summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-08-31Drain the OpenSSL error stack and report crypto verification errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Init openssl so we can use its debug facilities.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Add a mechanism to print openssl errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Fix a missing OpenSSL error message pointPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Make msleep() be a thingPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-29debian/shim.install: update paths in light of using shim's upstream install ↵Mathieu Trudel-Lapierre
target.
2017-08-29Set EFIDIR=ubuntu for dh_auto_install; that will let files be installed in ↵Mathieu Trudel-Lapierre
the "right" final directories, and makes boot.csv for us.
2017-08-29Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream options: ↵Mathieu Trudel-Lapierre
set MAKELEVEL.
2017-08-29debian/rules: clean up after *.signed files.Mathieu Trudel-Lapierre
2017-08-29debian/patches/fix_makefile_phony.patch: fix a makefile bug causing shim to ↵Mathieu Trudel-Lapierre
fail to build, because it gets confused about the .signed efi files.
2017-08-29Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback and ↵Mathieu Trudel-Lapierre
MokManager. Also drop debian/patches/sbsigntool-no-pesign: with this change from upstream it is no longer needed..
2017-08-29Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built at ↵Mathieu Trudel-Lapierre
compile-time for MokManager and fallback.
2017-08-29debian/patches/second-stage-path: dropped; the default loader path now ↵Mathieu Trudel-Lapierre
includes an arch suffix.
2017-08-29New upstream snapshot: 12+1503074702.5202f80.Mathieu Trudel-Lapierre
2017-08-29Updated version 12+1503074702.5202f80 from 'upstream/12+1503074702.5202f80'Mathieu Trudel-Lapierre
with Debian dir 08243b332bab8ddbadb7a33b4929c3a66682e2c4
2017-08-29New upstream version 12+1503074702.5202f80Mathieu Trudel-Lapierre
2017-08-18Rework looping in enter_mok_menu(), to allow multiple MOK changesMathieu Trudel-Lapierre
Rather than looping once through the possible actions (MokNew, MokDel, etc.), revise the logic so that instead of rebooting immediately we get back to the main menu setting a flag to replace "Continue booting" with a proper reboot. Getting back to the menu means we can go make other changes before rebooting. For instance, you might want to enable validation, but beforehand you also need to enroll a MOK. You can already do so from userland; except the requests were cleared as soon as one of them was processed. This involves some extra cleanup of the states to avoid running the same request more than once, removing the option from the menu once it's done, and changing prompting functions to return an EFI_STATUS so we can better track whether the process has succeeded. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-11Add ENABLE_SHIM_HASH and make install-as-data know how to install it.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Update TODO with some stuffPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make better debuginfo and install it reasonably.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Allow use of sbsign to sign things.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Add ENABLE_SHIM_CERT to make MokManager/fallback signing optional.Peter Jones
This makes shim not create its own keyring and sign MokManager and fallback by default. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make DEFAULT_LOADER have the EFI arch suffix by default.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make ARM targets use -mstrict-alignPeter Jones
Otherwise device paths are definitely all kinds of screwed up, but other stuff might be as well. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Add install targets.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Fix openssl compile flags for x86_64Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11fallback: work around the issue of boot option creation with AMI BIOSLans Zhang
AMI BIOS (e.g, Intel NUC5i3MYHE) may automatically hide and patch BootXXXX variables with ami_masked_device_path_guid. Initially, the normal boot option created by fallback looks like this: 00000000 01 00 00 00 5e 00 42 00 6f 00 6f 00 74 00 6c 00 |....^.B.o.o.t.l.| 00000010 6f 00 61 00 64 00 65 00 72 00 20 00 54 00 65 00 |o.a.d.e.r. .T.e.| 00000020 73 00 74 00 20 00 28 00 36 00 34 00 2d 00 62 00 |s.t. .(.6.4.-.b.| 00000030 69 00 74 00 29 00 00 00 04 01 2a 00 01 00 00 00 |i.t.).....*.....| 00000040 00 08 00 00 00 00 00 00 00 00 08 00 00 00 00 00 |................| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 01 01 04 04 30 00 5c 00 45 00 46 00 49 00 5c 00 |....0.\.E.F.I.\.| 00000070 42 00 4f 00 4f 00 54 00 5c 00 74 00 65 00 73 00 |B.O.O.T.\.t.e.s.| 00000080 74 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 |t.x.6.4...e.f.i.| 00000090 00 00 7f ff 04 00 |......