summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-10-18Pause on callback failuresMatthew Garrett
If a callback returns any kind of failure, wait for a keypress in order to give the user an opportunity to read any failure messages.
2012-10-18Skip signature checking if insecureMatthew Garrett
If we're configured to run untrusted code, print a message and skip the validation checks.
2012-10-18Skip signature checking if insecureMatthew Garrett
If we're configured to run untrusted code, print a message and skip the validation checks.
2012-10-18Add support for disabling signature verificationMatthew Garrett
Provide a mechanism for a physically present end user to disable signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable signature validation (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will skip verification of signatures.
2012-10-18Add support for disabling signature verificationMatthew Garrett
Provide a mechanism for a physically present end user to disable signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable signature validation (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will skip verification of signatures.
2012-10-13Add section headersMatthew Garrett
Provide a little more contextual information when people are in shim menus.
2012-10-13Add section headersMatthew Garrett
Provide a little more contextual information when people are in shim menus.
2012-10-12Add draft version of Neil's netboot codeMatthew Garrett
2012-10-12Add draft version of Neil's netboot codeMatthew Garrett
2012-10-12Reallocate the DevPath space for the volume labelGary Ching-Pang Lin
The size of the DevPath string array was not sufficient to append the volume label. This patch extends the size for the label and re-enables the menu freeing.
2012-10-12Reallocate the DevPath space for the volume labelGary Ching-Pang Lin
The size of the DevPath string array was not sufficient to append the volume label. This patch extends the size for the label and re-enables the menu freeing.
2012-10-12Remove LoadImage/StartImage supportMatthew Garrett
Some systems will show an error dialog if LoadImage() returned EFI_ACCESS_DENIED, which then requires physical user interaction to skip. Let's just remove the LoadImage/StartImage code, since the built-in code is theoretically equivalent.
2012-10-12Remove LoadImage/StartImage supportMatthew Garrett
Some systems will show an error dialog if LoadImage() returned EFI_ACCESS_DENIED, which then requires physical user interaction to skip. Let's just remove the LoadImage/StartImage code, since the built-in code is theoretically equivalent.
2012-10-12Switch to using db format for MokList and MokNewMatthew Garrett
Using the same format as the UEFI key databases makes it easier for the kernel to parse and extract keys from MOK, and also permits MOK to contain multiple key or hash types. Additionally, add support for enrolling hashes.
2012-10-12Switch to using db format for MokList and MokNewMatthew Garrett
Using the same format as the UEFI key databases makes it easier for the kernel to parse and extract keys from MOK, and also permits MOK to contain multiple key or hash types. Additionally, add support for enrolling hashes.
2012-10-11Split out hashingMatthew Garrett
We want to be able to generate hashes, so split out the hash generation function from the verification function
2012-10-11Split out hashingMatthew Garrett
We want to be able to generate hashes, so split out the hash generation function from the verification function
2012-10-11Add missing header defineMatthew Garrett
2012-10-11Add missing header defineMatthew Garrett
2012-10-11Add SHA1 supportMatthew Garrett
In theory vendors could blacklist binaries with SHA1, so make sure we calculate and check that hash as well.
2012-10-11Add SHA1 supportMatthew Garrett
In theory vendors could blacklist binaries with SHA1, so make sure we calculate and check that hash as well.
2012-10-11Add menu headerMatthew Garrett
Add a basic header to the menu to make it clearer what's going on. Define SHIM_VENDOR in order to override the default.
2012-10-11Add menu headerMatthew Garrett
Add a basic header to the menu to make it clearer what's going on. Define SHIM_VENDOR in order to override the default.
2012-10-11Clear screen on exitMatthew Garrett
2012-10-11Clear screen on exitMatthew Garrett
2012-10-11Add timeout supportMatthew Garrett
We should time out if there aren't any keypresses at the top level menu within a reasonable timeframe.
2012-10-11Add timeout supportMatthew Garrett
We should time out if there aren't any keypresses at the top level menu within a reasonable timeframe.
2012-10-11Fix whitespaceMatthew Garrett
2012-10-11Fix whitespaceMatthew Garrett
2012-10-11Remove unnecessary newlineGary Ching-Pang Lin
The newline character shouldn't be present in the menu item string
2012-10-11Remove unnecessary newlineGary Ching-Pang Lin
The newline character shouldn't be present in the menu item string
2012-10-11Pass the size of MokNew to the key enrollment functionGary Ching-Pang Lin
The size of MokNew was missing and it caused crash when enrolling new MOKs with mokutil
2012-10-11Pass the size of MokNew to the key enrollment functionGary Ching-Pang Lin
The size of MokNew was missing and it caused crash when enrolling new MOKs with mokutil
2012-10-10releasing version 0~20120906.bcd0a4e8-0ubuntu4Steve Langasek
2012-10-10debian/patches/shim-before-loadimage: Use direct verification firstSteve Langasek
before LoadImage. Addresses an issue where Lenovo's SecureBoot implementation pops an error message on any verification failure - avoid calling LoadImage at all unless we have to.
2012-10-09Callbacks should return INTN, not UINTNMatthew Garrett
2012-10-09Callbacks should return INTN, not UINTNMatthew Garrett
2012-10-09Remove unused variableMatthew Garrett
2012-10-09Remove unused variableMatthew Garrett
2012-10-09Don't lose the last file in top-level directoriesMatthew Garrett
The filesystem callback was failing to account for the additional menu item to return to the filesystem list, and so the last file entry in the root directory would be missing from the list.
2012-10-09Don't lose the last file in top-level directoriesMatthew Garrett
The filesystem callback was failing to account for the additional menu item to return to the filesystem list, and so the last file entry in the root directory would be missing from the list.
2012-10-08Fix filesystem enrollmentMatthew Garrett
We would always enrol a single key, deleting any existing keys in the database. Fix that up.
2012-10-08Fix filesystem enrollmentMatthew Garrett
We would always enrol a single key, deleting any existing keys in the database. Fix that up.
2012-10-08Add an auth argument to store_keys()Matthew Garrett
If the user is manually installing keys from a filesystem then we don't need to ask for the key password.
2012-10-08Add an auth argument to store_keys()Matthew Garrett
If the user is manually installing keys from a filesystem then we don't need to ask for the key password.
2012-10-08Add __attribute__ ((packed)) to MokListNode definitionMatthew Garrett
Packing this lets us use MokListNode with the binary MokList representation.
2012-10-08Add __attribute__ ((packed)) to MokListNode definitionMatthew Garrett
Packing this lets us use MokListNode with the binary MokList representation.
2012-10-06Disable menu freeingMatthew Garrett
This looks like it ought to work, but is currently failing. Leaking here isn't a big deal, so just disable it until I figure out what's wrong.
2012-10-06Disable menu freeingMatthew Garrett
This looks like it ought to work, but is currently failing. Leaking here isn't a big deal, so just disable it until I figure out what's wrong.
2012-10-06Fix menucountMatthew Garrett
Menucount wasn't being incremented for the final top level menu, so the file explorer menu item wasn't appearing.
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-26 18:34:47 +0000