summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-09-29Bump the version to 1313Peter Jones
shim 13: - OpenSSL reverted to 1.0.2k to make the cert chaining of existing deployments stay working - Better PCR usage for TPM - TPM documentation in README.tpm - More configurable build via make variables: ENABLE_SHIM_CERT ENABLE_SHIM_HASH ENABLE_SBSIGN LIBDIR EFIDIR VENDOR_CERT_FILE VENDOR_DB_FILE - Better MoK documentation in MokVars.txt - Better debuginfo generation - Lots of minor bug fixes. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-29buildid: Check the return values of write() callsMathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-29Make shim_cert.h able to be included more safely.Peter Jones
If you build with ENABLE_SHIM_CERT=1, the include chain right now winds up meaning shim_cert is defined in a header that gets included in netboot.c as well, which never uses it: In file included from shim.h:125:0, from netboot.c:36: shim_cert.h:1:14: error: ‘shim_cert’ defined but not used [-Werror=unused-variable] static UINT8 shim_cert[] = { ^~~~~~~~~ cc1: all warnings being treated as errors So make that okay by adding __attribute__((__unused__)) to the variable decl. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-29buildid: make 'make clean' remove it.Peter Jones
2017-09-26Use iconv for UCS-2 encoding.Peter Jones
Cyphermox discovered that when you run this: ( printf "\xff\x00\xfe\x00" ; echo "shimx64.efi,foo,,This is the boot entry for foo" ) | sed -z 's/./&\x00/g' on some debian machines, printf(1) doesn't interpret the \x.. characters, and that results in this being the encoded text: 00000000 5c 78 66 66 5c 78 66 65 73 00 68 00 69 00 6d 00 |\xff\xfes.h.i.m.| 00000010 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 2c 00 |x.6.4...e.f.i.,.| 00000020 66 00 6f 00 6f 00 2c 00 2c 00 54 00 68 00 69 00 |f.o.o.,.,.T.h.i.| which... yeah, that's wrong. So instead, use iconv instead of printf+sed to encode it in UCS-2. Unfortunately, that means we don't get endian markers, because for some reason iconv(1) doesn't have any way to say it should include them. But that's okay; fallback already handles not having them and just assumes the second byte being \x00 means UCS-2LE. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Fix an LDFLAGS issue on arm and aarch64Peter Jones
Commit 1e71734992 inadvertantly switched ARM's LDFLAGS+=--defsym=EFI_SUBSYSTEM=$(SUBSYSTEM) to be before LDFLAGS is set, and so it got clobbered away. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Try to do a slightly better job at 'make clean'Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-14Don't build shim_cert.h in parallel with other targets.Mathieu Trudel-Lapierre
shim_cert.h is required by other pieces (such as netboot.o, cert.o) and might not be built by the time these targets are reached. In that case the build would fail as it can't find a required header. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-14Clean up after BOOT$(ARCH).CSV.Mathieu Trudel-Lapierre
It should not be left around after clean since it's a generated file. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-13try to show errors more usefully.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some debugging data to the last malformed binary check...Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some defaults and a syntastic file so vim helps more.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Work around some annoying compiler grievancesPeter Jones
I'm still having some trouble with the offsetof() definition, so just nerf it to what stddef.h would say anyway. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Some things went weird with the openssl revert...Peter Jones
I think this works around most of them. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Cryptlib: remove DESGary Lin
Disable DES completely since it's already old and insecure. This makes MokManager not support the DES based password hash but probably no one is using it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: Remove MD4Gary Lin
MD4 is known to be insecure and shim never uses it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: amend the headers and fix signnessGary Lin
- Declare some functions in the proper headers + We missed them for a long time... - Cast offsetof to UINTN + The original casting triggers the gcc warning since int can not present the offset for the 64bit machines. - Cast the "char" array to "CHAR8 *" to avoid the gcc warnings - Implement atoi correctly Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Fix build with ENABLE_SHIM_CERT and ENABLE_SBSIGN: shim.key is created by ↵Mathieu Trudel-Lapierre
