summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-06-25Make sure we default to assuming we're locked down.Peter Jones
If "SecureBoot" exists but "SetupMode" does not, assume "SetupMode" says we're not in Setup Mode. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-06-25Make sure we default to assuming we're locked down.Peter Jones
If "SecureBoot" exists but "SetupMode" does not, assume "SetupMode" says we're not in Setup Mode. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-06-25Check the secure variables with the lib functionsGary Ching-Pang Lin
There are functions defined in lib to check the secure variables. Use the functions to shun the duplicate code. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c
2014-06-25Check the secure variables with the lib functionsGary Ching-Pang Lin
There are functions defined in lib to check the secure variables. Use the functions to shun the duplicate code. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c
2014-06-25Explain the logic in secure_mode() better.Peter Jones
I was getting confused reading it, and I wrote it, so clearly it needs more commentry. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-06-25Explain the logic in secure_mode() better.Peter Jones
I was getting confused reading it, and I wrote it, so clearly it needs more commentry. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-06-25Free the string from DevicePathToStrGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c
2014-06-25Free the string from DevicePathToStrGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c
2014-06-25Silence the functions of shim protocolGary Ching-Pang Lin
When grub2 invokes the functions of shim protocol in gfx mode, OutputString in shim could distort the screen. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c (modified by pjones to include some newer Prints that weren't there when Gary did the initial work here.)
2014-06-25Silence the functions of shim protocolGary Ching-Pang Lin
When grub2 invokes the functions of shim protocol in gfx mode, OutputString in shim could distort the screen. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c (modified by pjones to include some newer Prints that weren't there when Gary did the initial work here.)
2014-06-25Remove the duplicate calls in lib/console.cGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Remove the duplicate calls in lib/console.cGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25No newline for console_notifyGary Ching-Pang Lin
The newlines are for Print(), not console_notify(). Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c
2014-06-25No newline for console_notifyGary Ching-Pang Lin
The newlines are for Print(), not console_notify(). Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: shim.c
2014-06-25Exclude ca.crt while signing EFI imagesGary Ching-Pang Lin
If ca.crt was added into the certificate database, ca.crt would be the first certificate in the signature. Because shim couldn't verify ca.crt with the embedded shim.cer, it failed to load MokManager.efi.signed and fallback.efi.signed. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Exclude ca.crt while signing EFI imagesGary Ching-Pang Lin
If ca.crt was added into the certificate database, ca.crt would be the first certificate in the signature. Because shim couldn't verify ca.crt with the embedded shim.cer, it failed to load MokManager.efi.signed and fallback.efi.signed. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25MokManager: handle the error status from ReadKeyStrokeGary Ching-Pang Lin
On some machines, even though the key event was signaled, ReadKeyStroke still got EFI_NOT_READY. This commit handles the error status to avoid console_get_keystroke from returning unexpected keys. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: MokManager.c
2014-06-25MokManager: handle the error status from ReadKeyStrokeGary Ching-Pang Lin
On some machines, even though the key event was signaled, ReadKeyStroke still got EFI_NOT_READY. This commit handles the error status to avoid console_get_keystroke from returning unexpected keys. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com> Conflicts: MokManager.c
2014-06-25MokManager: delete the BS+NV variables the right wayGary Ching-Pang Lin
LibDeleteVariable assumes that the variable is RT+NV and it won't work on a BS+NV variable. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25MokManager: delete the BS+NV variables the right wayGary Ching-Pang Lin
LibDeleteVariable assumes that the variable is RT+NV and it won't work on a BS+NV variable. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Remove grubpath in generate_path()Gary Ching-Pang Lin
The variable is not used anymore. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Remove grubpath in generate_path()Gary Ching-Pang Lin
The variable is not used anymore. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Check the first 4 bytes of the certificateGary Ching-Pang Lin
A non-DER encoding x509 certificate may be mistakenly enrolled into db or MokList. This commit checks the first 4 bytes of the certificate to ensure that it's DER encoding. This commit also removes the iteration of the x509 signature list. Per UEFI SPEC, each x509 signature list contains only one x509 certificate. Besides, the size of certificate is incorrect. The size of the header must be substracted from the signature size. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Check the first 4 bytes of the certificateGary Ching-Pang Lin
A non-DER encoding x509 certificate may be mistakenly enrolled into db or MokList. This commit checks the first 4 bytes of the certificate to ensure that it's DER encoding. This commit also removes the iteration of the x509 signature list. Per UEFI SPEC, each x509 signature list contains only one x509 certificate. Besides, the size of certificate is incorrect. The size of the header must be substracted from the signature size. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Fetch the netboot image from the same deviceGary Ching-Pang Lin
The previous strategy is to locate the first available PXE_BASE_CODE protocol and to fetch the second stage image from it, and this may cause shim to fetch the wrong second stage image, i.e. grub.efi. Consider the machine with the following boot order: 1. PXE Boot 2. Hard Drive Assume that the EFI image, e.g. bootx64.efi, in the PXE server is broken, then "PXE Boot" will fail and fallback to "Hard Drive". While shim.efi in "Hard Drive" is loaded, it will find the PXE protocol is available and fetch grub.efi from the PXE server, not grub.efi in the disk. This commit checks the DeviceHandle from Loaded Image. If the device supports PXE, then shim fetches grub.efi with the PXE protocol. Otherwise, shim loads grub.efi from the disk. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-06-25Fetch the netboot image from the same deviceGary Ching-Pang Lin
