summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-10-04Bump version to 0.5Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Bump version to 0.50.5Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Unhook system services as we exit.Peter Jones
If we never find a valid thing to boot, we need to undo the weird things we've done. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Unhook system services as we exit.Peter Jones
If we never find a valid thing to boot, we need to undo the weird things we've done. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Put SHIM_VERBOSE under shim's guid, not global.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Put SHIM_VERBOSE under shim's guid, not global.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Try to actually make debug printing look reasonable.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Try to actually make debug printing look reasonable.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Do more strict checking on PE Headers.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Do more strict checking on PE Headers.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Reapply patches lost in the updateMatthew Garrett
2013-10-04Reapply patches lost in the updateMatthew Garrett
2013-10-04Update to current Tiano CryptlibMatthew Garrett
2013-10-04Update to current Tiano CryptlibMatthew Garrett
2013-10-04Add Tiano patch e98e59c237e17f064a4ecffb39d45499f89720a1Matthew Garrett
This is: Fix a bug in OpensslLib that PKCS7_verify will use over 8k stack space. Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Dong Guo <guo.dong@intel.com> from upstream.
2013-10-04Add Tiano patch e98e59c237e17f064a4ecffb39d45499f89720a1Matthew Garrett
This is: Fix a bug in OpensslLib that PKCS7_verify will use over 8k stack space. Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Dong Guo <guo.dong@intel.com> from upstream.
2013-10-03Improve PE image bounds checking.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Improve PE image bounds checking.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Add ident-like blobs to shim.efi for version checking.Peter Jones
I feel dirty.
2013-10-03Add ident-like blobs to shim.efi for version checking.Peter Jones
I feel dirty.
2013-10-02Update for Josh's changes.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Update for Josh's changes.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Add support for disabling db for verificationJosh Boyer
Provide a mechanism for a physically present end user to disable the use of db when doing signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable the use of db for verification purposes (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will cause shim to not use db for verification purposes. If db is to be ignored, shim will export a runtime variable called 'MokIgnoreDB' for the OS to query at runtime. Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
2013-10-02Add support for disabling db for verificationJosh Boyer
Provide a mechanism for a physically present end user to disable the use of db when doing signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable the use of db for verification purposes (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will cause shim to not use db for verification purposes. If db is to be ignored, shim will export a runtime variable called 'MokIgnoreDB' for the OS to query at runtime. Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
2013-10-02Remove "shim.cer" on "make clean".Peter Jones
If we don't do this, an old key winds up being reused and MokManager.efi.signed is signed with a different key than shim_cert reflects. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Remove "shim.cer" on "make clean".Peter Jones
If we don't do this, an old key winds up being reused and MokManager.efi.signed is signed with a different key than shim_cert reflects. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Use CHAR8 not UINT8 for character work.Peter Jones
This gets rid of a lot of type casting that we don't need, and helps reduce warnings when I switch a bunch of gnu-efi stuff to taking const arguments. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Use CHAR8 not UINT8 for character work.Peter Jones
This gets rid of a lot of type casting that we don't need, and helps reduce warnings when I switch a bunch of gnu-efi stuff to taking const arguments. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02CompareMem expects void * and gcc complains.Peter Jones
Sorry about that. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02CompareMem expects void * and gcc complains.Peter Jones
Sorry about that. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Fix wrong type on console_error() call.Peter Jones
Stupid L"". Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Fix wrong type on console_error() call.Peter Jones
Stupid L"". Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01If we fail to install our protocol, don't continue.Peter Jones
This shouldn't be exploitable unless you've got a way to make InstallProtocol fail and still, for example, have memory free to actually load and run something. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01If we fail to install our protocol, don't continue.Peter Jones
This shouldn't be exploitable unless you've got a way to make InstallProtocol fail and still, for example, have memory free to actually load and run something. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Clean up warnings.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Clean up warnings.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Conditionalize overriding the security policy.Peter Jones
Make OVERRIDE_SECURITY_POLICY a build option. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Conditionalize overriding the security policy.Peter Jones
Make OVERRIDE_SECURITY_POLICY a build option. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Merge console_control.h and console.hPeter Jones
Since these are topically the same thing, they can live together. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Merge console_control.h and console.hPeter Jones
Since these are topically the same thing, they can live together. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Make verbose stuff use console_notifyPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Make verbose stuff use console_notifyPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01MokManager needs to disable the graphics console.Peter Jones
Without this patch, on some machines we never see MokManager's UI. This protocol has never (I think?) been officially published, and yet I still have new hardware that needs it. If you're looking for a reference, look at: EdkCompatibilityPkg/Foundation/Protocol/ConsoleControl/ConsoleControl.c in the edk2 tree from Tiano. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01MokManager needs to disable the graphics console.Peter Jones
Without this patch, on some machines we never see MokManager's UI. This protocol has never (I think?) been officially published, and yet I still have new hardware that needs it. If you're looking for a reference, look at: EdkCompatibilityPkg/Foundation/Protocol/ConsoleControl/ConsoleControl.c in the edk2 tree from Tiano. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Include shim's vendor_cert in MokListRTPeter Jones
There needs to be some way to communicate to the kernel that it's a trusted key, and since this mechanism already exists, it's by far the easiest.
2013-10-01Include shim's vendor_cert in MokListRTPeter Jones
There needs to be some way to communicate to the kernel that it's a trusted key, and since this mechanism already exists, it's by far the easiest.
2013-10-01Harden shim against non-participating bootloaders.Peter Jones
It works like this: during startup of shim, we hook into the system's ExitBootServices() and StartImage(). If the system's StartImage() is called, we automatically unhook, because we're chainloading to something the system can verify. When shim's verify is called, we record what kind of certificate the image was verified against. If the call /succeeds/, we remove our hooks. If ExitBootServices() is called, we check how the bootloader verified whatever it is loading. If it was verified by its hash, we unhook everything and call the system's EBS(). If it was verified by certificate, we check if it has called shim_verify(). If it has, we unhook everything and call the system's EBS() If the bootloader has not verified anything, and is itself verified by a certificate, we display a security violation warning and halt the machine.
2013-10-01Harden shim against non-participating bootloaders.Peter Jones
It works like this: during startup of shim, we hook into the system's ExitBootServices() and StartImage(). If the system's StartImage() is called, we automatically unhook, because we're chainloading to something the system can verify. When shim's verify is called, we record what kind of certificate the image was verified against. If the call /succeeds/, we remove our hooks. If ExitBootServices() is called, we check how the bootloader verified whatever it is loading. If it was verified by its hash, we unhook everything and call the system's EBS(). If it was verified by certificate, we check if it has called shim_verify(). If it has, we unhook everything and call the system's EBS() If the bootloader has not verified anything, and is itself verified by a certificate, we display a security violation warning and halt the machine.
2013-10-01Make vendor_cert/vendor_dbx actually replaceable by an external tool.Peter Jones
This moves them both to be computed at runtime from a pointer+offset rather than just a pointer, so that their real address can be entirely derived from the section they're in. This means you can replace the whole .vendor_cert section with a new one with certs that don't have the same size.
2013-10-01Make vendor_cert/vendor_dbx actually replaceable by an external tool.Peter Jones
This moves them both to be computed at runtime from a pointer+offset rather than just a pointer, so that their real address can be entirely derived from the section they're in. This means you can replace the whole .vendor_cert section with a new one with certs that don't have the same size.
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-07 12:30:00 +0000