the shim.crt target Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-31Cryptlib: implement strcmp() and strcasecmp()Gary Lin
strcmp() and strcasecmp() are widely used in openssl. Implement those two functions to eliminate the gcc warnings and the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Cryptlib: Include stddef.h in CrtLibSupport.hGary Lin
The changes in the openssl headers cause the inclusion of CrtLibSupport.h eariler than the inclusion of stddef.h, so "offsetof" was defined twice and this caused the followling build error: In file included from Cryptlib/Include/openssl/buffer.h:23:0, from Cryptlib/Include/openssl/x509.h:22, from shim.c:56: /usr/lib64/gcc/x86_64-suse-linux/6/include/stddef.h:417:0: error: "offsetof" redefined [-Werror] #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) In file included from Cryptlib/Include/limits.h:15:0, from Cryptlib/Include/openssl/ossl_typ.h:13, from Cryptlib/Include/openssl/x509.h:20, from shim.c:56: Cryptlib/Include/CrtLibSupport.h:192:0: note: this is the location of the previous definition #define offsetof(type, member) ( (int) & ((type*)0) -> member ) We can lower the priority of the gcc include path or just remove the path, but this might cause problem since the path was introduced on purpose(*). Instead, including stddef.h first is more feasible. (*) https://github.com/rhinstaller/shim/commit/d51739a416400ad348d8a1c7e3886abce11fff1b Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Revert lots of Cryptlib updates.Peter Jones
OpenSSL changes quite a bit of the key validation, and most of the keys I can find in the wild aren't marked as trusted by the new checker. Intel noticed this too: https://github.com/vathpela/edk2/commit/f536d7c3ed but instead of fixing the compatibility error, they switched their test data to match the bug. So that's pretty broken. For now, I'm reverting OpenSSL 1.1.0e, because we need those certs in the wild to work. This reverts commit 513cbe2aea689bf968f171f894f3d4cdb43524d5. This reverts commit e9cc33d6f2b7f35c6f5e349fd83fb9ae0bc66226. This reverts commit 80d49f758ead0180bfe6161931838e0578248303. This reverts commit 9bc647e2b23bcfd69a0077c0717fbc454c919a57. This reverts commit ae75df6232ad30f3e8736e9449692d58a7439260. This reverts commit e883479f35644d17db7efed710657c8543cfcb68. This reverts commit 97469449fda5ba933a64280917e776487301a127. This reverts commit e39692647f78e13d757ddbfdd36f440d5f526050. This reverts commit 0f3dfc01e2d5e7df882c963dd8dc4a0dfbfc96ad. This reverts commit 4da6ac819510c7cc4ba21d7a735d69b45daa5873. This reverts commit d064bd7eef201f26cb926450a76260b5187ac689. This reverts commit 9bc86cfd6f9387f0da9d5c0102b6aa5627e91c91. This reverts commit ab9a05a10f16b33f7ee1e9da360c7801eebdb9d2. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Drain the OpenSSL error stack and report crypto verification errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Init openssl so we can use its debug facilities.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Add a mechanism to print openssl errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Fix a missing OpenSSL error message pointPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Make msleep() be a thingPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-18Rework looping in enter_mok_menu(), to allow multiple MOK changesMathieu Trudel-Lapierre
Rather than looping once through the possible actions (MokNew, MokDel, etc.), revise the logic so that instead of rebooting immediately we get back to the main menu setting a flag to replace "Continue booting" with a proper reboot. Getting back to the menu means we can go make other changes before rebooting. For instance, you might want to enable validation, but beforehand you also need to enroll a MOK. You can already do so from userland; except the requests were cleared as soon as one of them was processed. This involves some extra cleanup of the states to avoid running the same request more than once, removing the option from the menu once it's done, and changing prompting functions to return an EFI_STATUS so we can better track whether the process has succeeded. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-11Add ENABLE_SHIM_HASH and make install-as-data know how to install it.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Update TODO with some stuffPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make better debuginfo and install it reasonably.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Allow use of sbsign to sign things.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Add ENABLE_SHIM_CERT to make MokManager/fallback signing optional.Peter Jones
