristau <jcristau@debian.org> Sat, 15 Oct 2016 15:17:34 +0200
-
-shim (0.9+1474479173.6c180c6-0ubuntu1) yakkety; urgency=medium
-
- [ Helen Koike ]
- * debian/copyright: add OpenSSL license
-
- [ Mathieu Trudel-Lapierre ]
- * New upstream release. (LP: #1624096)
- * debian/copyright: patches should be BSD, like the rest of the upstream
- code.
- * debian/patches/unused-variable: dropped; applied upstream.
- * debian/patches/binutils-version-matching: dropped, fixed upstream.
- * debian/shim.install: built EFI binaries were renamed; update our install
- file to properly pick up shim (shim$arch), MokManager (mm$arch), and
- fallback (fb$arch).
-
- -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com> Thu, 22 Sep 2016 15:02:20 -0400
-
-shim (0.9+1465500757.14a5905-0ubuntu1) yakkety; urgency=medium
-
- * New upstream release.
- - Better handle LoadOptions. (LP: #1581299)
- - Measure state and second stage in TPM.
- - Mirror MokSBState in runtime as MokSBStateRT.
- - Fix failure to build with GCC 5. (LP: #1429978)
- - Various bug fixes and other improvements.
- * Refreshed patches.
- - Remaining patches:
- + second-stage-path
- + sbsigntool-not-pesign
- * debian/patches/unused-variable: remove unused variable size.
- * debian/patches/binutils-version-matching: revert d9a4c912 to correctly
- match objcopy's version on Ubuntu.
- * debian/copyright: update copyright for patches.
-
- -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com> Tue, 26 Jul 2016 16:48:32 -0400
-
-shim (0.8-0ubuntu2) wily; urgency=medium
-
- * No-change rebuild against gnu-efi 3.0v-5ubuntu1.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Tue, 12 May 2015 17:48:30 +0000
-
-shim (0.8-0ubuntu1) wily; urgency=medium
-
- * New upstream release.
- - Clarify meaning of insecure_mode. (LP: #1384973)
- * debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch,
- debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included
- in the upstream release.
- * debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path:
- refreshed.
-
- -- Mathieu Trudel-Lapierre <mathieu-tl@ubuntu.com> Mon, 11 May 2015 19:50:49 -0400
-
-shim (0.7-0ubuntu4) utopic; urgency=medium
-
- * SECURITY UPDATE: heap overflow and out-of-bounds read access when
- parsing DHCPv6 information
- - debian/patches/CVE-2014-3675.patch: apply proper bounds checking
- when parsing data provided in DHCPv6 packets.
- - CVE-2014-3675
- - CVE-2014-3676
- * SECURITY UPDATE: memory corruption when processing user-provided key
- lists
- - debian/patches/CVE-2014-3677.patch: detect malformed machine owner
- key (MOK) lists and ignore them, avoiding possible memory corruption.
- - CVE-2014-3677
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Wed, 08 Oct 2014 06:40:40 +0000
-
-shim (0.7-0ubuntu2) utopic; urgency=medium
-
- * Restore debian/patches/prototypes, which still is needed on shim 0.7
- but only detected on the buildds.
- * Update debian/patches/prototypes with some new declarations needed for
- openssl 0.9.8za update.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Tue, 07 Oct 2014 16:20:08 -0700
-
-shim (0.7-0ubuntu1) utopic; urgency=medium
-
- * New upstream release.
- - fix spurious error message when fallback.efi is not present, as will
- always be the case for removable media. LP: #1297069.
- - drop most patches, included upstream.
- * debian/patches/0001-Update-openssl-to-0.9.8za.patch: cherry-pick
- openssl 0.9.8za in via upstream.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Tue, 07 Oct 2014 05:40:41 +0000
-
-shim (0.4-0ubuntu5) utopic; urgency=low
-
- * Install fallback.efi.signed as well, to lay the groundwork for fallback
- handling (wanted when we have to move a drive between machines, or when
- the firmware loses its marbles^W nvram).
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Mon, 04 Aug 2014 12:11:13 +0200
-
-shim (0.4-0ubuntu4) saucy; urgency=low
-
- * debian/patches/fix-tftp-prototype: pass the right arguments to
- EFI_PXE_BASE_CODE_TFTP_READ_FILE.
- * debian/patches/build-with-Werror: Build with -Werror to catch future
- prototype mismatches.
- * debian/patches/fix-compiler-warnings: Fix remaining compiler
- warnings in netboot.c.
- * debian/patches/tftp-proper-nul-termination: fix nul termination
- errors in filenames passed to tftp.
- * debian/patches/netboot-cleanup: roll-up of miscellaneous fixes to
- the netboot code.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Mon, 23 Sep 2013 00:30:00 -0700
-
-shim (0.4-0ubuntu3) saucy; urgency=low
-
- [ Steve Langasek ]
- * Install MokManager.efi.signed in the package.
- * debian/patches/no-output-by-default.patch: Don't print any
- informational messages. Closes LP: #1074302.
-
- [ Stéphane Graber ]
- * debian/patches/no-print-on-unsigned: Don't print an error message when
- validating an unsigned binary as that tends to hang Lenovo machines.
- (LP: #1087501)
-
- -- Stéphane Graber <stgraber@ubuntu.com> Thu, 08 Aug 2013 17:12:12 +0200
-
-shim (0.4-0ubuntu2) saucy; urgency=low
-
- * Add missing build-dependency on openssl.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Tue, 02 Jul 2013 20:30:43 +0000
-
-shim (0.4-0ubuntu1) saucy; urgency=low
-
- * New upstream release.
- * Drop debian/patches/shim-before-loadimage; upstream has changed this to
- not call loadimage at all.
- * debian/patches/sbsigntool-not-pesign: Sign MokManager with
- sbsigntool instead of pesign.
- * Add a versioned build-dependency on gnu-efi.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Tue, 02 Jul 2013 12:53:24 -0700
-
-shim (0~20120906.bcd0a4e8-0ubuntu4) quantal-proposed; urgency=low
-
- * debian/patches/shim-before-loadimage: Use direct verification first
- before LoadImage. Addresses an issue where Lenovo's SecureBoot
- implementation pops an error message on any verification failure - avoid
- calling LoadImage at all unless we have to.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Wed, 10 Oct 2012 15:28:40 -0700
-
-shim (0~20120906.bcd0a4e8-0ubuntu3) quantal; urgency=low
-
- * debian/patches/second-stage-path: Chainload grubx64.efi, not
- grub.efi.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Fri, 05 Oct 2012 11:20:58 -0700
-
-shim (0~20120906.bcd0a4e8-0ubuntu2) quantal; urgency=low
-
- * debian/patches/prototypes: Include missing prototypes, and disable
- use of BIO_new_file.
- * Only build the package for amd64; we're not signing an i386 shim at this
- stage so there's no point in building it.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Thu, 04 Oct 2012 17:47:04 +0000
-
-shim (0~20120906.bcd0a4e8-0ubuntu1) quantal; urgency=low
-
- * Initial release.
- * Include the Canonical Secure Boot master CA.
-
- -- Steve Langasek <steve.langasek@ubuntu.com> Thu, 04 Oct 2012 00:01:06 -0700
diff --git a/debian/compat b/debian/compat
deleted file mode 100644
index ec635144..00000000
--- a/debian/compat
+++ /dev/null
@@ -1 +0,0 @@
-9
diff --git a/debian/control b/debian/control
deleted file mode 100644
index 824230b8..00000000
--- a/debian/control
+++ /dev/null
@@ -1,18 +0,0 @@
-Source: shim
-Section: admin
-Priority: optional
-Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
-XSBC-Original-Maintainer: Steve Langasek <vorlon@debian.org>
-Standards-Version: 3.9.8
-Build-Depends: debhelper (>= 9), gnu-efi (>= 3.0u), sbsigntool, openssl, libnss3-tools
-Vcs-Bzr: lp:~ubuntu-core-dev/shim/trunk
-
-Package: shim
-Architecture: amd64
-Depends: ${shlibs:Depends}, ${misc:Depends}
-Description: boot loader to chain-load signed boot loaders under Secure Boot
- This package provides a minimalist boot loader which allows verifying
- signatures of other UEFI binaries against either the Secure Boot DB/DBX or
- against a built-in signature database. Its purpose is to allow a small,
- infrequently-changing binary to be signed by the UEFI CA, while allowing
- an OS distributor to revision their main bootloader independently of the CA.
diff --git a/debian/copyright b/debian/copyright
deleted file mode 100644
index 7c08287c..00000000
--- a/debian/copyright
+++ /dev/null
@@ -1,254 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: shim
-Upstream-Contact: Matthew Garrett <mjg59@coreos.com>
-Source: https://github.com/mjg59/shim.git
-
-Files: *
-Copyright: 2012-2013 Red Hat, Inc
- 2009-2016 Intel Corporation
-License: BSD-2-Clause
-
-Files: debian/patches/*
-Copyright: 2016 Canonical Ltd.