| 00000096 after reboot, fallback has to create a new one due to the previous boot option is hidden and masked by AMI BIOS: 00000000 09 00 00 00 76 00 42 00 6f 00 6f 00 74 00 6c 00 |....v.B.o.o.t.l.| 00000010 6f 00 61 00 64 00 65 00 72 00 20 00 54 00 65 00 |o.a.d.e.r. .T.e.| 00000020 73 00 74 00 20 00 28 00 36 00 34 00 2d 00 62 00 |s.t. .(.6.4.-.b.| 00000030 69 00 74 00 29 00 00 00 01 04 14 00 e7 75 e2 99 |i.t.)........u..| 00000040 a0 75 37 4b a2 e6 c5 38 5e 6c 00 cb 7f ff 04 00 |.u7K...8^l......| 00000050 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 |..*.............| 00000060 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 00 00 00 00 01 01 04 04 30 00 5c 00 |............0.\.| 00000080 45 00 46 00 49 00 5c 00 42 00 4f 00 4f 00 54 00 |E.F.I.\.B.O.O.T.| 00000090 5c 00 74 00 65 00 73 00 74 00 78 00 36 00 34 00 |\.t.e.s.t.x.6.4.| 000000a0 2e 00 65 00 66 00 69 00 00 00 7f ff 04 00 |..e.f.i.......| 000000ae And after several reboot, fallback will have to create more boot options because AMI BIOS corrupts the previous ones. We can get the valid device path if just skipping the masked device path and its next end path. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-08-11fallback: fix double free of dpLans Zhang
If the boot option recorded in csv is not in a media device path, the corresponding full device path will be referred for creating the boot variable. However, the current code logic always frees the full device path (full_device_path) and the media device path (dp) separately. In order to resolve this issue, always check whether dp equals to full_device_path before freeing dp. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-08-09New upstream snapshot: 12+1502324945.478f9bb.Mathieu Trudel-Lapierre
2017-08-09Updated version 12+1502324945.478f9bb from 'upstream/12+1502324945.478f9bb'Mathieu Trudel-Lapierre
with Debian dir a5373f8bb41a0f7c4d5d293c57dd3374e72d3064
2017-08-09New upstream version 12+1502324945.478f9bbupstream/12+1502324945.478f9bbMathieu Trudel-Lapierre
2017-08-07Fix typo for DEFAULT_LOADER: missing a backslash, also needs quoting.Mathieu Trudel-Lapierre
2017-08-07debian/patches/0001-shim-fix-the-mirroring-MokSBState-fail.patch: dropped, ↵Mathieu Trudel-Lapierre
included upstream.
2017-08-07Define an EFI_ARCH variable, and use that for paths to shim. This makes it ↵Mathieu Trudel-Lapierre
possible to build a shim for other architectures than amd64.
2017-08-07debian/patches/sbsigntool-no-pesign: refreshed.Mathieu Trudel-Lapierre
2017-08-07Set DEFAULT_LOADER; this makes second-stage-path unnecessary.Mathieu Trudel-Lapierre
2017-08-07* debian/rules:Mathieu Trudel-Lapierre
- Update dh_auto_build/dh_auto_clean for new upstream options: set MAKELEVEL.
2017-08-07debian/control: add a Build-Depends on libnss3-tools for pk12-util.Mathieu Trudel-Lapierre
2017-08-07New upstream snapshot: 12+1501864225.b586175.Mathieu Trudel-Lapierre
2017-08-07New upstream version 12+1501864225.b586175upstream/12+1501864225.b586175Mathieu Trudel-Lapierre
2017-08-07Merge tag 'upstream/12+1501864225.b586175' into cyphermox/mokmanagerMathieu Trudel-Lapierre
Upstream version 12+1501864225.b586175
2017-08-07New upstream version 12+1501864225.b586175Mathieu Trudel-Lapierre
2017-08-07Merge branch 'master' into cyphermox/mokmanagerMathieu Trudel-Lapierre
Update changelog entries/changes from Debian for 0.9+1474479173.6c180c6-1.
2017-08-07Update changelog/changes for released 0.9+1474479173.6c180c6-1ubuntu10.9+1474479173.6c180c6-1ubuntu1Mathieu Trudel-Lapierre
2017-08-07Update changelog for released 0.9+1474479173.6c180c6-0ubuntu1Mathieu Trudel-Lapierre
2017-08-04Import Debian changes 0.9+1474479173.6c180c6-1debian/0.9+1474479173.6c180c6-1Julien Cristau
shim (0.9+1474479173.6c180c6-1) unstable; urgency=medium [ Steve Langasek ] * Initial Debian upload. Closes: #820052. * Update Standards-Version. * Embed the newly-minted Debian CA certificate. * Vendorize debian/rules so that the same package can be used in both Debian and Ubuntu without modification. * Fix debian/copyright to match the spec (last match wins, not first) * Fix shim.efi to not be executable. * Add watchfile. * Support parallel builds, because eh why not * Update Vcs-Bzr. * Resync with Ubuntu, including patch to fix debian/copyright. [ Julien Cristau ] * Add some missing copyright holders in d/copyright, update Upstream-Contact. Thanks to Helen Koike for the help. shim (0.9+1474479173.6c180c6-0ubuntu1) UNRELEASED; urgency=medium [ Helen Koike ] * debian/copyright: add OpenSSL license [ Mathieu Trudel-Lapierre ] * New upstream release. * debian/copyright: patches should be BSD, like the rest of the upstream code. * debian/patches/unused-variable: dropped; applied upstream. * debian/patches/binutils-version-matching: dropped, fixed upstream. * debian/shim.install: built EFI binaries were renamed; update our install file to properly pick up shim (shim$arch), MokManager (mm$arch), and fallback (fb$arch). shim (0.9+1465500757.14a5905-0ubuntu1) yakkety; urgency=medium * New upstream release. - Better handle LoadOptions. (LP: #1581299) - Measure state and