This makes shim not create its own keyring and sign MokManager and fallback by default. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make DEFAULT_LOADER have the EFI arch suffix by default.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make ARM targets use -mstrict-alignPeter Jones
Otherwise device paths are definitely all kinds of screwed up, but other stuff might be as well. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Add install targets.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Fix openssl compile flags for x86_64Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11fallback: work around the issue of boot option creation with AMI BIOSLans Zhang
AMI BIOS (e.g, Intel NUC5i3MYHE) may automatically hide and patch BootXXXX variables with ami_masked_device_path_guid. Initially, the normal boot option created by fallback looks like this: 00000000 01 00 00 00 5e 00 42 00 6f 00 6f 00 74 00 6c 00 |....^.B.o.o.t.l.| 00000010 6f 00 61 00 64 00 65 00 72 00 20 00 54 00 65 00 |o.a.d.e.r. .T.e.| 00000020 73 00 74 00 20 00 28 00 36 00 34 00 2d 00 62 00 |s.t. .(.6.4.-.b.| 00000030 69 00 74 00 29 00 00 00 04 01 2a 00 01 00 00 00 |i.t.).....*.....| 00000040 00 08 00 00 00 00 00 00 00 00 08 00 00 00 00 00 |................| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 01 01 04 04 30 00 5c 00 45 00 46 00 49 00 5c 00 |....0.\.E.F.I.\.| 00000070 42 00 4f 00 4f 00 54 00 5c 00 74 00 65 00 73 00 |B.O.O.T.\.t.e.s.| 00000080 74 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 |t.x.6.4...e.f.i.| 00000090 00 00 7f ff 04 00 |......| 00000096 after reboot, fallback has to create a new one due to the previous boot option is hidden and masked by AMI BIOS: 00000000 09 00 00 00 76 00 42 00 6f 00 6f 00 74 00 6c 00 |....v.B.o.o.t.l.| 00000010 6f 00 61 00 64 00 65 00 72 00 20 00 54 00 65 00 |o.a.d.e.r. .T.e.| 00000020 73 00 74 00 20 00 28 00 36 00 34 00 2d 00 62 00 |s.t. .(.6.4.-.b.| 00000030 69 00 74 00 29 00 00 00 01 04 14 00 e7 75 e2 99 |i.t.)........u..| 00000040 a0 75 37 4b a2 e6 c5 38 5e 6c 00 cb 7f ff 04 00 |.u7K...8^l......| 00000050 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 |..*.............| 00000060 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 00 00 00 00 01 01 04 04 30 00 5c 00 |............0.\.| 00000080 45 00 46 00 49 00 5c 00 42 00 4f 00 4f 00 54 00 |E.F.I.\.B.O.O.T.| 00000090 5c 00 74 00 65 00 73 00 74 00 78 00 36 00 34 00 |\.t.e.s.t.x.6.4.| 000000a0 2e 00 65 00 66 00 69 00 00 00 7f ff 04 00 |..e.f.i.......| 000000ae And after several reboot, fallback will have to create more boot options because AMI BIOS corrupts the previous ones. We can get the valid device path if just skipping the masked device path and its next end path. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-08-11fallback: fix double free of dpLans Zhang
If the boot option recorded in csv is not in a media device path, the corresponding full device path will be referred for creating the boot variable. However, the current code logic always frees the full device path (full_device_path) and the media device path (dp) separately. In order to resolve this issue, always check whether dp equals to full_device_path before freeing dp. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-08-03Add README.tpm to explain which PCRs we extend things to.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Add MokListX to MokVars.txtPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Make fallback aware of tpm measurements, and reboot if tpm is used.Peter Jones
Since booting the entry with fallback in the stack of things that got measured will result in all the wrong PCR values, in the cases where TPM is present and enabled, use ->Reset() instead of loading the Boot#### variable and executing its target. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Make tpm.c build right on 32-bit platforms.Peter Jones
EFI_PHYSICAL_ADDRESS is UINT64 everywhere, so you can't just copy a 32-bit pointer to it. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Always measure all of MokSBState, MokList, and MokListXPeter Jones
Even if errors occurred, always try to measure all of our Mok entries. This way we won't fail on e.g. MokList not being set. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Measure stage 2 according to specMatthew Garrett
We're currently measuring the raw second stage loader into PCR 9, but we're closer to spec if we measure the semi-parsed PE into PCR 4. The hash that's logged is the same as the hash used for the Authenticode validation, so refactor shim.c a little to separate out the hash generation.