-License: BSD-2-Clause
-
-Files: crypt_blowfish.*
-Copyright: none
-License: public-domain
- No copyright is claimed, and the software is hereby placed in the public
- domain. In case this attempt to disclaim copyright and place the software
- in the public domain is deemed null and void, then the software is
- Copyright (c) 2000-2011 Solar Designer and it is hereby released to the
- general public under the following terms:
- .
- Redistribution and use in source and binary forms, with or without
- modification, are permitted.
- .
- There's ABSOLUTELY NO WARRANTY, express or implied.
-
-Files: httpboot.*
-Copyright: 2015 SUSE LINUX GmbH
-License: BSD-2-Clause
-
-Files: include/Http.h
-Copyright: 2016 Intel Corporation
- 2015 Hewlett Packard Enterprise Development LP
-License: BSD-2-Clause
-
-Files: include/PeImage.h
-Copyright: 2006-2010 Intel Corporation
- 2008-2009 Apple Inc
-License: BSD-2-Clause
-
-Files: lib/*.c
-Copyright: 2011-2012 Intel Corporation
- 2012 <James.Bottomley@HansenPartnership.com>
- 2012-2013 Red Hat, Inc
-License: BSD-2-Clause
-
-Files: Cryptlib/OpenSSL/* Cryptlib/Include/openssl/*
-Copyright: 1998-2016 The OpenSSL Project
- 1995-1998 Eric Young (eay@cryptsoft.com)
- 2002 Sun Microsystems, Inc
- 2005 Nokia
-License: OpenSSL and Original-SSLeay
- OpenSSL License
- ---------------
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions
- are met:
- .
- 1. Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- .
- 2. Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in
- the documentation and/or other materials provided with the
- distribution.
- .
- 3. All advertising materials mentioning features or use of this
- software must display the following acknowledgment:
- "This product includes software developed by the OpenSSL Project
- for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- .
- 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- endorse or promote products derived from this software without
- prior written permission. For written permission, please contact
- openssl-core@openssl.org.
- .
- 5. Products derived from this software may not be called "OpenSSL"
- nor may "OpenSSL" appear in their names without prior written
- permission of the OpenSSL Project.
- .
- 6. Redistributions of any form whatsoever must retain the following
- acknowledgment:
- "This product includes software developed by the OpenSSL Project
- for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- .
- THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- OF THE POSSIBILITY OF SUCH DAMAGE.
- ====================================================================
- .
- This product includes cryptographic software written by Eric Young
- (eay@cryptsoft.com). This product includes software written by Tim
- Hudson (tjh@cryptsoft.com).
- .
- Original SSLeay License
- -----------------------
- This package is an SSL implementation written
- by Eric Young (eay@cryptsoft.com).
- The implementation was written so as to conform with Netscapes SSL.
- .
- This library is free for commercial and non-commercial use as long as
- the following conditions are aheared to. The following conditions
- apply to all code found in this distribution, be it the RC4, RSA,
- lhash, DES, etc., code; not just the SSL code. The SSL documentation
- included with this distribution is covered by the same copyright terms
- except that the holder is Tim Hudson (tjh@cryptsoft.com).
- .
- Copyright remains Eric Young's, and as such any Copyright notices in
- the code are not to be removed.
- If this package is used in a product, Eric Young should be given attribution
- as the author of the parts of the library used.
- This can be in the form of a textual message at program startup or
- in documentation (online or textual) provided with the package.
- .
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions
- are met:
- 1. Redistributions of source code must retain the copyright
- notice, this list of conditions and the following disclaimer.
- 2. Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- 3. All advertising materials mentioning features or use of this software
- must display the following acknowledgement:
- "This product includes cryptographic software written by
- Eric Young (eay@cryptsoft.com)"
- The word 'cryptographic' can be left out if the rouines from the library
- being used are not cryptographic related :-).
- 4. If you include any Windows specific code (or a derivative thereof) from
- the apps directory (application code) you must include an acknowledgement:
- "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- .
- THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- SUCH DAMAGE.
- .
- The licence and distribution terms for any publically available version or
- derivative of this code cannot be changed. i.e. this code cannot simply be
- copied and put under another distribution licence
- [including the GNU Public Licence.]
-
-Files: Cryptlib/Include/openssl/seed.h
-Copyright: 2007 KISA(Korea Information Security Agency)
-License: BSD-2-Clause
-
-Files: Cryptlib/OpenSSL/crypto/o_dir.h Cryptlib/OpenSSL/crypto/LPdir_nyi.c
-Copyright: 2004, Richard Levitte <richard@levitte.org>
-License: BSD-2-Clause
-
-Files: Cryptlib/OpenSSL/crypto/x509v3/v3_pci.c Cryptlib/OpenSSL/crypto/x509v3/v3_pcia.c
-Copyright: 2004 Kungliga Tekniska Högskolan
-License: BSD-3-Clause-Institute
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions
- are met:
- .
- 1. Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- .
- 2. Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
- .
- 3. Neither the name of the Institute nor the names of its contributors
- may be used to endorse or promote products derived from this software
- without specific prior written permission.
- .
- THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- SUCH DAMAGE.
-
-Files: Cryptlib/OpenSSL/crypto/bn/rsaz_exp.h
-Copyright: 2012, Intel Corporation
-License: BSD-3-Clause-Intel
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are
- met:
- .
- * Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- .
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the
- distribution.
- .
- * Neither the name of the Intel Corporation nor the names of its
- contributors may be used to endorse or promote products derived from
- this software without specific prior written permission.
- .
- THIS SOFTWARE IS PROVIDED BY INTEL CORPORATION ""AS IS"" AND ANY
- EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL CORPORATION OR
- CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-License: BSD-2-Clause
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions
- are met:
- .
- Redistributions of source code must retain the above copyright
- notice, this list of conditions and the following disclaimer.
- .
- Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the
- distribution.
- .
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
- INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/debian/debian-uefi-ca.der b/debian/debian-uefi-ca.der
deleted file mode 100644
index 1dd6ee16..00000000
--- a/debian/debian-uefi-ca.der
+++ /dev/null
Binary files differ
diff --git a/debian/patches/gcc-5.diff b/debian/patches/gcc-5.diff
deleted file mode 100644
index e706c3ab..00000000
--- a/debian/patches/gcc-5.diff
+++ /dev/null
@@ -1,45 +0,0 @@
----
- Cryptlib/Makefile | 2 +-
- Cryptlib/OpenSSL/Makefile | 2 +-
- Makefile | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-Index: b/Makefile
-===================================================================
---- a/Makefile
-+++ b/Makefile
-@@ -19,7 +19,7 @@ EFI_CRT_OBJS = $(EFI_PATH)/crt0-efi-$(A
- EFI_LDS = elf_$(ARCH)_efi.lds
-
- DEFAULT_LOADER := \\\\grubx64.efi
--CFLAGS = -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic \
-+CFLAGS = -std=gnu89 -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic \
- -fshort-wchar -Wall -Wsign-compare -Werror -fno-builtin \
- -Werror=sign-compare \
- "-DDEFAULT_LOADER=L\"$(DEFAULT_LOADER)\"" \
-Index: b/Cryptlib/Makefile
-===================================================================
---- a/Cryptlib/Makefile
-+++ b/Cryptlib/Makefile
-@@ -1,7 +1,7 @@
-
- EFI_INCLUDES = -IInclude -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol
-
--CFLAGS = -ggdb -O0 -I. -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar \
-+CFLAGS = -std=gnu89 -ggdb -O0 -I. -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar \
- -Wall $(EFI_INCLUDES)
-
- ifeq ($(ARCH),x86_64)
-Index: b/Cryptlib/OpenSSL/Makefile
-===================================================================
---- a/Cryptlib/OpenSSL/Makefile
-+++ b/Cryptlib/OpenSSL/Makefile
-@@ -1,7 +1,7 @@
-
- EFI_INCLUDES = -I../Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol
-
--CFLAGS = -ggdb -O0 -I. -I.. -I../Include/ -Icrypto -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar -nostdinc \
-+CFLAGS = -std=gnu89 -ggdb -O0 -I. -I.. -I../Include/ -Icrypto -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar -nostdinc \
- -Wall $(EFI_INCLUDES) -DOPENSSL_SYSNAME_UWIN -DOPENSSL_SYS_UEFI -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_SEED -DOPENSSL_NO_RC5 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_SOCK -DOPENSSL_NO_CMS -DOPENSSL_NO_JPAKE -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_ERR -DOPENSSL_NO_KRB5 -DOPENSSL_NO_DYNAMIC_ENGINE -DGETPID_IS_MEANINGLESS -DOPENSSL_NO_STDIO -DOPENSSL_NO_FP_API -DOPENSSL_NO_DGRAM -DOPENSSL_NO_SHA0 -DOPENSSL_NO_LHASH -DOPENSSL_NO_HW -DOPENSSL_NO_OCSP -DOPENSSL_NO_LOCKING -DOPENSSL_NO_DEPRECATED -DOPENSSL_SMALL_FOOTPRINT -DPEDANTIC
-
- ifeq ($(ARCH),x86_64)
diff --git a/debian/patches/gcc5-includes-stdarg.patch b/debian/patches/gcc5-includes-stdarg.patch
deleted file mode 100644
index 57cf4a8e..00000000
--- a/debian/patches/gcc5-includes-stdarg.patch
+++ /dev/null
@@ -1,129 +0,0 @@
-From d51739a416400ad348d8a1c7e3886abce11fff1b Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Tue, 7 Apr 2015 11:59:25 -0400
-Subject: [PATCH] gcc 5.0 changes some include bits, so copy what arm does on
- x86.
