summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-05-03Add maintainer scripts to the template packagesdebian/15.4-3Steve McIntyre
Manage installing and removing fbXXX.efi and mmXXX.efi when we install/remove the shim-helpers-$arch-signed packages. Closes: #966845
2021-04-21Add changelog for 15.4-2 with new patchesdebian/15.4-2Steve McIntyre
2021-04-21Don't call QueryVariableInfo() on EFI 1.10 machinesSteve McIntyre
New patch from upstream, don't break old Macs
2021-04-21Fix handling of ignore_db and user_insecure_modeSteve McIntyre
Extra patch from upstream
2021-04-17Stop hardcoding the release version in the rules filedebian/15.4-1Steve McIntyre
We can grab it from the changelog already
2021-04-17Clean more thingsSteve McIntyre
2021-04-17Prep for releasing based on 15.4Steve McIntyre
2021-04-14allocate MOK config table as BootServicesDataSteve McIntyre
Another patch from upstream, needed with newer kernels on x86
2021-03-31Add one more patch from upstream to fix i386 binary relocationsSteve McIntyre
2021-03-31Move the sha256sum call to the end of the install phaseSteve McIntyre
Make the output easier to find
2021-03-31Override dh_auto_build setting INSTALL, cut down on build noiseSteve McIntyre
2021-03-31Update to the 15.4 releaseSteve McIntyre
2021-03-31Update upstream source from tag 'upstream/15.4'Steve McIntyre
Update to upstream version '15.4' with Debian dir 93160080661283eee071d2c92a27ce9b39acb998
2021-03-31New upstream version 15.4upstream/15.4Steve McIntyre
2021-03-24Print sha256 checksums of the EFI binaries when the build is doneSteve McIntyre
2021-03-24Tweak the SBAT data to keep reproducibilitydebian/15.3-3Steve McIntyre
Only include the upstream version in the Debian SBAT metadata, so we don't break reproducibility on every minor packaging change.
2021-03-24Add missing build-dep on xxd for build-time unit testsdebian/15.3-2Steve McIntyre
2021-03-23New upstream version 15.3upstream/15.3Steve McIntyre
2021-03-23Update upstream source from tag 'upstream/15.3'debian/15.3-1Steve McIntyre
Update to upstream version '15.3' with Debian dir 1b484f1c1ac270604a5a1451b34de4b0865c6211
2021-03-23Switch to using the 15.3 release from upstreamSteve McIntyre
2021-03-23Remove all out outstanding patchesSteve McIntyre
* cast-CHAR8-string-handling.patch no longer needed * fix-Make.coverity-bashisms.patch went upstream
2021-03-23Update copyright fileSteve McIntyre
Update a couple of top-level changes, copy in gnu-efi information from the gnu-efi package
2021-03-23Fix up some of the options we're using at build timeSteve McIntyre
Definitely don't want to be setting EFI_PATH, as that over-rides the vendored gnu-efi. Argh
2021-03-23Improve how the dbx hashes are handledSteve McIntyre
Only include the hashes for the architecture we're building for - no point in adding bloat and delay here. Add a script "block_signed_deb" to scan a set of .deb files, extract the hashes for .efi binaries and list them in the format wanted for the dbx hashes file. Split out the code to use that file from the rules file into a separate helper.
2021-03-23Tweak the gnu-efi tarball codeSteve McIntyre
2021-03-23Add an extra rule to generate the extra gnu-efi tarballSteve McIntyre
Thanks to Dmitri John Ledkov for help
2021-03-23Add Debian SBAT data to the shim buildSteve McIntyre
Add a Debian SBAT template, and rules to use it Adds a build-dep on dos2unix
2021-03-23Add dbx entries for all our existing grub binariesSteve McIntyre
They're insecure, let's break the chainloading hole
2021-02-21Change changelog to shut lintian upSteve McIntyre
2021-02-21Remove artifacts that upstream installs that we don't useSteve McIntyre
... to keep debhelper from complaining
2021-02-21Add new patch cast-CHAR8-string-handling.patchSteve McIntyre
Cast CHAR8 strings to use (const char *) when using string functions Looks like gnu-efi definitions of CHAR8 are problematic
2021-02-21Trivial change to remove bashisms in Make.coveritySteve McIntyre
2021-02-21Remove all our old patches, no longer needed:Steve McIntyre
- avoid_null_vsprint.patch - check_null_sn_ln.patch - fixup_git.patch - uname.patch - use_compare_mem_gcc9.patch
2021-02-21Switch to using gcc-10 rather than gcc-9. Closes: #978521Steve McIntyre
2021-02-21Switch to newer upstream "release" 15+1613861442.888f5b5Steve McIntyre
Many many updates, but caring mainly about SBAT support
2021-02-21Update upstream source from tag 'upstream/15+1613861442.888f5b5'Steve McIntyre
Update to upstream version '15+1613861442.888f5b5' with Debian dir 15b0853a73144b1f8571ce2bebc2eea68af4a8e3
2021-02-20Add --set-section-alignment '.sbat=512' to objcopy command lineupstream/15+1613861442.888f5b5Jan Setje-Eilers
2021-02-20Include missing .text sections in PE/COFF binaryChris Coulson
