summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-06-16MokManager: Support SHA224, SHA384, and SHA512Gary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Add more key list safe checksGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Add more key list safe checksGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: fix the return value and typeGary Ching-Pang Lin
There are some functions that the return value and the type didn't match. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: fix the return value and typeGary Ching-Pang Lin
There are some functions that the return value and the type didn't match. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Support SHA1 hash in MOKGary Ching-Pang Lin
Add SHA1 hash support and amend the code to make it easier to support other SHA digests.
2015-06-16MokManager: Support SHA1 hash in MOKGary Ching-Pang Lin
Add SHA1 hash support and amend the code to make it easier to support other SHA digests.
2015-06-16MokManager: fix the hash list counting in deleteGary Ching-Pang Lin
match_hash() requests the number of keys in a list and it was mistakenly replaced with the size of the Mok node. This would made MokManager to remove the whole Mok node instead of one hash. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: fix the hash list counting in deleteGary Ching-Pang Lin
match_hash() requests the number of keys in a list and it was mistakenly replaced with the size of the Mok node. This would made MokManager to remove the whole Mok node instead of one hash. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: calculate the variable size correctlyGary Ching-Pang Lin
MokSize of the hash signature list includes the owner GUID, so we should not add the 16bytes compensation. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: calculate the variable size correctlyGary Ching-Pang Lin
MokSize of the hash signature list includes the owner GUID, so we should not add the 16bytes compensation. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Make shim to check MokXAuth for MOKX resetGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Make shim to check MokXAuth for MOKX resetGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Verify the EFI images with MOK blacklistGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Verify the EFI images with MOK blacklistGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Copy the MOK blacklist to a RT variableGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Copy the MOK blacklist to a RT variableGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Write the hash list properlyGary Ching-Pang Lin
also return to the previous entry in the list Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Write the hash list properlyGary Ching-Pang Lin
also return to the previous entry in the list Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Match all hashes in the listGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Match all hashes in the listGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: delete the hash properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: delete the hash properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: show the hash list properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: show the hash list properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Support MOK blacklistGary Ching-Pang Lin
The new blacklist, MokListX, stores the keys and hashes that are banned. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Support MOK blacklistGary Ching-Pang Lin
The new blacklist, MokListX, stores the keys and hashes that are banned. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Fix console_print_box*() parameters.Peter Jones
When we made lib build with the correct CFLAGS, it inherited -Werror=sign-compare, and I fixed up some parameters on console_print_box() and console_print_box_at() to avoid sign comparison errors. The fixups were *completely wrong*, as some behavior relies on negative values. So this fixes them in a completely different way, by casting appropriately to signed types where we're doing comparisons. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-16Fix console_print_box*() parameters.Peter Jones
When we made lib build with the correct CFLAGS, it inherited -Werror=sign-compare, and I fixed up some parameters on console_print_box() and console_print_box_at() to avoid sign comparison errors. The fixups were *completely wrong*, as some behavior relies on negative values. So this fixes them in a completely different way, by casting appropriately to signed types where we're doing comparisons. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Ensure that apps launched by shim get correct BS->Exit() behaviorPeter Jones
Right now applications run by shim get our wrapper for Exit(), but it doesn't do as much cleanup as it should - shim itself also exits, but currently is not doing all the cleanup it should be doing. This changes it so all of shim's cleanup is also performed. Based on a patch and lots of review from Gary Lin. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Ensure that apps launched by shim get correct BS->Exit() behaviorPeter Jones
Right now applications run by shim get our wrapper for Exit(), but it doesn't do as much cleanup as it should - shim itself also exits, but currently is not doing all the cleanup it should be doing. This changes it so all of shim's cleanup is also performed. Based on a patch and lots of review from Gary Lin. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Don't leave in_protocol==1 when shim_verify() isn't enforcing.Peter Jones
Right now if shim_verify() sees secure_mode()==0, it exits with EFI_SUCCESS, but accidentally leaves in_protocol=1. This means any other call will have supressed error/warning messages. That's wrong, so don't do it. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Don't leave in_protocol==1 when shim_verify() isn't enforcing.Peter Jones
Right now if shim_verify() sees secure_mode()==0, it exits with EFI_SUCCESS, but accidentally leaves in_protocol=1. This means any other call will have supressed error/warning messages. That's wrong, so don't do it. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-04Only run MokManager if asked or a security violation occurs.Peter Jones
Don't run MokManager on any random error from start_image(second_stage); only try it if it /is/ the second stage, or if start_image gave us EFI_SECURITY_VIOLATION. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-04Only run MokManager if asked or a security violation occurs.Peter Jones
Don't run MokManager on any random error from start_image(second_stage); only try it if it /is/ the second stage, or if start_image gave us EFI_SECURITY_VIOLATION. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-05-12More GCC 5 fixes: stdarg.h and other include tweaks, cherry-pick fromMathieu Trudel-Lapierre
d51739a4.
2015-05-12Fix build with GCC 5, forcing -std=gnu89 to not rely on stdint.hMathieu Trudel-Lapierre
required by efibind.h, and not found with -nostdinc. (LP: #1429978)
2015-05-12Make the build failed with objcopy < 2.24Gary Ching-Pang Lin
The wildcard support was introduced in objcopy since binutils 2.24. However, objcopy < 2.24 never issues any warning message with the wildcard and a faulty binary will be generated. This commit makes the build failed as a notification for the usage of binutils < 2.24. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12Make the build failed with objcopy < 2.24Gary Ching-Pang Lin
The wildcard support was introduced in objcopy since binutils 2.24. However, objcopy < 2.24 never issues any warning message with the wildcard and a faulty binary will be generated. This commit makes the build failed as a notification for the usage of binutils < 2.24. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12Update Cryptlib and opensslGary Ching-Pang Lin
Update Cryptlib to r16559 and openssl to 0.9.8zf Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12Update Cryptlib and opensslGary Ching-Pang Lin
Update Cryptlib to r16559 and openssl to 0.9.8zf Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12releasing package shim version 0.8-0ubuntu2Steve Langasek
2015-05-11* New upstream release.Mathieu Trudel-Lapierre
- Clarify meaning of insecure_mode. (LP: #1384973) * debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch, debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included in the upstream release. * debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path: refreshed.
2015-05-10Reapplying all patchesMathieu Trudel-Lapierre
2015-05-07Add bug tag for insecure_mode semantics changes in 0.8.Mathieu Trudel-Lapierre
2015-05-06debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path:Mathieu Trudel-Lapierre
refreshed.
2015-05-06debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch,Mathieu Trudel-Lapierre
debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included in the upstream release.
2015-05-06New upstream release.Mathieu Trudel-Lapierre
2015-05-06Import upstream version 0.8Mathieu Trudel-Lapierre
2015-05-06Unapplying patches to prevent spurious conflicts.Mathieu Trudel-Lapierre
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-05 21:03:26 +0000