-
-Basically they messed around with stdarg some and now we need to do it
-the other way.
-
-Signed-off-by: Peter Jones <pjones@redhat.com>
----
- Cryptlib/Include/OpenSslSupport.h | 4 +++-
- Cryptlib/Makefile | 3 ++-
- Cryptlib/OpenSSL/Makefile | 5 +++--
- Makefile | 17 ++++++-----------
- MokManager.c | 1 +
- 5 files changed, 15 insertions(+), 15 deletions(-)
-
-Index: b/Cryptlib/Include/OpenSslSupport.h
-===================================================================
---- a/Cryptlib/Include/OpenSslSupport.h
-+++ b/Cryptlib/Include/OpenSslSupport.h
-@@ -34,7 +34,7 @@ typedef VOID *FILE;
- //
- // Map all va_xxxx elements to VA_xxx defined in MdePkg/Include/Base.h
- //
--#if !defined(__CC_ARM) // if va_list is not already defined
-+#if !defined(__CC_ARM) || defined(_STDARG_H) // if va_list is not already defined
- /*
- * These are now unconditionally #defined by GNU_EFI's efistdarg.h,
- * so we should #undef them here before providing a new definition.
-@@ -94,7 +94,9 @@ typedef __builtin_va_list VA_LIST;
- portably, hence it is provided by a Standard C header file.
- For pre-Standard C compilers, here is a version that usually works
- (but watch out!): */
-+#ifndef offsetof
- #define offsetof(type, member) ( (int) & ((type*)0) -> member )
-+#endif
-
- //
- // Basic types from EFI Application Toolkit required to buiild Open SSL
-Index: b/Cryptlib/Makefile
-===================================================================
---- a/Cryptlib/Makefile
-+++ b/Cryptlib/Makefile
-@@ -2,7 +2,8 @@
- EFI_INCLUDES = -IInclude -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol
-
- CFLAGS = -std=gnu89 -ggdb -O0 -I. -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar \
-- -Wall $(EFI_INCLUDES)
-+ -Wall $(EFI_INCLUDES) \
-+ -ffreestanding -I$(shell $(CC) -print-file-name=include)
-
- ifeq ($(ARCH),x86_64)
- CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args \
-Index: b/Cryptlib/OpenSSL/Makefile
-===================================================================
---- a/Cryptlib/OpenSSL/Makefile
-+++ b/Cryptlib/OpenSSL/Makefile
-@@ -2,6 +2,7 @@
- EFI_INCLUDES = -I../Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol
-
- CFLAGS = -std=gnu89 -ggdb -O0 -I. -I.. -I../Include/ -Icrypto -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar -nostdinc \
-+ -ffreestanding -I$(shell $(CC) -print-file-name=include) \
- -Wall $(EFI_INCLUDES) -DOPENSSL_SYSNAME_UWIN -DOPENSSL_SYS_UEFI -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_SEED -DOPENSSL_NO_RC5 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_SOCK -DOPENSSL_NO_CMS -DOPENSSL_NO_JPAKE -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_ERR -DOPENSSL_NO_KRB5 -DOPENSSL_NO_DYNAMIC_ENGINE -DGETPID_IS_MEANINGLESS -DOPENSSL_NO_STDIO -DOPENSSL_NO_FP_API -DOPENSSL_NO_DGRAM -DOPENSSL_NO_SHA0 -DOPENSSL_NO_LHASH -DOPENSSL_NO_HW -DOPENSSL_NO_OCSP -DOPENSSL_NO_LOCKING -DOPENSSL_NO_DEPRECATED -DOPENSSL_SMALL_FOOTPRINT -DPEDANTIC
-
- ifeq ($(ARCH),x86_64)
-@@ -13,10 +14,10 @@ ifeq ($(ARCH),ia32)
- -m32 -DTHIRTY_TWO_BIT
- endif
- ifeq ($(ARCH),aarch64)
-- CFLAGS += -O2 -DSIXTY_FOUR_BIT_LONG -ffreestanding -I$(shell $(CC) -print-file-name=include)
-+ CFLAGS += -O2 -DSIXTY_FOUR_BIT_LONG
- endif
- ifeq ($(ARCH),arm)
-- CFLAGS += -O2 -DTHIRTY_TWO_BIT -ffreestanding -I$(shell $(CC) -print-file-name=include)
-+ CFLAGS += -O2 -DTHIRTY_TWO_BIT
- endif
- LDFLAGS = -nostdlib -znocombreloc
-
-Index: b/Makefile
-===================================================================
---- a/Makefile
-+++ b/Makefile
-@@ -21,7 +21,8 @@ EFI_LDS = elf_$(ARCH)_efi.lds
- DEFAULT_LOADER := \\\\grubx64.efi
- CFLAGS = -std=gnu89 -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic \
- -fshort-wchar -Wall -Wsign-compare -Werror -fno-builtin \
-- -Werror=sign-compare \
-+ -Werror=sign-compare -ffreestanding \
-+ -I$(shell $(CC) -print-file-name=include) \
- "-DDEFAULT_LOADER=L\"$(DEFAULT_LOADER)\"" \
- "-DDEFAULT_LOADER_CHAR=\"$(DEFAULT_LOADER)\"" \
- $(EFI_INCLUDES)
-@@ -31,19 +32,13 @@ ifneq ($(origin OVERRIDE_SECURITY_POLICY
- endif
-
- ifeq ($(ARCH),x86_64)
-- CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args \
-+ CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc \
-+ -maccumulate-outgoing-args \
- -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI
- endif
- ifeq ($(ARCH),ia32)
-- CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args -m32
--endif
--
--ifeq ($(ARCH),aarch64)
-- CFLAGS += -ffreestanding -I$(shell $(CC) -print-file-name=include)
--endif
--
--ifeq ($(ARCH),arm)
-- CFLAGS += -ffreestanding -I$(shell $(CC) -print-file-name=include)
-+ CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc \
-+ -maccumulate-outgoing-args -m32
- endif
-
- ifneq ($(origin VENDOR_CERT_FILE), undefined)
-Index: b/MokManager.c
-===================================================================
---- a/MokManager.c
-+++ b/MokManager.c
-@@ -1,5 +1,6 @@
- #include <efi.h>
- #include <efilib.h>
-+#include <stdarg.h>
- #include <Library/BaseCryptLib.h>
- #include <openssl/x509.h>
- #include "shim.h"
diff --git a/debian/patches/prototypes b/debian/patches/prototypes
deleted file mode 100644
index 7191e102..00000000
--- a/debian/patches/prototypes
+++ /dev/null
@@ -1,191 +0,0 @@
-Description: Include missing prototypes, and disable use of BIO_new_file
- Pull in missing prototypes for functions that are not yet upstream in
- gnu-efi, and #ifdef out references to BIO_new_file(), BIO_new_fp(), and
- X509_load_{cert,crl}_file since the prototypes are themselves #ifdef'ed
- out.
- .
- Without these prototypes, we get implicit conversions on amd64, which
- are sensibly treated as a build failure by Launchpad.