At the default -Os optimization level, gcc emits ".text.startup" and ".text.unlikely" sections for static initializers and noreturn functions which end up in the intermediate ELF binary: $ objdump -h build-x64/shimx64.efi.so build-x64/shimx64.efi.so: file format elf64-x86-64 Sections: Idx Name Size VMA LMA File off Algn 0 .text 00046e7b 0000000000001000 0000000000001000 00001000 2**10 CONTENTS, ALLOC, LOAD, READONLY, CODE 1 .text.startup 00000118 0000000000047e7b 0000000000047e7b 00047e7b 2**0 CONTENTS, ALLOC, LOAD, READONLY, CODE 2 .text.unlikely 00000046 0000000000047f93 0000000000047f93 00047f93 2**0 CONTENTS, ALLOC, LOAD, READONLY, CODE 3 .data 000315e8 0000000000048000 0000000000048000 00048000 2**9 These additional .text.* sections are omitted from the final PE/COFF binary, resulting in a crash when processing the ctors. Taking a look at _init_array in gdb: (gdb) p/x &_init_array $1 = 0x78510 (gdb) p/x &_init_array_end $2 = 0x7851c (gdb) x/x (void*)&_init_array 0x78510 <_init_array>: 0x00047e7b (gdb) x/x (void*)(&_init_array)+8 0x78518 <_init_array+8>: 0x00000000 See that 0x00047e7b falls inside the padding between the .text and .data sections: $ objdump -h build-x64/shimx64.efi build-x64/shimx64.efi: file format pei-x86-64 Sections: Idx Name Size VMA LMA File off Algn 0 .text 00046e7b 0000000000001000 0000000000001000 00000400 2**10 CONTENTS, ALLOC, LOAD, READONLY, CODE 1 .data 000315e8 0000000000048000 0000000000048000 00047400 2**9 Adjust the linker script to merge the .text.startup and .text.unlikely sections in to the .text section. [edited by pjones to use .text.* instead of naming the sections individually, and to sync up with what other arches have in .text]
2021-02-19build: Pass the correct paths to sbsignChris Coulson
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
2021-02-19sbat: Fix two NULL derefs found with "gcc -fanalyzer"Peter Jones
"gcc -fanalyzer" found two NULL pointer checks we're missing in sbat.c: include/str.h: In function ‘get_sbat_field.part.0’: sbat.c:20:14: error: dereference of NULL ‘offset’ [CWE-476] [-Werror=analyzer-null-dereference] 20 | if (!*offset) and include/str.h: In function ‘parse_sbat’: sbat.c:140:27: error: dereference of NULL ‘current’ [CWE-476] [-Werror=analyzer-null-dereference] 140 | } while (entry && *current != '\0'); Both are simple, and this patch fixes them. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: make shim to parse it's own .sbat section on initJavier Martinez Canillas
This is needed for shim to verify itself when booting, to make sure that shim binaries can't be executed anymore after been revoked by SBAT. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-19shim: initialize OpenSSL after parsing SBAT dataJavier Martinez Canillas
A following patch will make shim to verify its .sbat section and it should be done before doing the OpenSSL initialization. But having the debugger attached may be useful at this point. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-19sbat: include NULL terminator when calculating buffer end in parse_sbat()Javier Martinez Canillas
The parse_sbat() function is currently removing the last character of the passed buffer, which will usually be a null-terminated string to parse. There's no reason to do this and just take the whole size as specified by the caller. Reported-by: Chris Coulson <chris.coulson@canonical.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-19pe.c: move sbat verification to its own function.Peter Jones
handle_image() is quite huge and complex. This patch moves the SBAT validation code from handle_image() to a new function, handle_sbat(). Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19Don't re-parse the SBAT EFI variable for each binary we load.Javier Martinez Canillas
On a typical boot we validate at least two binaries; parsing the SBAT EFI variable each time, when it should not be changing, is not worth the effort. This patch moves the parsing out to some setup code, instead of doing it during the verification stage. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19parse_sbat: handle the realloc failure leak and batch allocations.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19pe.c: parse SBAT variable and perform basic verificationAlex Burmashev
Per Peter Jones suggestion, we will be flexible in what data we expect while parsing the variable. Three fields are mandatory: component_generation, component_name_size, component_name However we also support adding comments and additional information to be added after component name, with ',' as a separator. Those information will be ignored and not used for verification purposes. So: grub,1 and grub,1,wow,this,is,my,comment will provide exactly same set of data for verification. [0]: https://github.com/rhboot/shim/blob/main/SBAT.md Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com> Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: drop the struct sbat and just use two variables insteadPeter Jones
The struct sbat isn't doing anything and only has two fields so let's pass pass those two to the functions directly instead of storing it in a struct. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19shim: use an enum for efi_main's error messages.Peter Jones
Numbering the error messages in efi_main directly was a mistake, and the following patches just make it more apparent. This makes it an enum so we don't have to re-number at more than one place when we add or remove them. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19Fix EV_EFI_VARIABLE_AUTHORITY event in eventlogHai Huang
Currently, for an EV_EFI_VARIABLE_AUTHORITY event, the shim puts only EFI_SIGNATURE_DATA.SignatureData in the VariableData field, but omits EFI_SIGNATURE_DATA.SignatureOwner. According to reference implementation in EDK2, the entire EFI_SIGNATURE_DATA is put into the VariableData field, shown here: https://github.com/tianocore/edk2/blob/master/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c#L1032
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-28 08:53:38 +0000