summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-11-12fix fallback.so build dependencyAndrew Boie
Exposed during parallel builds Change-Id: I9867858166dcafd69438f37ee5da14a267ace8f4 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fallback.c: fix 32-bit compilationAndrew Boie
fh->Read expects pointer to 32-bit int, use UINTN Change-Id: If1a728efd51a9a24dfcd8123e84bf4c0713491fe Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fallback.c: fix 32-bit compilationAndrew Boie
fh->Read expects pointer to 32-bit int, use UINTN Change-Id: If1a728efd51a9a24dfcd8123e84bf4c0713491fe Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12properly compile OpenSSL in 32-bit modeAndrey Petrov
Change-Id: Iff3ee5ae0f0b95b282b99a23e465723b4e9f6104 Signed-off-by: Andrey Petrov <andrey.petrov@intel.com> Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12properly compile OpenSSL in 32-bit modeAndrey Petrov
Change-Id: Iff3ee5ae0f0b95b282b99a23e465723b4e9f6104 Signed-off-by: Andrey Petrov <andrey.petrov@intel.com> Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12netboot.h: fix build error on 32-bit systemsAndrew Boie
Function prototype/implementation mismatch. Change-Id: I89aaae1b49d0372d3aed76fc21c194e0ae55f72e Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12netboot.h: fix build error on 32-bit systemsAndrew Boie
Function prototype/implementation mismatch. Change-Id: I89aaae1b49d0372d3aed76fc21c194e0ae55f72e Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12shim.c: Add support for hashing/relocation of 32-bit binariesMohanraj S
Change-Id: Ib93305f7f1691d1b142567507df1058de62dde06 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12shim.c: Add support for hashing/relocation of 32-bit binariesMohanraj S
Change-Id: Ib93305f7f1691d1b142567507df1058de62dde06 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fix verify_mok()Andrew Boie
() Fix the return value semantics. If the MokList doesn't exist, we are OK. If the MokList was compromised but we were able to erase it, that is OK too. Only if the list can't be nuked do we return an error. () Fix use of potentially uninitialized attribute variable () Actually use the return value when called from verify_buffer. Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fix verify_mok()Andrew Boie
() Fix the return value semantics. If the MokList doesn't exist, we are OK. If the MokList was compromised but we were able to erase it, that is OK too. Only if the list can't be nuked do we return an error. () Fix use of potentially uninitialized attribute variable () Actually use the return value when called from verify_buffer. Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-06Bump version to 0.7.Peter Jones
Do not use 0.6; on some machines it misunderstands the SetupMode variable. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-06Bump version to 0.7.0.7Peter Jones
Do not use 0.6; on some machines it misunderstands the SetupMode variable. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-06Fix check logic for SetupMode variable.Peter Jones
After going back and inspecting this further, the logic for "SetupMode" being present at all was incorrect. Also initialize our state earlier so it's sure to always be set. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-06Fix check logic for SetupMode variable.Peter Jones
After going back and inspecting this further, the logic for "SetupMode" being present at all was incorrect. Also initialize our state earlier so it's sure to always be set. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Make tag its own make target, and make it sign tags.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Make tag its own make target, and make it sign tags.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Bump version to 0.6Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Bump version to 0.6Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-30Don't free GetVariable() return data without checking the status code.Peter Jones
This breaks every machine from before Secure Boot was a thing. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-30Don't free GetVariable() return data without checking the status code.Peter Jones
This breaks every machine from before Secure Boot was a thing. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-28We should be checking both mok and the system's SB settingsPeter Jones
When we call hook_system_services(), we're currently only checking mok's setting. We should use secure_mode() instead so it'll check both. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-28We should be checking both mok and the system's SB settingsPeter Jones
When we call hook_system_services(), we're currently only checking mok's setting. We should use secure_mode() instead so it'll check both. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-23Revert "additional bounds-checking on section sizes"Peter Jones
This reverts commit 21e40f0174814b3d91836e38c7cf95c8f2f1f3a4. In principle I like the idea of what's going on here, but generate_hash() really does need to have the expected result.
2013-10-23Revert "additional bounds-checking on section sizes"Peter Jones
This reverts commit 21e40f0174814b3d91836e38c7cf95c8f2f1f3a4. In principle I like the idea of what's going on here, but generate_hash() really does need to have the expected result.
2013-10-22Don't reject all binaries without a certificate database.Peter Jones
If a binary isn't signed, but its hash is enrolled in db, it won't have a certificate database. So in those cases, don't check it against certificate databases in db/dbx/etc, but we don't need to reject it outright. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-22Don't reject all binaries without a certificate database.Peter Jones
If a binary isn't signed, but its hash is enrolled in db, it won't have a certificate database. So in those cases, don't check it against certificate databases in db/dbx/etc, but we don't need to reject it outright. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-22additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2013-10-22additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2013-10-04Bump version to 0.5Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Bump version to 0.50.5Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Unhook system services as we exit.Peter Jones
If we never find a valid thing to boot, we need to undo the weird things we've done. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Unhook system services as we exit.Peter Jones
If we never find a valid thing to boot, we need to undo the weird things we've done. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Put SHIM_VERBOSE under shim's guid, not global.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Put SHIM_VERBOSE under shim's guid, not global.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Try to actually make debug printing look reasonable.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Try to actually make debug printing look reasonable.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Do more strict checking on PE Headers.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Do more strict checking on PE Headers.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Reapply patches lost in the updateMatthew Garrett
2013-10-04Reapply patches lost in the updateMatthew Garrett
2013-10-04Update to current Tiano CryptlibMatthew Garrett
2013-10-04Update to current Tiano CryptlibMatthew Garrett
2013-10-04Add Tiano patch e98e59c237e17f064a4ecffb39d45499f89720a1Matthew Garrett
This is: Fix a bug in OpensslLib that PKCS7_verify will use over 8k stack space. Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Dong Guo <guo.dong@intel.com> from upstream.
2013-10-04Add Tiano patch e98e59c237e17f064a4ecffb39d45499f89720a1Matthew Garrett
This is: Fix a bug in OpensslLib that PKCS7_verify will use over 8k stack space. Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Dong Guo <guo.dong@intel.com> from upstream.
2013-10-03Improve PE image bounds checking.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Improve PE image bounds checking.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Add ident-like blobs to shim.efi for version checking.Peter Jones
I feel dirty.
2013-10-03Add ident-like blobs to shim.efi for version checking.Peter Jones
I feel dirty.
2013-10-02Update for Josh's changes.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-25 05:41:52 +0000