-Author: Steve Langasek <steve.langasek@ubuntu.com>
-
-Index: shim/Cryptlib/Library/BaseMemoryLib.h
-===================================================================
---- /dev/null
-+++ shim/Cryptlib/Library/BaseMemoryLib.h
-@@ -0,0 +1,41 @@
-+#ifndef __BASE_MEMORY_LIB__
-+#define __BASE_MEMORY_LIB__
-+
-+CHAR8 *
-+ScanMem8 (
-+ IN CHAR8 *Buffer,
-+ IN UINTN Size,
-+ IN CHAR8 Value
-+ );
-+
-+UINT32
-+WriteUnaligned32(
-+ UINT32 *Buffer,
-+ UINT32 Value
-+ );
-+
-+CHAR8 *
-+AsciiStrCat(
-+ CHAR8 *Destination,
-+ CHAR8 *Source
-+ );
-+
-+CHAR8 *
-+AsciiStrCpy(
-+ CHAR8 *Destination,
-+ CHAR8 *Source
-+ );
-+
-+CHAR8 *
-+AsciiStrnCpy(
-+ CHAR8 *Destination,
-+ CHAR8 *Source,
-+ UINTN count
-+ );
-+
-+UINTN
-+AsciiStrSize(
-+ CHAR8 *string
-+ );
-+
-+#endif
-Index: shim/Cryptlib/OpenSSL/crypto/x509v3/v3_pci.c
-===================================================================
---- shim.orig/Cryptlib/OpenSSL/crypto/x509v3/v3_pci.c
-+++ shim/Cryptlib/OpenSSL/crypto/x509v3/v3_pci.c
-@@ -157,6 +157,7 @@
- }
- OPENSSL_free(tmp_data2);
- }
-+#ifndef OPENSSL_NO_STDIO
- else if (strncmp(val->value, "file:", 5) == 0)
- {
- unsigned char buf[2048];
-@@ -194,6 +195,7 @@
- goto err;
- }
- }
-+#endif
- else if (strncmp(val->value, "text:", 5) == 0)
- {
- val_len = strlen(val->value + 5);
-Index: shim/Cryptlib/OpenSSL/crypto/conf/conf_def.c
-===================================================================
---- shim.orig/Cryptlib/OpenSSL/crypto/conf/conf_def.c
-+++ shim/Cryptlib/OpenSSL/crypto/conf/conf_def.c
-@@ -186,11 +186,13 @@
- int ret;
- BIO *in=NULL;
-
-+#ifndef OPENSSL_NO_STDIO
- #ifdef OPENSSL_SYS_VMS
- in=BIO_new_file(name, "r");
- #else
- in=BIO_new_file(name, "rb");
- #endif
-+#endif
- if (in == NULL)
- {
- if (ERR_GET_REASON(ERR_peek_last_error()) == BIO_R_NO_SUCH_FILE)
-Index: shim/Cryptlib/OpenSSL/crypto/conf/conf_lib.c
-===================================================================
---- shim.orig/Cryptlib/OpenSSL/crypto/conf/conf_lib.c
-+++ shim/Cryptlib/OpenSSL/crypto/conf/conf_lib.c
-@@ -92,11 +92,13 @@
- LHASH *ltmp;
- BIO *in=NULL;
-
-+#ifndef OPENSSL_NO_STDIO
- #ifdef OPENSSL_SYS_VMS
- in=BIO_new_file(file, "r");
- #else
- in=BIO_new_file(file, "rb");
- #endif
-+#endif
- if (in == NULL)
- {
- CONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);
-Index: shim/Cryptlib/OpenSSL/crypto/conf/conf_sap.c
-===================================================================
---- shim.orig/Cryptlib/OpenSSL/crypto/conf/conf_sap.c
-+++ shim/Cryptlib/OpenSSL/crypto/conf/conf_sap.c
-@@ -93,12 +93,14 @@
- {
- BIO *bio_err;
- ERR_load_crypto_strings();
-+#ifndef OPENSSL_NO_STDIO
- if ((bio_err=BIO_new_fp(stderr, BIO_NOCLOSE)) != NULL)
- {
- BIO_printf(bio_err,"Auto configuration failed\n");
- ERR_print_errors(bio_err);
- BIO_free(bio_err);
- }
-+#endif
- exit(1);
- }
-
-Index: shim/Cryptlib/OpenSSL/crypto/engine/eng_openssl.c
-===================================================================
---- shim.orig/Cryptlib/OpenSSL/crypto/engine/eng_openssl.c
-+++ shim/Cryptlib/OpenSSL/crypto/engine/eng_openssl.c
-@@ -374,11 +374,15 @@
- BIO *in;
- EVP_PKEY *key;
- fprintf(stderr, "(TEST_ENG_OPENSSL_PKEY)Loading Private key %s\n", key_id);
-+#ifndef OPENSSL_NO_STDIO
- in = BIO_new_file(key_id, "r");
- if (!in)
- return NULL;
- key = PEM_read_bio_PrivateKey(in, NULL, 0, NULL);
- BIO_free(in);
-+#else
-+ return NULL;
-+#endif
- return key;
- }
- #endif
-Index: shim/Cryptlib/OpenSSL/crypto/x509/by_dir.c
-===================================================================
---- shim.orig/Cryptlib/OpenSSL/crypto/x509/by_dir.c
-+++ shim/Cryptlib/OpenSSL/crypto/x509/by_dir.c
-@@ -92,8 +92,10 @@
- static int new_dir(X509_LOOKUP *lu);
- static void free_dir(X509_LOOKUP *lu);
- static int add_cert_dir(BY_DIR *ctx,const char *dir,int type);
-+#ifndef OPENSSL_NO_STDIO
- static int get_cert_by_subject(X509_LOOKUP *xl,int type,X509_NAME *name,
- X509_OBJECT *ret);
-+#endif
- X509_LOOKUP_METHOD x509_dir_lookup=
- {
- "Load certs from files in a directory",
-@@ -102,7 +104,11 @@
- NULL, /* init */
- NULL, /* shutdown */
- dir_ctrl, /* ctrl */
-+#ifdef OPENSSL_NO_STDIO
-+ NULL, /* get_by_subject */
-+#else
- get_cert_by_subject, /* get_by_subject */
-+#endif
- NULL, /* get_by_issuer_serial */
- NULL, /* get_by_fingerprint */
- NULL, /* get_by_alias */
-@@ -242,6 +248,7 @@
- return(1);
- }
-
-+#ifndef OPENSSL_NO_STDIO
- static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
- X509_OBJECT *ret)
- {
-@@ -383,3 +390,4 @@
- if (b != NULL) BUF_MEM_free(b);
- return(ok);
- }
-+#endif
diff --git a/debian/patches/sbsigntool-not-pesign b/debian/patches/sbsigntool-not-pesign
deleted file mode 100644
index 1220cabd..00000000
--- a/debian/patches/sbsigntool-not-pesign
+++ /dev/null
@@ -1,26 +0,0 @@
-Description: Sign MokManager with sbsigntool instead of pesign
- Ubuntu infrastructure uses sbsigntool for all other EFI signing, so we use
- the same thing for signing MokManager with our ephemeral key. This also
- avoids an additional build dependency on libnss3-tools.
-Author: Steve Langasek <steve.langasek@canonical.com>
-Forwarded: not-needed
-
----
- Makefile | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-Index: b/Makefile
-===================================================================
---- a/Makefile
-+++ b/Makefile
-@@ -206,8 +206,8 @@ endif
- -j .note.gnu.build-id \
- $(FORMAT) $^ $@.debug
-
--%.efi.signed: %.efi certdb/secmod.db
-- $(PESIGN) -n certdb -i $< -c "shim" -s -o $@ -f
-+%.efi.signed: %.efi shim.crt
-+ sbsign --key shim.key --cert shim.crt $<
-
- clean:
- $(MAKE) -C Cryptlib -f $(TOPDIR)/Cryptlib/Makefile clean
diff --git a/debian/patches/series b/debian/patches/series
deleted file mode 100644
index b8e0e105..00000000
--- a/debian/patches/series
+++ /dev/null
@@ -1 +0,0 @@
-sbsigntool-not-pesign
diff --git a/debian/rules b/debian/rules
deleted file mode 100755
index f35661c1..00000000
--- a/debian/rules
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/make -f
-
-# Other vendors, add your certs here. No sense in using
-# dpkg-vendor --derives-from, because only Canonical-generated binaries will
-# be signed with this key; so if you are building your own shim binary you
-# should be building the other binaries also.
