summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-07-18Make ARCH overridablePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-17httpboot: fix OVMF crashLans Zhang
This is a typical typo. The free operation should be done if uri was allocated. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-20tpm2_present(): remove unused tpm2 protocol argument.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-06-15shim/tpm: Avoid passing an usupported event log format to GetEventLogs()Javier Martinez Canillas
The TCG EFI Protocol Specification for family "2.0" mentions that not all TPM2 chips may support the EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 (crypto agile) log format. So instead of always use this log format, the GetCapability() function should be used to determine which format is supported by the TPM. For example, the Intel PTT firmware based TPM found in Lenovo Thinkapd X1 Carbon (4th gen), only supports SHA-1 (EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2) log format. So a call to GetEventLog() using the crypto agile format was returning EFI_INVALID_PARAMETER, making tpm_log_event() function to fail. This was preventing shim to correctly measure the second stage bootloader: $ tpm2_listpcrs -L 0x04:9 Bank/Algorithm: TPM_ALG_SHA1(0x0004) PCR_09: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 After passing a supported log format to GetEventLog(), it succeeds and so shim is able to call the HashLogExtendEvent() EFI function correctly: $ tpm2_listpcrs -L 0x04:9 Bank/Algorithm: TPM_ALG_SHA1(0x0004) PCR_09: 07 5a 7e d3 75 64 ad 91 1a 34 17 17 c2 34 10 2b 58 5b de b7 Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15shim/tpm: Take out GetCapability() call from tpm2_present() logicJavier Martinez Canillas
The EFI_TCG2_PROTOCOL.GetCapability() function is used to learn if a TPM2 chip is present. But the protocol capability information is also needed for other reasons, for example to determine what event log formats are supported by the firmware. Take out the GetCapability() call from the tpm2_present() logic and reduce that function to just checking if a TPM2 chip is available or not, so the capabilities can later be used to determine the supported TPM log formats. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15shim/tpm: Remove magic numbersJavier Martinez Canillas
When measuring data into the TPM and generating events logs, the event type is set to EV_IPL (0xd), and for TPM1.2 the algorithm will always be set to SHA-1 (0x4). So, add some macro-defined constants for these instead of having them as magic numbers to make the code more readable. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15update verification_method if the loaded image is signed by shim/vendor certLans Zhang
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-15become more friendly for the cross compilationLans Zhang
Allow to overwrite certain settings from the external. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-15skip the error message when creating MokListRT if vendor cert is emptyLans Zhang
EFI_NOT_FOUND will be returned when creating MokListRT if vendor cert is empty. This is harmless, meaningless and skippable. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-15fix compilerer errors in security policyMax Resch
When compiling with -Werror security policy can't be compiled because of type errors. This commit fixes this problem.
2017-04-27Bump version number to 12.latest-release12Peter Jones
Since 87060b2fc effectively means signing with signtool.exe simply does not work correctly, and that's sort of the biggest goal for shim, make this version 12. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-04-27Fix buffer overrun / damaged options passed to second_stage.John S. Gruber
start is a UCS-2 character pointer and loader_len is a number of bytes. Adjust loader_len to count characters before adding to the start pointer.
2017-04-26Don't allow anything with a small alignment in our PE files.Peter Jones
When I added 4990d3f I inadvertantly made .data.ident and .rela.got sections appear in the top-level section headers at file offsets not aligned with PE->OptionalHeader.FileAlignment. This results in a section table that looks like: Sections: Idx Name Size VMA LMA File off Algn 0 .eh_frame 00018648 0000000000005000 0000000000005000 00000400 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA 1 .text 00093f45 000000000001e000 000000000001e000 00018c00 2**4 CONTENTS, ALLOC, LOAD, READONLY, CODE 2 .reloc 0000000a 00000000000b2000 00000000000b2000 000acc00 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 3 .data.ident 000000e4 00000000000b3040 00000000000b3040 000ace40 2**5 CONTENTS, ALLOC, LOAD, DATA 4 .data 000291e8 00000000000b4000 00000000000b4000 000ad200 2**5 CONTENTS, ALLOC, LOAD, DATA 5 .vendor_cert 000003e2 00000000000de000 00000000000de000 000d6400 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 6 .dynamic 000000f0 00000000000df000 00000000000df000 000d6800 2**3 CONTENTS, ALLOC, LOAD, DATA 7 .rela 0001aef8 00000000000e0000 00000000000e0000 000d6a00 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA 8 .rela.got 00000060 00000000000faef8 00000000000faef8 000f1af8 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA 9 .dynsym 0000ecd0 00000000000fb000 00000000000fb000 000f1e00 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA rather than: Sections: Idx Name Size VMA LMA File off Algn 0 .eh_frame 00018118 0000000000005000 0000000000005000 00000400 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA 1 .text 00091898 000000000001e000 000000000001e000 00018600 2**4 CONTENTS, ALLOC, LOAD, READONLY, CODE 2 .reloc 0000000a 00000000000b0000 00000000000b0000 000aa000 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 