summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-06-25Fetch the netboot image from the same deviceGary Ching-Pang Lin
The previous strategy is to locate the first available PXE_BASE_CODE protocol and to fetch the second stage image from it, and this may cause shim to fetch the wrong second stage image, i.e. grub.efi. Consider the machine with the following boot order: 1. PXE Boot 2. Hard Drive Assume that the EFI image, e.g. bootx64.efi, in the PXE server is broken, then "PXE Boot" will fail and fallback to "Hard Drive". While shim.efi in "Hard Drive" is loaded, it will find the PXE protocol is available and fetch grub.efi from the PXE server, not grub.efi in the disk. This commit checks the DeviceHandle from Loaded Image. If the device supports PXE, then shim fetches grub.efi with the PXE protocol. Otherwise, shim loads grub.efi from the disk. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Try to boot the first boot option anywayGary Ching-Pang Lin
Some UEFI implementations never care the boot options, so the restored boot options could be just ignored and this results in endless reboot. To avoid this situation, this commit makes fallback.efi to load the first matched boot option even if there is no boot option to be restored. It may not be perfect, but at least the bootloader is loaded... Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Fix the data size for boot option comparisonGary Ching-Pang Lin
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-05-13[fallback] Avoid duplicate old BootOrderGary Ching-Pang Lin
set_boot_order() already copies the old BootOrder to the variable, bootorder. Besides, we can adjust BootOrder when adding the newly generated boot option. So, we don't have to copy the old one again in update_boot_order(). This avoid the duplicate entries in BootOrder. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-04-11Get rid of SectionCache in generate_hash(), it is unused.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2014-04-11Kees' patch missed the offset adjustment to PEHdr.Peter Jones
In read_header, we adjust context->PEHdr's address by doshdr->e_lfanew. If we're going to recompute that address, we have to adjust it here too. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-04-11additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2014-02-14Allow fallback to use the system's LoadImage/StartImage .Peter Jones
Track use of the system's LoadImage(), and when the next StartImage() call is for an image the system verified, allow that to count as participating, since it has been verified by the system's db. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-02-14Add a failure case to the test plan and fix an ordering error.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2014-02-14Add a preliminary test plan.Peter Jones
Because you know you wanted a test plan. You feel it deeply inside. Note that none of the /negative/ cases are tested yet. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-01-31[fallback] Attempt to re-use existing entries when possible.Peter Jones
Some firmwares seem to ignore our boot entries and put their fallback entries back on top. Right now that results in a lot of boot entries for our stuff, a la https://bugzilla.redhat.com/show_bug.cgi?id=995834 . Instead of that happening, if we simply find existing entries that match the entry we would create and move them to the top of the boot order, the machine will continue to operate in failure mode (which we can't avoid), but at least we won't create thousands of extra entries. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-01-31[fallback] For HD() device paths, use just the media node and later.Peter Jones
UEFI 2.x section 3.1.2 provides for "short-form device path", where the first element specified is a "hard drive media device path", so that you can move a disk around on different buses without invalidating your device path. Fallback has not been using this option, though in most cases efibootmgr has. Note that we still keep the full device path, because LoadImage() isn't necessarily the layer where HD() works - one some systems BDS is responsible for resolving the full path and passes that to LoadImage() instead. So we have to do LoadImage() with the full path.