The previous strategy is to locate the first available PXE_BASE_CODE protocol and to fetch the second stage image from it, and this may cause shim to fetch the wrong second stage image, i.e. grub.efi. Consider the machine with the following boot order: 1. PXE Boot 2. Hard Drive Assume that the EFI image, e.g. bootx64.efi, in the PXE server is broken, then "PXE Boot" will fail and fallback to "Hard Drive". While shim.efi in "Hard Drive" is loaded, it will find the PXE protocol is available and fetch grub.efi from the PXE server, not grub.efi in the disk. This commit checks the DeviceHandle from Loaded Image. If the device supports PXE, then shim fetches grub.efi with the PXE protocol. Otherwise, shim loads grub.efi from the disk. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Try to boot the first boot option anywayGary Ching-Pang Lin
Some UEFI implementations never care the boot options, so the restored boot options could be just ignored and this results in endless reboot. To avoid this situation, this commit makes fallback.efi to load the first matched boot option even if there is no boot option to be restored. It may not be perfect, but at least the bootloader is loaded... Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Try to boot the first boot option anywayGary Ching-Pang Lin
Some UEFI implementations never care the boot options, so the restored boot options could be just ignored and this results in endless reboot. To avoid this situation, this commit makes fallback.efi to load the first matched boot option even if there is no boot option to be restored. It may not be perfect, but at least the bootloader is loaded... Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Fix the data size for boot option comparisonGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Fix the data size for boot option comparisonGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Avoid duplicate old BootOrderGary Ching-Pang Lin
set_boot_order() already copies the old BootOrder to the variable, bootorder. Besides, we can adjust BootOrder when adding the newly generated boot option. So, we don't have to copy the old one again in update_boot_order(). This avoid the duplicate entries in BootOrder. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Avoid duplicate old BootOrderGary Ching-Pang Lin
set_boot_order() already copies the old BootOrder to the variable, bootorder. Besides, we can adjust BootOrder when adding the newly generated boot option. So, we don't have to copy the old one again in update_boot_order(). This avoid the duplicate entries in BootOrder. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-04-11Get rid of SectionCache in generate_hash(), it is unused.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2014-04-11Get rid of SectionCache in generate_hash(), it is unused.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2014-04-11Kees' patch missed the offset adjustment to PEHdr.Peter Jones
In read_header, we adjust context->PEHdr's address by doshdr->e_lfanew. If we're going to recompute that address, we have to adjust it here too. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-04-11Kees' patch missed the offset adjustment to PEHdr.Peter Jones
In read_header, we adjust context->PEHdr's address by doshdr->e_lfanew. If we're going to recompute that address, we have to adjust it here too. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-04-11additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2014-04-11additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2014-02-14Allow fallback to use the system's LoadImage/StartImage .Peter Jones
Track use of the system's LoadImage(), and when the next StartImage() call is for an image the system verified, allow that to count as participating, since it has been verified by the system's db. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-02-14Allow fallback to use the system's LoadImage/StartImage .Peter Jones
Track use of the system's LoadImage(), and when the next StartImage() call is for an image the system verified, allow that to count as participating, since it has been verified by the system's db. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-02-14Add a failure case to the test plan and fix an ordering error.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2014-02-14Add a failure case to the test plan and fix an ordering error.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2014-02-14Add a preliminary test plan.Peter Jones
Because you know you wanted a test plan. You feel it deeply inside. Note that none of the /negative/ cases are tested yet. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-02-14Add a preliminary test plan.Peter Jones
Because you know you wanted a test plan. You feel it deeply inside. Note that none of the /negative/ cases are tested yet. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-01-31[fallback] Attempt to re-use existing entries when possible.Peter Jones
Some firmwares seem to ignore our boot entries and put their fallback entries back on top. Right now that results in a lot of boot entries for our stuff, a la https://bugzilla.redhat.com/show_bug.cgi?id=995834 . Instead of that happening, if we simply find existing entries that match the entry we would create and move them to the top of the boot order, the machine will continue to operate in failure mode (which we can't avoid), but at least we won't create thousands of extra entries. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-01-31[fallback] Attempt to re-use existing entries when possible.Peter Jones
Some firmwares seem to ignore our boot entries and put their fallback entries back on top. Right now that results in a lot of boot entries for our stuff, a la https://bugzilla.redhat.com/show_bug.cgi?id=995834 . Instead of that happening, if we simply find existing entries that match the entry we would create and move them to the top of the boot order, the machine will continue to operate in failure mode (which we can't avoid), but at least we won't create thousands of extra entries. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-01-31[fallback] For HD() device paths, use just the media node and later.Peter Jones
UEFI 2.x section 3.1.2 provides for "short-form device path", where the first element specified is a "hard drive media device path", so that you can move a disk around on different buses without invalidating your device path. Fallback has not been using this option, though in most cases efibootmgr has. Note that we still keep the full device path, because LoadImage() isn't necessarily the layer where HD() works - one some systems BDS is responsible for resolving the full path and passes that to LoadImage() instead. So we have to do LoadImage() with the full path.
2014-01-31[fallback] For HD() device paths, use just the media node and later.Peter Jones
UEFI 2.x section 3.1.2 provides for "short-form device path", where the first element specified is a "hard drive media device path", so that you can move a disk around on different buses without invalidating your device path. Fallback has not been using this option, though in most cases efibootmgr has. Note that we still keep the full device path, because LoadImage() isn't necessarily the layer where HD() works - one some systems BDS is responsible for resolving the full path and passes that to LoadImage() instead. So we have to do LoadImage() with the full path.
2013-11-21Error check the right thing in get_variable_attr() when allocating.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-21Error check the right thing in get_variable_attr() when allocating.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-06 13:49:16 +0000