3 .data 00028848 00000000000b1000 00000000000b1000 000aa200 2**5 CONTENTS, ALLOC, LOAD, DATA 4 .vendor_cert 00000449 00000000000da000 00000000000da000 000d2c00 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 5 .dynamic 00000100 00000000000db000 00000000000db000 000d3200 2**3 CONTENTS, ALLOC, LOAD, DATA 6 .rela 0001ae50 00000000000dc000 00000000000dc000 000d3400 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA 7 .dynsym 0000ea78 00000000000f7000 00000000000f7000 000ee400 2**3 CONTENTS, ALLOC, LOAD, READONLY, DATA (Note "File off" on sections #3 and #8 on the top one.) This seems to work fine with edk2's loader and shim's loader, as well as their Authenticode implementation, and pesign's as well. While PE loaders seem to be fine with sections with alignments smaller than PE->OptionalHeader.FileAlignment, MS's signtool.exe does ... something else with them. I'm not sure what. What it definitely does *not* do is extend the digest based on their file offset and size. So just don't allow anything that small, and don't allow anything smaller than SectionAlignment either, just to be on the safe side. Since most of our stuff gets stripped into the debuginfo anyway, and shim has relatively few sections, this should not be a very large burden. So just to be clear: If you have a binary with a section that's not aligned on PE->OptionalHeader.FileAlignment: - pesign hashes it to A - tiano hashes it to A - shim hashes it to A - signtool.exe hashes it to B Because that makes sense. This patch works around the bug in signtool.exe . Signed-off-by: Peter Jones <pjones@redhat.com>
2017-04-11Cryptlib: replace CryptPem with the Null versionGary Lin
CryptPem only provides one function: RsaGetPrivateKeyFromPem(). Since we don't need to retrieve any private key, it's safe to disable the function. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: remove DESGary Lin
Disable DES completely since it's already old and insecure. This makes MokManager not support the DES based password hash but probably no one is using it. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Remove MD4Gary Lin
MD4 is known to be insecure and shim never uses it. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: implement strcmp() and strcasecmp()Gary Lin
strcmp() and strcasecmp() are widely used in openssl. Implement those two functions to eliminate the gcc warnings and the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11MokManager: Update to new openssl APIGary Lin
X509_get_notBefore -> X509_getm_notBefore X509_get_notAfter -> X509_getm_notAfter Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: amend the headers and fix signnessGary Lin
- Declare some functions in the proper headers + We missed them for a long time... - Cast offsetof to UINTN + The original casting triggers the gcc warning since int can not present the offset for the 64bit machines. - Cast the "char" array to "CHAR8 *" to avoid the gcc warnings - Implement atoi correctly Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Include stddef.h in CrtLibSupport.hGary Lin
The changes in the openssl headers cause the inclusion of CrtLibSupport.h eariler than the inclusion of stddef.h, so "offsetof" was defined twice and this caused the followling build error: In file included from Cryptlib/Include/openssl/buffer.h:23:0, from Cryptlib/Include/openssl/x509.h:22, from shim.c:56: /usr/lib64/gcc/x86_64-suse-linux/6/include/stddef.h:417:0: error: "offsetof" redefined [-Werror] #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) In file included from Cryptlib/Include/limits.h:15:0, from Cryptlib/Include/openssl/ossl_typ.h:13, from Cryptlib/Include/openssl/x509.h:20, from shim.c:56: Cryptlib/Include/CrtLibSupport.h:192:0: note: this is the location of the previous definition #define offsetof(type, member) ( (int) & ((type*)0) -> member ) We can lower the priority of the gcc include path or just remove the path, but this might cause problem since the path was introduced on purpose(*). Instead, including stddef.h first is more feasible. (*) https://github.com/rhinstaller/shim/commit/d51739a416400ad348d8a1c7e3886abce11fff1b Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11shim: Remove the obsolete OBJ_cleanupGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib/OpenSSL: update to openssl 1.1.0eGary Lin
- Delete the old openssl files and use the script to copy the new files - Add "-DNO_SYSLOG" to CFLAGS and add crypto/include to the include path Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib/OpenSSL: Update the script to copy the new openssl filesGary Lin
- Update update.sh to copy the openssl 1.1.0 source files - Refresh the supplemental patch to reflect the change Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Update to the latest edk2 commitGary Lin
- Update to edk2 commit 7c410b3d4180087020c7734bf67cdc4ad9fdb136 CryptoPkg/BaseCryptLib: Adding NULL checking in time() wrapper. - Update headers in Cryptlib/Include/openssl/ to 1.1.0e + Also copy the openssl internal headers Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Amend update.sh and refresh Cryptlib.diffGary Lin
- Remove the openssl version from update.sh since edk2 doesn't use the version number in the directory name anymore. - Refresh Cryptlib.diff to reflect the change Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Rename OpenSslSupport.h as CrtLibSupport.hGary Lin
Edk2 renamed OpenSslSupport.h, so we have to follow the change. Also merge some changes from edk2 CrtLibSupport.h Signed-off-by: Gary Lin <glin@suse.com>
2017-04-10make tag: always tag latest-release as wellPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-04-03Update version to 1111Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-04-03generate_hash(): fix the regressionLans Zhang