-ifeq ($(shell dpkg-vendor --is ubuntu && echo yes),yes)
- cert=debian/canonical-uefi-ca.der
-else
- cert=debian/debian-uefi-ca.der
-endif
-
-ifeq ($(DEB_HOST_ARCH),amd64)
-export EFI_ARCH := x64
-endif
-
-%:
- dh $@ --parallel
-
-override_dh_auto_clean:
- dh_auto_clean -- MAKELEVEL=0
-override_dh_auto_build:
- dh_auto_build -- \
- MAKELEVEL=0 \
- EFI_PATH=/usr/lib \
- DEFAULT_LOADER='\\\\grub$(EFI_ARCH).efi' \
- VENDOR_CERT_FILE=$(cert)
-
-override_dh_fixperms:
- dh_fixperms
- chmod a-x debian/shim/usr/lib/shim/shim$(EFI_ARCH).efi
diff --git a/debian/shim.install b/debian/shim.install
deleted file mode 100644
index f37f6d19..00000000
--- a/debian/shim.install
+++ /dev/null
@@ -1,3 +0,0 @@
-shim*.efi /usr/lib/shim
-mm*.efi.signed /usr/lib/shim
-fb*.efi.signed /usr/lib/shim
diff --git a/debian/source/format b/debian/source/format
deleted file mode 100644
index 163aaf8d..00000000
--- a/debian/source/format
+++ /dev/null
@@ -1 +0,0 @@
-3.0 (quilt)
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
deleted file mode 100644
index d82be748..00000000
--- a/debian/source/include-binaries
+++ /dev/null
@@ -1,2 +0,0 @@
-debian/canonical-uefi-ca.der
-debian/debian-uefi-ca.der
diff --git a/debian/watch b/debian/watch
deleted file mode 100644
index 361d88c4..00000000
--- a/debian/watch
+++ /dev/null
@@ -1,5 +0,0 @@
-# Compulsory line, this is a version 4 file
-version=4
-
-opts="repack,compression=xz,filenamemangle=s/.+\/v?(\d\S*)\.tar\.gz/shim-$1\.tar\.gz/" \
- https://github.com/mjg59/shim/releases .*/v?(\d\S*)\.tar\.gz
diff --git a/fallback.c b/fallback.c
index 09749bb6..46894aff 100644
--- a/fallback.c
+++ b/fallback.c
@@ -12,6 +12,7 @@
#include "ucs2.h"
#include "variables.h"
+#include "tpm.h"
EFI_LOADED_IMAGE *this_image = NULL;
@@ -286,6 +287,105 @@ add_boot_option(EFI_DEVICE_PATH *hddp, EFI_DEVICE_PATH *fulldp,
return EFI_OUT_OF_RESOURCES;
}
+/*
+ * AMI BIOS (e.g, Intel NUC5i3MYHE) may automatically hide and patch BootXXXX
+ * variables with ami_masked_device_path_guid. We can get the valid device path
+ * if just skipping it and its next end path.
+ */
+
+static EFI_GUID ami_masked_device_path_guid = {
+ 0x99e275e7, 0x75a0, 0x4b37,
+ { 0xa2, 0xe6, 0xc5, 0x38, 0x5e, 0x6c, 0x0, 0xcb }
+};
+
+static unsigned int
+calc_masked_boot_option_size(unsigned int size)
+{
+ return size + sizeof(EFI_DEVICE_PATH) +
+ sizeof(ami_masked_device_path_guid) + sizeof(EFI_DEVICE_PATH);
+}
+
+static int
+check_masked_boot_option(CHAR8 *candidate, unsigned int candidate_size,
+ CHAR8 *data, unsigned int data_size)
+{
+ /*
+ * The patched BootXXXX variables contain a hardware device path and
+ * an end path, preceding the real device path.
+ */
+ if (calc_masked_boot_option_size(data_size) != candidate_size)
+ return 1;
+
+ CHAR8 *cursor = candidate;
+
+ /* Check whether the BootXXXX is patched */
+ cursor += sizeof(UINT32) + sizeof(UINT16);
+ cursor += StrSize((CHAR16 *)cursor);
+
+ unsigned int min_valid_size = cursor - candidate + sizeof(EFI_DEVICE_PATH);
+
+ if (candidate_size <= min_valid_size)
+ return 1;
+
+ EFI_DEVICE_PATH *dp = (EFI_DEVICE_PATH *)cursor;
+ unsigned int node_size = DevicePathNodeLength(dp) - sizeof(EFI_DEVICE_PATH);
+
+ min_valid_size += node_size;
+ if (candidate_size <= min_valid_size ||
+ DevicePathType(dp) != HARDWARE_DEVICE_PATH ||
+ DevicePathSubType(dp) != HW_VENDOR_DP ||
+ node_size != sizeof(ami_masked_device_path_guid) ||
+ CompareGuid((EFI_GUID *)(cursor + sizeof(EFI_DEVICE_PATH)),
+ &ami_masked_device_path_guid))
+ return 1;
+
+ /* Check whether the patched guid is followed by an end path */
+ min_valid_size += sizeof(EFI_DEVICE_PATH);
+ if (candidate_size <= min_valid_size)
+ return 1;
+
+ dp = NextDevicePathNode(dp);
+ if (!IsDevicePathEnd(dp))
+ return 1;
+
+ /*
+ * OK. We may really get a masked BootXXXX variable. The next
+ * step is to test whether it is hidden.
+ */
+ UINT32 attrs = *(UINT32 *)candidate;
+#ifndef LOAD_OPTION_HIDDEN
+# define LOAD_OPTION_HIDDEN 0x00000008
+#endif
+ if (!(attrs & LOAD_OPTION_HIDDEN))
+ return 1;
+
+ attrs &= ~LOAD_OPTION_HIDDEN;
+
+ /* Compare the field Attributes */
+ if (attrs != *(UINT32 *)data)
+ return 1;
+
+ /* Compare the field FilePathListLength */
+ data += sizeof(UINT32);
+ candidate += sizeof(UINT32);
+ if (calc_masked_boot_option_size(*(UINT16 *)data) !=
+ *(UINT16 *)candidate)
+ return 1;
+
+ /* Compare the field Description */
+ data += sizeof(UINT16);
+ candidate += sizeof(UINT16);
+ if (CompareMem(candidate, data, cursor - candidate))
+ return 1;
+
+ /* Compare the filed FilePathList */
+ cursor = (CHAR8 *)NextDevicePathNode(dp);
+ data += sizeof(UINT16);
+ data += StrSize((CHAR16 *)data);
+
+ return CompareMem(cursor, data, candidate_size - min_valid_size);
+}
+
EFI_STATUS
find_boot_option(EFI_DEVICE_PATH *dp, EFI_DEVICE_PATH *fulldp,
CHAR16 *filename, CHAR16 *label, CHAR16 *arguments,
@@ -315,7 +415,8 @@ find_boot_option(EFI_DEVICE_PATH *dp, EFI_DEVICE_PATH *fulldp,
EFI_GUID global = EFI_GLOBAL_VARIABLE;
EFI_STATUS rc;
- CHAR8 *candidate = AllocateZeroPool(size);
+ UINTN max_candidate_size = calc_masked_boot_option_size(size);
+ CHAR8 *candidate = AllocateZeroPool(max_candidate_size);
if (!candidate) {
FreePool(data);
return EFI_OUT_OF_RESOURCES;
@@ -327,17 +428,21 @@ find_boot_option(EFI_DEVICE_PATH *dp, EFI_DEVICE_PATH *fulldp,
varname[6] = hexmap[(bootorder[i] & 0x00f0) >> 4];
varname[7] = hexmap[(bootorder[i] & 0x000f) >> 0];
- UINTN candidate_size = size;
+ UINTN candidate_size = max_candidate_size;
rc = uefi_call_wrapper(RT->GetVariable, 5, varname, &global,
NULL, &candidate_size, candidate);
if (EFI_ERROR(rc))
continue;
- if (candidate_size != size)
+ if (candidate_size != size) {
+ if (check_masked_boot_option(candidate, candidate_size,
+ data, size))
+ continue;
+ } else if (CompareMem(candidate, data, size))
continue;
- if (CompareMem(candidate, data, size))
- continue;
+ VerbosePrint(L"Found boot entry \"%s\" with label \"%s\" "
+ L"for file \"%s\"\n", varname, label, filename);
/* at this point, we have duplicate data. */
if (!first_new_option) {
@@ -481,7 +586,7 @@ add_to_boot_list(CHAR16 *dirname, CHAR16 *filename, CHAR16 *label, CHAR16 *argum
err:
if (full_device_path)
FreePool(full_device_path);
- if (dp)
+ if (dp && dp != full_device_path)
FreePool(dp);
if (fullpath)
FreePool(fullpath);
@@ -904,7 +1009,13 @@ efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *systab)
return rc;
}
- try_start_first_option(image);
+ rc = fallback_should_prefer_reset();
+ if (EFI_ERROR(rc)) {
+ VerbosePrint(L"tpm not present, starting the first image\n");
+ try_start_first_option(image);
+ } else {
+ VerbosePrint(L"tpm present, resetting system\n");
+ }
Print(L"Reset System\n");
diff --git a/shim.c b/shim.c
index 6e040c4f..bd314b31 100644
--- a/shim.c
+++ b/shim.c
@@ -40,7 +40,6 @@
#include "shim.h"
#include "netboot.h"
#include "httpboot.h"
-#include "shim_cert.h"
#include "replacements.h"
#include "tpm.h"
#include "ucs2.h"
@@ -52,6 +51,10 @@
#include "console.h"
#include "version.h"
+#ifdef ENABLE_SHIM_CERT
+#include "shim_cert.h"
+#endif
+
#include <stdarg.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
@@ -428,7 +431,8 @@ static BOOLEAN verify_eku(UINT8 *Cert, UINTN CertSize)
static CHECK_STATUS check_db_cert_in_ram(EFI_SIGNATURE_LIST *CertList,
UINTN dbsize,
WIN_CERTIFICATE_EFI_PKCS *data,
- UINT8 *hash)
+ UINT8 *hash, CHAR16 *dbname,
+ EFI_GUID guid)
{
EFI_SIGNATURE_DATA *Cert;
UINTN CertSize;
@@ -446,8 +450,10 @@ static CHECK_STATUS check_db_cert_in_ram(EFI_SIGNATURE_LIST *CertList,
Cert->SignatureData,
CertSize,
hash, SHA256_DIGEST_SIZE);
- if (IsFound)
+ if (IsFound) {
+ tpm_measure_variable(dbname, guid, CertSize, Cert->SignatureData);
return DATA_FOUND;
+ }
}
} else if (verbose) {
console_notify(L"Not a DER encoding x.509 Certificate");
@@ -477,7 +483,7 @@ static CHECK_STATUS check_db_cert(CHAR16 *dbname, EFI_GUID guid,
CertList = (EFI_SIGNATURE_LIST *)db;
- rc = check_db_cert_in_ram(CertList, dbsize, data, hash);
+ rc = check_db_cert_in_ram(CertList, dbsize, data, hash, dbname, guid);
FreePool(db);
@@ -489,7 +495,8 @@ static CHECK_STATUS check_db_cert(CHAR16 *dbname, EFI_GUID guid,
*/
static CHECK_STATUS check_db_hash_in_ram(EFI_SIGNATURE_LIST *CertList,
UINTN dbsize, UINT8 *data,
- int SignatureSize, EFI_GUID CertType)
+ int SignatureSize, EFI_GUID CertType,
+ CHAR16 *dbname, EFI_GUID guid)
{
EFI_SIGNATURE_DATA *Cert;
UINTN CertCount, Index;
@@ -505,6 +512,7 @@ static CHECK_STATUS check_db_hash_in_ram(EFI_SIGNATURE_LIST *CertList,
// Find the signature in database.
