summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-06-29Don't print anything or delay when start_image() succeeds.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-16MokManager: Nerf SHA-1 again for actual hashes and signatures.Peter Jones
Nobody should be deploying SHA-1. No hardware deploys it, and the rate of change on https://en.wikipedia.org/wiki/SHA-1#Attacks is wildly uninspiring. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-16MokManager: Nerf SHA-1 again for actual hashes and signatures.Peter Jones
Nobody should be deploying SHA-1. No hardware deploys it, and the rate of change on https://en.wikipedia.org/wiki/SHA-1#Attacks is wildly uninspiring. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-16MokManager: fix comparison between signed and unsigned integerGary Ching-Pang Lin
Patch from Johannes Segitz <jsegitz@suse.com>
2015-06-16MokManager: fix comparison between signed and unsigned integerGary Ching-Pang Lin
Patch from Johannes Segitz <jsegitz@suse.com>
2015-06-16MokManager: Discard the list contains an invalid signatureGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Discard the list contains an invalid signatureGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Support SHA224, SHA384, and SHA512Gary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Support SHA224, SHA384, and SHA512Gary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Add more key list safe checksGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Add more key list safe checksGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: fix the return value and typeGary Ching-Pang Lin
There are some functions that the return value and the type didn't match. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: fix the return value and typeGary Ching-Pang Lin
There are some functions that the return value and the type didn't match. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Support SHA1 hash in MOKGary Ching-Pang Lin
Add SHA1 hash support and amend the code to make it easier to support other SHA digests.
2015-06-16MokManager: Support SHA1 hash in MOKGary Ching-Pang Lin
Add SHA1 hash support and amend the code to make it easier to support other SHA digests.
2015-06-16MokManager: fix the hash list counting in deleteGary Ching-Pang Lin
match_hash() requests the number of keys in a list and it was mistakenly replaced with the size of the Mok node. This would made MokManager to remove the whole Mok node instead of one hash. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: fix the hash list counting in deleteGary Ching-Pang Lin
match_hash() requests the number of keys in a list and it was mistakenly replaced with the size of the Mok node. This would made MokManager to remove the whole Mok node instead of one hash. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: calculate the variable size correctlyGary Ching-Pang Lin
MokSize of the hash signature list includes the owner GUID, so we should not add the 16bytes compensation. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: calculate the variable size correctlyGary Ching-Pang Lin
MokSize of the hash signature list includes the owner GUID, so we should not add the 16bytes compensation. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Make shim to check MokXAuth for MOKX resetGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Make shim to check MokXAuth for MOKX resetGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Verify the EFI images with MOK blacklistGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Verify the EFI images with MOK blacklistGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Copy the MOK blacklist to a RT variableGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Copy the MOK blacklist to a RT variableGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Write the hash list properlyGary Ching-Pang Lin
also return to the previous entry in the list Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Write the hash list properlyGary Ching-Pang Lin
also return to the previous entry in the list Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Match all hashes in the listGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: Match all hashes in the listGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: delete the hash properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: delete the hash properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: show the hash list properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16MokManager: show the hash list properlyGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Support MOK blacklistGary Ching-Pang Lin
The new blacklist, MokListX, stores the keys and hashes that are banned. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Support MOK blacklistGary Ching-Pang Lin
The new blacklist, MokListX, stores the keys and hashes that are banned. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16Fix console_print_box*() parameters.Peter Jones
When we made lib build with the correct CFLAGS, it inherited -Werror=sign-compare, and I fixed up some parameters on console_print_box() and console_print_box_at() to avoid sign comparison errors. The fixups were *completely wrong*, as some behavior relies on negative values. So this fixes them in a completely different way, by casting appropriately to signed types where we're doing comparisons. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-16Fix console_print_box*() parameters.Peter Jones
When we made lib build with the correct CFLAGS, it inherited -Werror=sign-compare, and I fixed up some parameters on console_print_box() and console_print_box_at() to avoid sign comparison errors. The fixups were *completely wrong*, as some behavior relies on negative values. So this fixes them in a completely different way, by casting appropriately to signed types where we're doing comparisons. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Ensure that apps launched by shim get correct BS->Exit() behaviorPeter Jones
Right now applications run by shim get our wrapper for Exit(), but it doesn't do as much cleanup as it should - shim itself also exits, but currently is not doing all the cleanup it should be doing. This changes it so all of shim's cleanup is also performed. Based on a patch and lots of review from Gary Lin. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Ensure that apps launched by shim get correct BS->Exit() behaviorPeter Jones
Right now applications run by shim get our wrapper for Exit(), but it doesn't do as much cleanup as it should - shim itself also exits, but currently is not doing all the cleanup it should be doing. This changes it so all of shim's cleanup is also performed. Based on a patch and lots of review from Gary Lin. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Don't leave in_protocol==1 when shim_verify() isn't enforcing.Peter Jones
Right now if shim_verify() sees secure_mode()==0, it exits with EFI_SUCCESS, but accidentally leaves in_protocol=1. This means any other call will have supressed error/warning messages. That's wrong, so don't do it. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Don't leave in_protocol==1 when shim_verify() isn't enforcing.Peter Jones
Right now if shim_verify() sees secure_mode()==0, it exits with EFI_SUCCESS, but accidentally leaves in_protocol=1. This means any other call will have supressed error/warning messages. That's wrong, so don't do it. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-04Only run MokManager if asked or a security violation occurs.Peter Jones
Don't run MokManager on any random error from start_image(second_stage); only try it if it /is/ the second stage, or if start_image gave us EFI_SECURITY_VIOLATION. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-04Only run MokManager if asked or a security violation occurs.Peter Jones
Don't run MokManager on any random error from start_image(second_stage); only try it if it /is/ the second stage, or if start_image gave us EFI_SECURITY_VIOLATION. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-05-12More GCC 5 fixes: stdarg.h and other include tweaks, cherry-pick fromMathieu Trudel-Lapierre
d51739a4.
2015-05-12Fix build with GCC 5, forcing -std=gnu89 to not rely on stdint.hMathieu Trudel-Lapierre
required by efibind.h, and not found with -nostdinc. (LP: #1429978)
2015-05-12Make the build failed with objcopy < 2.24Gary Ching-Pang Lin
The wildcard support was introduced in objcopy since binutils 2.24. However, objcopy < 2.24 never issues any warning message with the wildcard and a faulty binary will be generated. This commit makes the build failed as a notification for the usage of binutils < 2.24. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12Make the build failed with objcopy < 2.24Gary Ching-Pang Lin
The wildcard support was introduced in objcopy since binutils 2.24. However, objcopy < 2.24 never issues any warning message with the wildcard and a faulty binary will be generated. This commit makes the build failed as a notification for the usage of binutils < 2.24. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12Update Cryptlib and opensslGary Ching-Pang Lin
Update Cryptlib to r16559 and openssl to 0.9.8zf Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12Update Cryptlib and opensslGary Ching-Pang Lin
Update Cryptlib to r16559 and openssl to 0.9.8zf Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-05-12releasing package shim version 0.8-0ubuntu2Steve Langasek
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-07 09:25:16 +0000