The commit 03b9f800 introduces an issue in case the gap between SumOfBytesHashed and context->SecDir->VirtualAddress exists. This would be a typo because a formal PE image always meet SumOfBytesHashed + hashsize == context->SecDir->VirtualAddress either the gap exists or not. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-04-03Ignore BDS when it tells us we got our own path on the command line.Peter Jones
Sometimes we get our own path in LoadOptions for no clear reason. Don't execute it, just ignore it. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-03-27Update version to 10Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-03-27Fix some i386 type casting errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-03-27shim: disambiguate our global image handle.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-03-24Update to openssl 1.0.2kGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2017-03-24Update CryptlibGary Lin
Update to edk2 commit 6e4489d8129d233ef0fe85eeb6eebfecafe9ea6e (CryptoPkg: Refine type cast for pointer subtraction) Also replaced CryptAes.c, CryptArc4.c, CryptTdes.c, CryptMd4.c, CryptHmacMd5.c, and CryptHmacSha1.c with the Null version since we don't really need those functions. Signed-off-by: Gary Lin <glin@suse.com>
2017-03-24httpboot: parse https prefix in the uriGary Lin
This commit adds the check for "https://" in the uri to support HTTPs Boot. Signed-off-by: Gary Lin <glin@suse.com>
2017-02-28Use EfiLoaderCode memory for loading PE/COFF executablesArd Biesheuvel
Under a strict memory protection policy, UEFI may give out EfiLoaderData memory with the XN attribute set. So use EfiLoaderCode explicitly. At the same time, use a page based allocation rather than a pool allocation, which is more appropriate when loading PE/COFF images. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2017-02-27Fix some type errors gcc7 finds in http boot code.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-02-23Make shim_version live in a special aligned section.Peter Jones
This makes it so two builds of the same .deb on different hosts won't have wildly different file offsets. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-02-06Also just check for access denied anyway.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-02-06Ensure all of the SB verification returns the same error code.Peter Jones
Previously we were returning EFI_ACCESS_DENIED at some places and EFI_SECURITY_VIOLATION at others. When we're checking whether to run MokManager, we're checking EFI_SECURITY_VIOLATION, which is more or less analogous with what the spec says StartImage() returns. So we should always have that as the return code. I believe this will fix github issue #44. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-02-06shim/tpm: the EFI_TCG2_BOOT_SERVICE_CAPABILITY structure shouldn't be packedLans Zhang
According to TCG EFI Protocol Specification, this structure is not packed. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-02-06shim/tpm: correct the definition of the capability structure version 1.0Lans Zhang
EFI TrEE Protocol uses the same protocol GUID as EFI TCG2 protocol, and defines the capability structure version 1.0. Hence, the structure and name are all align the EFI TrEE Protocol. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-02-06shim: fix the mirroring MokSBState failIvan Hu
Some machines have already embedded MokSBStateRT varaible with EFI_VARIABLE_NON_VOLATILE attribute, and some users might disable shim vailidation manually by creating MokSBStateRT. It causes mirroring MokSBState fail because the variable cannot be set with different attribute again, and gets error massage every time when booting. Fix it with checking the MokSBStateRT existence and deleting it before mirroring it. Signed-off-by: Ivan Hu <ivan.hu@canonical.com>
2017-02-06generate_hash(): make check_size() set an error, and verify SecDir size.Peter Jones
Currently generate_hash() attempts to include any trailing data at the end of the binary in the resulting digest, but it won't include such data if the size computed is wrong because context->SecDir->Size is invalid. In this case the return code is EFI_SUCCESS, and the hash will match any a binary as if the Attribute Certificate Table and anything after it are missing. This is wrong. Signed-off-by: Peter Jones <pjones@redhat.com>
2016-11-30Update the CryptLibGary Lin
Update to the edk2 commit dab62c5ec8a88def3ee99c04d644720cb201de08 Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30Update to openssl 1.0.2jGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30Update the openssl update script to 1.0.2jGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30Cryptlib: Implement memset() to avoid the potential crashGary Lin
Although the prototype of memset() is already defined in OpenSslSupport.h, the function was never implemented. It was fine since a macro was designed to replace all memset() with SetMem() after including OpenSslSupport.h. However, since openssl 1.0.2j, a new function pointer in crypto/mem_clr.c requires the "real" memset() or the program would crash due to the NULL function pointer access. This commit implements memset() (just a wrapper of SetMem()) to avoid the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30shim/tpm: fix trigger failure caused by NULL argumentsLans Zhang
Certain AMI BIOS (Intel NUC5i3MYBE BIOS version 0037) may make the strict check on the last 3 arguments passed to get_event_log() and don't expect NULL pointers are passed. In order to work around this failure (EFI_INVALID_PARAMETER), pass them even though we really don't use it. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-27 08:47:09 +0000