second stage in TPM. - Mirror MokSBState in runtime as MokSBStateRT. - Fix failure to build with GCC 5. (LP: #1429978) - Various bug fixes and other improvements. * Refreshed patches. - Remaining patches: + second-stage-path + sbsigntool-not-pesign * debian/patches/unused-variable: remove unused variable size. * debian/patches/binutils-version-matching: revert d9a4c912 to correctly match objcopy's version on Ubuntu. * debian/copyright: update copyright for patches. shim (0.8-0ubuntu2) wily; urgency=medium * No-change rebuild against gnu-efi 3.0v-5ubuntu1. shim (0.8-0ubuntu1) wily; urgency=medium * New upstream release. - Clarify meaning of insecure_mode. (LP: #1384973) * debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch, debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included in the upstream release. * debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path: refreshed. shim (0.7-0ubuntu4) utopic; urgency=medium * SECURITY UPDATE: heap overflow and out-of-bounds read access when parsing DHCPv6 information - debian/patches/CVE-2014-3675.patch: apply proper bounds checking when parsing data provided in DHCPv6 packets. - CVE-2014-3675 - CVE-2014-3676 * SECURITY UPDATE: memory corruption when processing user-provided key lists - debian/patches/CVE-2014-3677.patch: detect malformed machine owner key (MOK) lists and ignore them, avoiding possible memory corruption. - CVE-2014-3677 shim (0.7-0ubuntu2) utopic; urgency=medium * Restore debian/patches/prototypes, which still is needed on shim 0.7 but only detected on the buildds. * Update debian/patches/prototypes with some new declarations needed for openssl 0.9.8za update. shim (0.7-0ubuntu1) utopic; urgency=medium * New upstream release. - fix spurious error message when fallback.efi is not present, as will always be the case for removable media. LP: #1297069. - drop most patches, included upstream. * debian/patches/0001-Update-openssl-to-0.9.8za.patch: cherry-pick openssl 0.9.8za in via upstream. shim (0.4-0ubuntu5) utopic; urgency=low * Install fallback.efi.signed as well, to lay the groundwork for fallback handling (wanted when we have to move a drive between machines, or when the firmware loses its marbles^W nvram). shim (0.4-0ubuntu4) saucy; urgency=low * debian/patches/fix-tftp-prototype: pass the right arguments to EFI_PXE_BASE_CODE_TFTP_READ_FILE. * debian/patches/build-with-Werror: Build with -Werror to catch future prototype mismatches. * debian/patches/fix-compiler-warnings: Fix remaining compiler warnings in netboot.c. * debian/patches/tftp-proper-nul-termination: fix nul termination errors in filenames passed to tftp. * debian/patches/netboot-cleanup: roll-up of miscellaneous fixes to the netboot code. shim (0.4-0ubuntu3) saucy; urgency=low [ Steve Langasek ] * Install MokManager.efi.signed in the package. * debian/patches/no-output-by-default.patch: Don't print any informational messages. Closes LP: #1074302. [ Stéphane Graber ] * debian/patches/no-print-on-unsigned: Don't print an error message when validating an unsigned binary as that tends to hang Lenovo machines. (LP: #1087501) shim (0.4-0ubuntu2) saucy; urgency=low * Add missing build-dependency on openssl. shim (0.4-0ubuntu1) saucy; urgency=low * New upstream release. * Drop debian/patches/shim-before-loadimage; upstream has changed this to not call loadimage at all. * debian/patches/sbsigntool-not-pesign: Sign MokManager with sbsigntool instead of pesign. * Add a versioned build-dependency on gnu-efi. shim (0~20120906.bcd0a4e8-0ubuntu4) quantal-proposed; urgency=low * debian/patches/shim-before-loadimage: Use direct verification first before LoadImage. Addresses an issue where Lenovo's SecureBoot implementation pops an error message on any verification failure - avoid calling LoadImage at all unless we have to. shim (0~20120906.bcd0a4e8-0ubuntu3) quantal; urgency=low * debian/patches/second-stage-path: Chainload grubx64.efi, not grub.efi. shim (0~20120906.bcd0a4e8-0ubuntu2) quantal; urgency=low * debian/patches/prototypes: Include missing prototypes, and disable use of BIO_new_file. * Only build the package for amd64; we're not signing an i386 shim at this stage so there's no point in building it. shim (0~20120906.bcd0a4e8-0ubuntu1) quantal; urgency=low * Initial release. * Include the Canonical Secure Boot master CA.
2017-08-04Import Upstream version 0.9+1474479173.6c180c6upstream/0.9+1474479173.6c180c6Mathieu Trudel-Lapierre
2017-08-03Add README.tpm to explain which PCRs we extend things to.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Add MokListX to MokVars.txtPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Make fallback aware of tpm measurements, and reboot if tpm is used.Peter Jones
Since booting the entry with fallback in the stack of things that got measured will result in all the wrong PCR values, in the cases where TPM is present and enabled, use ->Reset() instead of loading the Boot#### variable and executing its target. Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-22 22:14:28 +0000