2017-08-01Extend PCR 7Matthew Garrett
It's desirable to be able to use PCR 7 for all TPM policy on Secure Boot systems, but right now Shim doesn't record any information about its configuration or the signature used to launch the second stage loader. Add support for that.
2017-08-01fallback.c: be more correct with device path code.Peter Jones
Rob Clark noticed while, implementing a UEFI like backend on u-boot, that if a File Handle actually returns a meaningful device path from DevicePathFromHandle(), we wind up with a horribly wrong device path in the boot variable. He's right, normal UEFI doesn't return that, which means FileDevicePath() in our code currently does nothing at all. Instead of all that, pass in the device's handle, and it'll do what we're doing after the fact there. Here's the log from a current run: FS0:\> \efi\BOOT\BOOTX64.EFI System BootOrder not found. Initializing defaults. find_boot_options:778:Found directory named "fedora" try_boot_csv:532:Found file "\EFI\fedora\BOOT.CSV" try_boot_csv:544:File looks like: ?shim.efi,Fedora,,This is the boot entry for Fedora populate_stanza:495:CSV data: "shim.efi,Fedora,,This is the boot entry for Fedora" populate_stanza:501:filename: "shim.efi" populate_stanza:508:label: "Fedora" populate_stanza:514:arguments: "" add_to_boot_list:430:file DP: PciRoot(0)/Pci(0x1F,0x2)/Sata(0x0,0x0,0x0)/HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi FindSubDevicePath:78:input device path: "PciRoot(0)/Pci(0x1F,0x2)/Sata(0x0,0x0,0x0)/HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi" FindSubDevicePath:86:sub-path (4,1): "HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi" add_to_boot_list:452:04 01 2A 00 01 00 00 00 00 08 00 00 00 00 00 00 add_to_boot_list:452:00 40 06 00 00 00 00 00 2A 27 84 65 B9 D7 2A 44 add_to_boot_list:452:B8 A4 19 B5 EC 45 66 F4 02 02 04 04 2E 00 5C 00 add_to_boot_list:452:45 00 46 00 49 00 5C 00 66 00 65 00 64 00 6F 00 add_to_boot_list:452:72 00 61 00 5C 00 73 00 68 00 69 00 6D 00 2E 00 add_to_boot_list:452:65 00 66 00 69 00 00 00 7F FF 04 00 add_to_boot_list:459:device path: "HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi" Creating boot entry "Boot0000" with label "Fedora" for file "\EFI\fedora\shim.efi" AddOption - Boot0000, then CurrentCount = 0x00000008 update_boot_order:390:nbootorder: 7 BootOrder: 0000 0002 0001 0003 0005 0006 0004 Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-01Make fallback debug printing be dynamic at runtime.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-31fallback: Minor whitespace cleanupPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-24Make it possible to build in a subdirectory.Peter Jones
This lets you do: mkdir build-x64 build-ia32 cd build-x64 make TOPDIR=.. -f ../Makefile cd ../build-ia32 setarch i686 -B make ARCH=ia32 TOPDIR=.. -f ../Makefile And not worry about generated sources and headers mixing and matching. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-24README.fallback: correct the path of BOOT.CSV in layout exampleLans Zhang
BOOT.CSV should be placed in fedora directory in order to locate the base directory of files recorded in $FILENAME column. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-01 22:43:09 +0000