//
IsFound = TRUE;
+ tpm_measure_variable(dbname, guid, SignatureSize, data);
break;
}
@@ -545,7 +553,8 @@ static CHECK_STATUS check_db_hash(CHAR16 *dbname, EFI_GUID guid, UINT8 *data,
CertList = (EFI_SIGNATURE_LIST *)db;
CHECK_STATUS rc = check_db_hash_in_ram(CertList, dbsize, data,
- SignatureSize, CertType);
+ SignatureSize, CertType,
+ dbname, guid);
FreePool(db);
return rc;
@@ -563,15 +572,18 @@ static EFI_STATUS check_blacklist (WIN_CERTIFICATE_EFI_PKCS *cert,
EFI_SIGNATURE_LIST *dbx = (EFI_SIGNATURE_LIST *)vendor_dbx;
if (check_db_hash_in_ram(dbx, vendor_dbx_size, sha256hash,
- SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID) ==
+ SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID,
+ L"dbx", secure_var) ==
DATA_FOUND)
return EFI_SECURITY_VIOLATION;
if (check_db_hash_in_ram(dbx, vendor_dbx_size, sha1hash,
- SHA1_DIGEST_SIZE, EFI_CERT_SHA1_GUID) ==
+ SHA1_DIGEST_SIZE, EFI_CERT_SHA1_GUID,
+ L"dbx", secure_var) ==
DATA_FOUND)
return EFI_SECURITY_VIOLATION;
if (cert && check_db_cert_in_ram(dbx, vendor_dbx_size, cert,
- sha256hash) == DATA_FOUND)
+ sha256hash, L"dbx",
+ secure_var) == DATA_FOUND)
return EFI_SECURITY_VIOLATION;
if (check_db_hash(L"dbx", secure_var, sha256hash, SHA256_DIGEST_SIZE,
@@ -953,13 +965,13 @@ static EFI_STATUS verify_mok (void) {
* Check that the signature is valid and matches the binary
*/
static EFI_STATUS verify_buffer (char *data, int datasize,
- PE_COFF_LOADER_IMAGE_CONTEXT *context)
+ PE_COFF_LOADER_IMAGE_CONTEXT *context,
+ UINT8 *sha256hash, UINT8 *sha1hash)
{
- UINT8 sha256hash[SHA256_DIGEST_SIZE];
- UINT8 sha1hash[SHA1_DIGEST_SIZE];
EFI_STATUS status = EFI_SECURITY_VIOLATION;
WIN_CERTIFICATE_EFI_PKCS *cert = NULL;
unsigned int size = datasize;
+ EFI_GUID shim_var = SHIM_LOCK_GUID;
if (context->SecDir->Size != 0) {
if (context->SecDir->Size >= size) {
@@ -1017,6 +1029,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
return status;
if (cert) {
+#if defined(ENABLE_SHIM_CERT)
/*
* Check against the shim build key
*/
@@ -1026,9 +1039,11 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
shim_cert, sizeof(shim_cert), sha256hash,
SHA256_DIGEST_SIZE)) {
update_verification_method(VERIFIED_BY_CERT);
+ tpm_measure_variable(L"Shim", shim_var, sizeof(shim_cert), shim_cert);
status = EFI_SUCCESS;
return status;
}
+#endif /* defined(ENABLE_SHIM_CERT) */
/*
* And finally, check against shim's built-in key
@@ -1039,6 +1054,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
vendor_cert, vendor_cert_size,
sha256hash, SHA256_DIGEST_SIZE)) {
update_verification_method(VERIFIED_BY_CERT);
+ tpm_measure_variable(L"Shim", shim_var, vendor_cert_size, vendor_cert);
status = EFI_SUCCESS;
return status;
}
@@ -1194,6 +1210,8 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize,
unsigned int alignment, alloc_size;
EFI_PHYSICAL_ADDRESS alloc_address;
int found_entry_point = 0;
+ UINT8 sha1hash[SHA1_DIGEST_SIZE];
+ UINT8 sha256hash[SHA256_DIGEST_SIZE];
/*
* The binary header contains relevant context and section pointers
@@ -1207,8 +1225,17 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize,
/*
* We only need to verify the binary if we're in secure mode
*/
+ efi_status = generate_hash(data, datasize, &context, sha256hash,
+ sha1hash);
+ if (efi_status != EFI_SUCCESS)
+ return efi_status;
+
+ /* Measure the binary into the TPM */
+ tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize, sha1hash, 4);
+
if (secure_mode ()) {
- efi_status = verify_buffer(data, datasize, &context);
+ efi_status = verify_buffer(data, datasize, &context,
+ sha256hash, sha1hash);
if (EFI_ERROR(efi_status)) {
console_error(L"Verification failed", efi_status);
@@ -1699,6 +1726,8 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
{
EFI_STATUS status = EFI_SUCCESS;
PE_COFF_LOADER_IMAGE_CONTEXT context;
+ UINT8 sha1hash[SHA1_DIGEST_SIZE];
+ UINT8 sha256hash[SHA256_DIGEST_SIZE];
loader_is_participating = 1;
in_protocol = 1;
@@ -1710,7 +1739,11 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
if (status != EFI_SUCCESS)
goto done;
- status = verify_buffer(buffer, size, &context);
+ status = generate_hash(buffer, size, &context, sha256hash, sha1hash);
+ if (status != EFI_SUCCESS)
+ goto done;
+
+ status = verify_buffer(buffer, size, &context, sha256hash, sha1hash);
done:
in_protocol = 0;
return status;
@@ -1814,10 +1847,6 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath)
}
}
- /* Measure the binary into the TPM */
- tpm_log_event((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize,
- 9, (CHAR8 *)"Second stage bootloader");
-
/*
* We need to modify the loaded image protocol entry before running
* the new binary, so back it up
@@ -1888,37 +1917,64 @@ EFI_STATUS init_grub(EFI_HANDLE image_handle)
}
/*
- * Measure some of the MOK variables into the TPM
+ * Measure some of the MOK variables into the TPM. We measure the entirety
+ * of MokList into PCR 14, and also measure the raw MokSBState there. PCR 7
+ * will be extended with MokSBState in the Microsoft format, and we'll
+ * measure any matching hashes or certificates later on in order to behave
+ * consistently with the PCR 7 spec.
