| Age | Commit message (Collapse) | Author |
|---|
|
shim needs to verify that MokManager hasn't been modified, but we want to
be able to support configurations where shim is shipped without a vendor
certificate. This patch adds support for generating a certificate at build
time, incorporating the public half into shim and signing MokManager with
the private half. It uses pesign and nss, but still requires openssl for
key generation. Anyone using sbsign will need to figure this out for
themselves.
|
|
findNetboot() would continue blindly even if no PXE-capable devices were
found. Fix that.
|
|
findNetboot() would continue blindly even if no PXE-capable devices were
found. Fix that.
|
|
This seems pretty much functionally complete, so let's call it 0.2.
|
|
This seems pretty much functionally complete, so let's call it 0.2.
|
|
Conflicts:
shim.c
|
|
Conflicts:
shim.c
|
|
|
|
|
|
Conflicts:
Makefile
shim.c
|
|
Conflicts:
Makefile
shim.c
|
|
Cert needs to be modified inside the Index loop, not outside it. This is unlikely to
ever trigger since there will typically only be one X509 certificate per
EFI_SIGNATURE_LIST, but fix it anyway.
|
|
Cert needs to be modified inside the Index loop, not outside it. This is unlikely to
ever trigger since there will typically only be one X509 certificate per
EFI_SIGNATURE_LIST, but fix it anyway.
|
|
We could potentially find a valid signature and then fail to validate it
due to not breaking out of the outer while loop.
|
|
We could potentially find a valid signature and then fail to validate it
due to not breaking out of the outer while loop.
|
|
load_image() didn't allocate PathName, don't have it free it.
|
|
load_image() didn't allocate PathName, don't have it free it.
|
|
Type-checking the UEFI calls picked up a couple of problems. Fix them up.
|
|
Type-checking the UEFI calls picked up a couple of problems. Fix them up.
|
|
Brief overview of the function and format of the various variables used
by Shim and MokManager.
|
|
Brief overview of the function and format of the various variables used
by Shim and MokManager.
|
|
|
|
|
|
|
|
|
|
The size of vendor dbx must be 0 if there is no vendor dbx provided
or the functions of db check will crash.
|
|
The size of vendor dbx must be 0 if there is no vendor dbx provided
or the functions of db check will crash.
|
|
Permit clearing of the password, and avoid a case where choosing not to set
a password would result in an error message on exit. Fix the same problem
with MokSB.
|
|
Permit clearing of the password, and avoid a case where choosing not to set
a password would result in an error message on exit. Fix the same problem
with MokSB.
|
|
The logic used in checking the signature validation password was a bit
ugly. Improve that so it behaves rather more as expected.
|
|
The logic used in checking the signature validation password was a bit
ugly. Improve that so it behaves rather more as expected.
|
|
read_header would fail if the binary was unsigned, even if we weren't then
going to verify the signature. Move that check to the verify function
instead.
|
|
read_header would fail if the binary was unsigned, even if we weren't then
going to verify the signature. Move that check to the verify function
instead.
|
|
Fixes for some small bugs noticed during review
|
|
Fixes for some small bugs noticed during review
|
|
Another case where we were drawing text over existing text.
|
|
Another case where we were drawing text over existing text.
|
|
|
|
|
|
This was hardcoded, rather than being based on the actual password length,
resulting in incorrect hashes being generated.
|
|
This was hardcoded, rather than being based on the actual password length,
resulting in incorrect hashes being generated.
|
|
Update this to match the new mokutil behaviour
|
|
Update this to match the new mokutil behaviour
|
|
A cut and paste error meant that attempts to delete MokList were instead
appending a zero-length addition.
|
|
A cut and paste error meant that attempts to delete MokList were instead
appending a zero-length addition.
|
|
Add a helper function and tidy up the calls for getting into MokManager
|
|
Add a helper function and tidy up the calls for getting into MokManager
|
|
The pointer to the certificate needs to be incremented by the size of the
entire certificate, not just the certificate data.
|
|
The pointer to the certificate needs to be incremented by the size of the
entire certificate, not just the certificate data.
|
|
In some rare corner cases, it's useful to add a blacklist of things that
were allowed by a copy of shim that was never signed by the UEFI signing
service. In these cases it's okay for them to go into a local dbx,
rather than taking up precious flash.
Signed-off-by: Peter Jones <pjones@redhat.com>
|