2013-11-21Error check the right thing in get_variable_attr() when allocating.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-21Rewrite directory traversal allocation path so coverity can grok it.Peter Jones
The things we do for our tools. In this case, make the AllocatePool() happen outside of a conditional, even though that conditional will always bee satisfied. This way coverity won't think we're setting fi to NULL and passing it to StrCaseCmp. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-21Initialize entries before we pass it to another function.Peter Jones
Coverity scan noticed that entries is uninitialized when we pass its location to another function. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-21Fix wrong sizeof().Peter Jones
CHAR16* vs CHAR16**, so the result is the same on all platforms. Detected by coverity. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-21Lengths that might be -1 can't be unsigned, Peter.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-21Fix path generation for Dhcpv4 bootloader.Peter Jones
Right now we always look for e.g. "\grubx64.efi", which is completely wrong. This makes it look for the path shim was loaded from and modify that to end in a sanitized version of our default loader name. Resolves: rhbz#1032583 Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-19Don't hook system services if shim has no built-in keysMatthew Garrett
Shim should only need to enforce its security policy when its launching binaries signed with its built-in key. Binaries signed by keys in db or Mokdb should be able to rely on their own security policy. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
2013-11-19Clarify meaning of insecure_modeMatthew Garrett
insecure_mode was intended to indicate that the user had explicity disabled checks with mokutil, which means it wasn't the opposite of secure_mode(). Change the names to clarify this and don't show the insecure mode message unless the user has explicitly enabled that mode. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
2013-11-12shim: improve error messagesAndrew Boie
%r when used in Print() will show a string representation of an EFI_STATUS code. Change-Id: I6db47f5213454603bd66177aca378ad01e9f0bd4 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12allow 32-bit compilation with 64-bit compilerAndrew Boie
Also removed unused LIB_PATH from some Makefiles. Change-Id: I7d28d18f7531b51b6121a2ffb88bcaedec57c467 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12propagate some path variablesAndrew Boie
If these are overridden on the command line, pass them along to the sub-makes. Change-Id: I531ccb5d2f5e4be8e99d4892cdcfffffc1ad9877 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fix fallback.so build dependencyAndrew Boie
Exposed during parallel builds Change-Id: I9867858166dcafd69438f37ee5da14a267ace8f4 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fallback.c: fix 32-bit compilationAndrew Boie
fh->Read expects pointer to 32-bit int, use UINTN Change-Id: If1a728efd51a9a24dfcd8123e84bf4c0713491fe Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12properly compile OpenSSL in 32-bit modeAndrey Petrov
Change-Id: Iff3ee5ae0f0b95b282b99a23e465723b4e9f6104 Signed-off-by: Andrey Petrov <andrey.petrov@intel.com> Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12netboot.h: fix build error on 32-bit systemsAndrew Boie
Function prototype/implementation mismatch. Change-Id: I89aaae1b49d0372d3aed76fc21c194e0ae55f72e Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12shim.c: Add support for hashing/relocation of 32-bit binariesMohanraj S
Change-Id: Ib93305f7f1691d1b142567507df1058de62dde06 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fix verify_mok()Andrew Boie
() Fix the return value semantics. If the MokList doesn't exist, we are OK. If the MokList was compromised but we were able to erase it, that is OK too. Only if the list can't be nuked do we return an error. () Fix use of potentially uninitialized attribute variable () Actually use the return value when called from verify_buffer. Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-06Bump version to 0.7.0.7Peter Jones
Do not use 0.6; on some machines it misunderstands the SetupMode variable. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-11-06Fix check logic for SetupMode variable.Peter Jones
After going back and inspecting this further, the logic for "SetupMode" being present at all was incorrect. Also initialize our state earlier so it's sure to always be set. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Make tag its own make target, and make it sign tags.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Bump version to 0.6Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-30Don't free GetVariable() return data without checking the status code.Peter Jones
This breaks every machine from before Secure Boot was a thing. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-28We should be checking both mok and the system's SB settingsPeter Jones
When we call hook_system_services(), we're currently only checking mok's setting. We should use secure_mode() instead so it'll check both. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-23Revert "additional bounds-checking on section sizes"Peter Jones
This reverts commit 21e40f0174814b3d91836e38c7cf95c8f2f1f3a4. In principle I like the idea of what's going on here, but generate_hash() really does need to have the expected result.
2013-10-22Don't reject all binaries without a certificate database.Peter Jones
If a binary isn't signed, but its hash is enrolled in db, it won't have a certificate database. So in those cases, don't check it against certificate databases in db/dbx/etc, but we don't need to reject it outright. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-22additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2013-10-04Bump version to 0.50.5Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Unhook system services as we exit.Peter Jones
If we never find a valid thing to boot, we need to undo the weird things we've done. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Put SHIM_VERBOSE under shim's guid, not global.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Try to actually make debug printing look reasonable.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Do more strict checking on PE Headers.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Reapply patches lost in the updateMatthew Garrett
2013-10-04Update to current Tiano CryptlibMatthew Garrett
2013-10-04Add Tiano patch e98e59c237e17f064a4ecffb39d45499f89720a1Matthew Garrett
This is: Fix a bug in OpensslLib that PKCS7_verify will use over 8k stack space. Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Dong Guo <guo.dong@intel.com> from upstream.
2013-10-03Improve PE image bounds checking.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Add ident-like blobs to shim.efi for version checking.Peter Jones
I feel dirty.
2013-10-02Update for Josh's changes.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02Add support for disabling db for verificationJosh Boyer
Provide a mechanism for a physically present end user to disable the use of db when doing signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable the use of db for verification purposes (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will cause shim to not use db for verification purposes. If db is to be ignored, shim will export a runtime variable called 'MokIgnoreDB' for the OS to query at runtime. Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-21 23:33:37 +0000