*/
EFI_STATUS measure_mok()
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
- EFI_STATUS efi_status;
+ EFI_STATUS efi_status, ret = EFI_SUCCESS;
UINT8 *Data = NULL;
UINTN DataSize = 0;
efi_status = get_variable(L"MokList", &Data, &DataSize, shim_lock_guid);
- if (efi_status != EFI_SUCCESS)
- return efi_status;
+ if (!EFI_ERROR(efi_status)) {
+ efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)(UINTN)Data,
+ DataSize, 14, (CHAR8 *)"MokList");
+ FreePool(Data);
- efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)(UINTN)Data,
- DataSize, 14, (CHAR8 *)"MokList");
+ if (EFI_ERROR(efi_status))
+ ret = efi_status;
- FreePool(Data);
+ } else {
+ ret = efi_status;
+ }
- if (efi_status != EFI_SUCCESS)
- return efi_status;
+ efi_status = get_variable(L"MokListX", &Data, &DataSize, shim_lock_guid);
+ if (!EFI_ERROR(efi_status)) {
+ efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)(UINTN)Data,
+ DataSize, 14, (CHAR8 *)"MokListX");
+ FreePool(Data);
+
+ if (EFI_ERROR(efi_status) && !EFI_ERROR(ret))
+ ret = efi_status;
+
+ } else if (!EFI_ERROR(ret)) {
+ ret = efi_status;
+ }
efi_status = get_variable(L"MokSBState", &Data, &DataSize,
shim_lock_guid);
+ if (!EFI_ERROR(efi_status)) {
+ efi_status = tpm_measure_variable(L"MokSBState",
+ shim_lock_guid,
+ DataSize, Data);
+ if (!EFI_ERROR(efi_status)) {
+ efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)
+ (UINTN)Data, DataSize, 14,
+ (CHAR8 *)"MokSBState");
+ }
- if (efi_status != EFI_SUCCESS)
- return efi_status;
-
- efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)(UINTN)Data,
- DataSize, 14, (CHAR8 *)"MokSBState");
+ FreePool(Data);
- FreePool(Data);
+ if (EFI_ERROR(efi_status) && !EFI_ERROR(ret))
+ ret = efi_status;
+ } else if (!EFI_ERROR(ret)) {
+ ret = efi_status;
+ }
return efi_status;
}
diff --git a/tpm.c b/tpm.c
index c37cc484..05b3c6fb 100644
--- a/tpm.c
+++ b/tpm.c
@@ -1,6 +1,7 @@
#include <efi.h>
#include <efilib.h>
#include <string.h>
+#include <stdint.h>
#include "tpm.h"
@@ -14,6 +15,16 @@ extern UINT8 in_protocol;
})
+typedef struct {
+ CHAR16 *VariableName;
+ EFI_GUID *VendorGuid;
+ VOID *Data;
+ UINTN Size;
+} VARIABLE_RECORD;
+
+UINTN measuredcount = 0;
+VARIABLE_RECORD *measureddata = NULL;
+
EFI_GUID tpm_guid = EFI_TPM_GUID;
EFI_GUID tpm2_guid = EFI_TPM2_GUID;
@@ -108,27 +119,60 @@ static EFI_STATUS trigger_tcg2_final_events_table(efi_tpm2_protocol_t *tpm2,
&start, &end, &truncated);
}
-EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
- const CHAR8 *description)
+static EFI_STATUS tpm_locate_protocol(efi_tpm_protocol_t **tpm,
+ efi_tpm2_protocol_t **tpm2,
+ BOOLEAN *old_caps_p,
+ EFI_TCG2_BOOT_SERVICE_CAPABILITY *capsp)
{
EFI_STATUS status;
- efi_tpm_protocol_t *tpm;
- efi_tpm2_protocol_t *tpm2;
- status = LibLocateProtocol(&tpm2_guid, (VOID **)&tpm2);
+ *tpm = NULL;
+ *tpm2 = NULL;
+ status = LibLocateProtocol(&tpm2_guid, (VOID **)tpm2);
/* TPM 2.0 */
if (status == EFI_SUCCESS) {
BOOLEAN old_caps;
- EFI_TCG2_EVENT *event;
EFI_TCG2_BOOT_SERVICE_CAPABILITY caps;
- EFI_TCG2_EVENT_LOG_BITMAP supported_logs;
- status = tpm2_get_caps(tpm2, &caps, &old_caps);
- if (status != EFI_SUCCESS)
+ status = tpm2_get_caps(*tpm2, &caps, &old_caps);
+ if (EFI_ERROR(status))
+ return status;
+
+ if (tpm2_present(&caps, old_caps)) {
+ if (old_caps_p)
+ *old_caps_p = old_caps;
+ if (capsp)
+ memcpy(capsp, &caps, sizeof(caps));
return EFI_SUCCESS;
+ }
+ } else {
+ status = LibLocateProtocol(&tpm_guid, (VOID **)tpm);
+ if (EFI_ERROR(status))
+ return status;
- if (!tpm2_present(&caps, old_caps))
+ if (tpm_present(*tpm))
return EFI_SUCCESS;
+ }
+
+ return EFI_NOT_FOUND;
+}
+
+static EFI_STATUS tpm_log_event_raw(EFI_PHYSICAL_ADDRESS buf, UINTN size,
+ UINT8 pcr, const CHAR8 *log, UINTN logsize,
+ UINT32 type, CHAR8 *hash)
+{
+ EFI_STATUS status;
+ efi_tpm_protocol_t *tpm;
+ efi_tpm2_protocol_t *tpm2;
+ BOOLEAN old_caps;
+ EFI_TCG2_BOOT_SERVICE_CAPABILITY caps;
+
+ status = tpm_locate_protocol(&tpm, &tpm2, &old_caps, &caps);
+ if (EFI_ERROR(status)) {
+ return status;
+ } else if (tpm2) {
+ EFI_TCG2_EVENT *event;
+ EFI_TCG2_EVENT_LOG_BITMAP supported_logs;
supported_logs = tpm2_get_supported_logs(tpm2, &caps, old_caps);
@@ -138,7 +182,7 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
return status;
}
- event = AllocatePool(sizeof(*event) + strlen(description) + 1);
+ event = AllocatePool(sizeof(*event) + logsize);
if (!event) {
perror(L"Unable to allocate event structure\n");
return EFI_OUT_OF_RESOURCES;
@@ -147,14 +191,24 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
event->Header.HeaderSize = sizeof(EFI_TCG2_EVENT_HEADER);
event->Header.HeaderVersion = 1;
event->Header.PCRIndex = pcr;
- event->Header.EventType = EV_IPL;
- event->Size = sizeof(*event) - sizeof(event->Event) + strlen(description) + 1;
- memcpy(event->Event, description, strlen(description) + 1);
- status = uefi_call_wrapper(tpm2->hash_log_extend_event, 5, tpm2,
- 0, buf, (UINT64) size, event);
+ event->Header.EventType = type;
+ event->Size = sizeof(*event) - sizeof(event->Event) + logsize + 1;
+ CopyMem(event->Event, (VOID *)log, logsize);
+ if (hash) {
+ /* TPM 2 systems will generate the appropriate hash
+ themselves if we pass PE_COFF_IMAGE
+ */
+ status = uefi_call_wrapper(tpm2->hash_log_extend_event,
+ 5, tpm2, PE_COFF_IMAGE, buf,
+ (UINT64) size, event);
+ } else {
+ status = uefi_call_wrapper(tpm2->hash_log_extend_event,
+ 5, tpm2, 0, buf,
+ (UINT64) size, event);
+ }
FreePool(event);
return status;
- } else {
+ } else if (tpm) {
TCG_PCR_EVENT *event;
UINT32 eventnum = 0;
EFI_PHYSICAL_ADDRESS lastevent;
@@ -167,7 +221,7 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
if (!tpm_present(tpm))
return EFI_SUCCESS;
- event = AllocatePool(sizeof(*event) + strlen(description) + 1);
+ event = AllocatePool(sizeof(*event) + logsize);
if (!event) {
perror(L"Unable to allocate event structure\n");
@@ -175,14 +229,164 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
}
event->PCRIndex = pcr;
- event->EventType = EV_IPL;
- event->EventSize = strlen(description) + 1;
- status = uefi_call_wrapper(tpm->log_extend_event, 7, tpm, buf,
- (UINT64)size, TPM_ALG_SHA, event,
- &eventnum, &lastevent);
+ event->EventType = type;
+ event->EventSize = logsize;
+ CopyMem(event->Event, (VOID *)log, logsize);
+ if (hash) {
+ /* TPM 1.2 devices require us to pass the Authenticode
+ hash rather than allowing the firmware to attempt
+ to calculate it */
+ CopyMem(event->digest, hash, sizeof(event->digest));
+ status = uefi_call_wrapper(tpm->log_extend_event, 7,
+ tpm, 0, 0, TPM_ALG_SHA,
+ event, &eventnum,
+ &lastevent);
+ } else {
+ status = uefi_call_wrapper(tpm->log_extend_event, 7,
+ tpm, buf, (UINT64)size,
+ TPM_ALG_SHA, event,
+ &eventnum, &lastevent);
+ }
FreePool(event);
return status;
}
return EFI_SUCCESS;
}
+
+EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
+ const CHAR8 *description)
+{
+ return tpm_log_event_raw(buf, size, pcr, description,
+ strlen(description) + 1, 0xd, NULL);
+}
+
+EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 *sha1hash,
+ UINT8 pcr)
+{
+ EFI_IMAGE_LOAD_EVENT ImageLoad;
+
+ // All of this is informational and forces us to do more parsing before
+ // we can generate it, so let's just leave it out for now
+ ImageLoad.ImageLocationInMemory = 0;
+ ImageLoad.ImageLengthInMemory = 0;
+ ImageLoad.ImageLinkTimeAddress = 0;
+ ImageLoad.LengthOfDevicePath = 0;
+
+ return tpm_log_event_raw(buf, size, pcr, (CHAR8 *)&ImageLoad,
+ sizeof(ImageLoad),
+ EV_EFI_BOOT_SERVICES_APPLICATION, sha1hash);
+}
+
+typedef struct {
+ EFI_GUID VariableName;
+ UINT64 UnicodeNameLength;
+ UINT64 VariableDataLength;
+ CHAR16 UnicodeName[1];
+ INT8 VariableData[1];
+} EFI_VARIABLE_DATA_TREE;
+
+static BOOLEAN tpm_data_measured(CHAR16 *VarName, EFI_GUID VendorGuid, UINTN VarSize, VOID *VarData)
+{
+ UINTN i;
+
+ for (i=0; i<measuredcount; i++) {
+ if ((StrCmp (VarName, measureddata[i].VariableName) == 0) &&
+ (CompareGuid (&VendorGuid, measureddata[i].VendorGuid)) &&
+ (VarSize == measureddata[i].Size) &&
+ (CompareMem (VarData, measureddata[i].Data, VarSize) == 0)) {
+ return TRUE;
+ }
+ }
+
+ return FALSE;
+}
+
+static EFI_STATUS tpm_record_data_measurement(CHAR16 *VarName, EFI_GUID VendorGuid, UINTN VarSize, VOID *VarData)
+{
+ if (measureddata == NULL) {
+ measureddata = AllocatePool(sizeof(*measureddata));
+ } else {
+ measureddata = ReallocatePool(measureddata, measuredcount * sizeof(*measureddata),
+ (measuredcount + 1) * sizeof(*measureddata));
+ }
+
+ if (measureddata == NULL)
+ return EFI_OUT_OF_RESOURCES;
+
+ measureddata[measuredcount].VariableName = AllocatePool(StrSize(VarName));
+ measureddata[measuredcount].VendorGuid = AllocatePool(sizeof(EFI_GUID));
+ measureddata[measuredcount].Data = AllocatePool(VarSize);
+
+ if (measureddata[measuredcount].VariableName == NULL ||
+ measureddata[measuredcount].VendorGuid == NULL ||
+ measureddata[measuredcount].Data == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ StrCpy(measureddata[measuredcount].VariableName, VarName);
+ CopyMem(measureddata[measuredcount].VendorGuid, &VendorGuid, sizeof(EFI_GUID));
+ CopyMem(measureddata[measuredcount].Data, VarData, VarSize);
+ measureddata[measuredcount].Size = VarSize;
+ measuredcount++;
+
+ return EFI_SUCCESS;
+}
+
+EFI_STATUS tpm_measure_variable(CHAR16 *VarName, EFI_GUID VendorGuid, UINTN VarSize, VOID *VarData)
+{
+ EFI_STATUS Status;
+ UINTN VarNameLength;
+ EFI_VARIABLE_DATA_TREE *VarLog;
+ UINT32 VarLogSize;
+
+ /* Don't measure something that we've already measured */
+ if (tpm_data_measured(VarName, VendorGuid, VarSize, VarData))
+ return EFI_SUCCESS;
+
+ VarNameLength = StrLen (VarName);
+ VarLogSize = (UINT32)(sizeof (*VarLog) +
+ VarNameLength * sizeof (*VarName) +
+ VarSize -
+ sizeof (VarLog->UnicodeName) -
+ sizeof (VarLog->VariableData));
+
+ VarLog = (EFI_VARIABLE_DATA_TREE *) AllocateZeroPool (VarLogSize);
+ if (VarLog == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ CopyMem (&VarLog->VariableName, &VendorGuid,
+ sizeof(VarLog->VariableName));
+ VarLog->UnicodeNameLength = VarNameLength;
+ VarLog->VariableDataLength = VarSize;
+ CopyMem (VarLog->UnicodeName, VarName,
+ VarNameLength * sizeof (*VarName));
+ CopyMem ((CHAR16 *)VarLog->UnicodeName + VarNameLength, VarData,
+ VarSize);
+
+ Status = tpm_log_event_raw((EFI_PHYSICAL_ADDRESS)(intptr_t)VarLog,
+ VarLogSize, 7, (CHAR8 *)VarLog, VarLogSize,
+ EV_EFI_VARIABLE_AUTHORITY, NULL);
+
+ FreePool(VarLog);
+
+ if (Status != EFI_SUCCESS)
+ return Status;
+
+ return tpm_record_data_measurement(VarName, VendorGuid, VarSize,
+ VarData);
+}
+
+EFI_STATUS
+fallback_should_prefer_reset(void)
+{
+ EFI_STATUS status;
+ efi_tpm_protocol_t *tpm;
+ efi_tpm2_protocol_t *tpm2;
+
+ status = tpm_locate_protocol(&tpm, &tpm2, NULL, NULL);
+ if (EFI_ERROR(status))
+ return EFI_NOT_FOUND;
+ return EFI_SUCCESS;
+}
diff --git a/tpm.h b/tpm.h
index cc1bbedb..d11b545b 100644
--- a/tpm.h
+++ b/tpm.h
@@ -1,3 +1,5 @@
+#include <efilib.h>
+
#define EFI_TPM_GUID {0xf541796d, 0xa62e, 0x4954, {0xa7, 0x75, 0x95, 0x84, 0xf6, 0x1b, 0x9c, 0xdd }};
#define EFI_TPM2_GUID {0x607f766c, 0x7455, 0x42be, {0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f }};
@@ -6,6 +8,12 @@
EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
const CHAR8 *description);
+EFI_STATUS fallback_should_prefer_reset(void);
+
+EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 *sha1hash,
+ UINT8 pcr);
+
+EFI_STATUS tpm_measure_variable(CHAR16 *dbname, EFI_GUID guid, UINTN size, void *data);
typedef struct {
uint8_t Major;
@@ -31,6 +39,14 @@ typedef struct _TCG_PCR_EVENT {
uint8_t Event[1];
} TCG_PCR_EVENT;
+typedef struct _EFI_IMAGE_LOAD_EVENT {
+ EFI_PHYSICAL_ADDRESS ImageLocationInMemory;
+ UINTN ImageLengthInMemory;
+ UINTN ImageLinkTimeAddress;
+ UINTN LengthOfDevicePath;
+ EFI_DEVICE_PATH DevicePath[1];
+} EFI_IMAGE_LOAD_EVENT;
+
struct efi_tpm_protocol
{
EFI_STATUS (EFIAPI *status_check) (struct efi_tpm_protocol *this,
@@ -154,3 +170,19 @@ struct efi_tpm2_protocol
};
typedef struct efi_tpm2_protocol efi_tpm2_protocol_t;
+
+typedef UINT32 TCG_EVENTTYPE;
+
+#define EV_EFI_EVENT_BASE ((TCG_EVENTTYPE) 0x80000000)
+#define EV_EFI_VARIABLE_DRIVER_CONFIG (EV_EFI_EVENT_BASE + 1)
+#define EV_EFI_VARIABLE_BOOT (EV_EFI_EVENT_BASE + 2)
+#define EV_EFI_BOOT_SERVICES_APPLICATION (EV_EFI_EVENT_BASE + 3)
+#define EV_EFI_BOOT_SERVICES_DRIVER (EV_EFI_EVENT_BASE + 4)
+#define EV_EFI_RUNTIME_SERVICES_DRIVER (EV_EFI_EVENT_BASE + 5)
+#define EV_EFI_GPT_EVENT (EV_EFI_EVENT_BASE + 6)
+#define EV_EFI_ACTION (EV_EFI_EVENT_BASE + 7)
+#define EV_EFI_PLATFORM_FIRMWARE_BLOB (EV_EFI_EVENT_BASE + 8)
+#define EV_EFI_HANDOFF_TABLES (EV_EFI_EVENT_BASE + 9)
+#define EV_EFI_VARIABLE_AUTHORITY (EV_EFI_EVENT_BASE + 0xE0)
+
+#define PE_COFF_IMAGE 0x0000000000000010
generated by cgit v1.2.3 (git 2.39.1) at 2025-12-24 20:19:48 +0000