summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-09-08Work around some annoying compiler grievancesPeter Jones
I'm still having some trouble with the offsetof() definition, so just nerf it to what stddef.h would say anyway. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Some things went weird with the openssl revert...Peter Jones
I think this works around most of them. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Cryptlib: remove DESGary Lin
Disable DES completely since it's already old and insecure. This makes MokManager not support the DES based password hash but probably no one is using it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: Remove MD4Gary Lin
MD4 is known to be insecure and shim never uses it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: amend the headers and fix signnessGary Lin
- Declare some functions in the proper headers + We missed them for a long time... - Cast offsetof to UINTN + The original casting triggers the gcc warning since int can not present the offset for the 64bit machines. - Cast the "char" array to "CHAR8 *" to avoid the gcc warnings - Implement atoi correctly Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Fix build with ENABLE_SHIM_CERT and ENABLE_SBSIGN: shim.key is created by ↵Mathieu Trudel-Lapierre
the shim.crt target Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-31Cryptlib: implement strcmp() and strcasecmp()Gary Lin
strcmp() and strcasecmp() are widely used in openssl. Implement those two functions to eliminate the gcc warnings and the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Cryptlib: Include stddef.h in CrtLibSupport.hGary Lin
The changes in the openssl headers cause the inclusion of CrtLibSupport.h eariler than the inclusion of stddef.h, so "offsetof" was defined twice and this caused the followling build error: In file included from Cryptlib/Include/openssl/buffer.h:23:0, from Cryptlib/Include/openssl/x509.h:22, from shim.c:56: /usr/lib64/gcc/x86_64-suse-linux/6/include/stddef.h:417:0: error: "offsetof" redefined [-Werror] #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) In file included from Cryptlib/Include/limits.h:15:0, from Cryptlib/Include/openssl/ossl_typ.h:13, from Cryptlib/Include/openssl/x509.h:20, from shim.c:56: Cryptlib/Include/CrtLibSupport.h:192:0: note: this is the location of the previous definition #define offsetof(type, member) ( (int) & ((type*)0) -> member ) We can lower the priority of the gcc include path or just remove the path, but this might cause problem since the path was introduced on purpose(*). Instead, including stddef.h first is more feasible. (*) https://github.com/rhinstaller/shim/commit/d51739a416400ad348d8a1c7e3886abce11fff1b Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Revert lots of Cryptlib updates.Peter Jones
OpenSSL changes quite a bit of the key validation, and most of the keys I can find in the wild aren't marked as trusted by the new checker. Intel noticed this too: https://github.com/vathpela/edk2/commit/f536d7c3ed but instead of fixing the compatibility error, they switched their test data to match the bug. So that's pretty broken. For now, I'm reverting OpenSSL 1.1.0e, because we need those certs in the wild to work. This reverts commit 513cbe2aea689bf968f171f894f3d4cdb43524d5. This reverts commit e9cc33d6f2b7f35c6f5e349fd83fb9ae0bc66226. This reverts commit 80d49f758ead0180bfe6161931838e0578248303. This reverts commit 9bc647e2b23bcfd69a0077c0717fbc454c919a57. This reverts commit ae75df6232ad30f3e8736e9449692d58a7439260. This reverts commit e883479f35644d17db7efed710657c8543cfcb68. This reverts commit 97469449fda5ba933a64280917e776487301a127. This reverts commit e39692647f78e13d757ddbfdd36f440d5f526050. This reverts commit 0f3dfc01e2d5e7df882c963dd8dc4a0dfbfc96ad. This reverts commit 4da6ac819510c7cc4ba21d7a735d69b45daa5873. This reverts commit d064bd7eef201f26cb926450a76260b5187ac689. This reverts commit 9bc86cfd6f9387f0da9d5c0102b6aa5627e91c91. This reverts commit ab9a05a10f16b33f7ee1e9da360c7801eebdb9d2. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Drain the OpenSSL error stack and report crypto verification errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Init openssl so we can use its debug facilities.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Add a mechanism to print openssl errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Fix a missing OpenSSL error message pointPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Make msleep() be a thingPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-18Rework looping in enter_mok_menu(), to allow multiple MOK changesMathieu Trudel-Lapierre
Rather than looping once through the possible actions (MokNew, MokDel, etc.), revise the logic so that instead of rebooting immediately we get back to the main menu setting a flag to replace "Continue booting" with a proper reboot. Getting back to the menu means we can go make other changes before rebooting. For instance, you might want to enable validation, but beforehand you also need to enroll a MOK. You can already do so from userland; except the requests were cleared as soon as one of them was processed. This involves some extra cleanup of the states to avoid running the same request more than once, removing the option from the menu once it's done, and changing prompting functions to return an EFI_STATUS so we can better track whether the process has succeeded. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-11Add ENABLE_SHIM_HASH and make install-as-data know how to install it.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Update TODO with some stuffPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make better debuginfo and install it reasonably.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Allow use of sbsign to sign things.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Add ENABLE_SHIM_CERT to make MokManager/fallback signing optional.Peter Jones
This makes shim not create its own keyring and sign MokManager and fallback by default. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make DEFAULT_LOADER have the EFI arch suffix by default.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make ARM targets use -mstrict-alignPeter Jones
Otherwise device paths are definitely all kinds of screwed up, but other stuff might be as well. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Add install targets.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Fix openssl compile flags for x86_64Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11fallback: work around the issue of boot option creation with AMI BIOSLans Zhang
AMI BIOS (e.g, Intel NUC5i3MYHE) may automatically hide and patch BootXXXX variables with ami_masked_device_path_guid. Initially, the normal boot option created by fallback looks like this: 00000000 01 00 00 00 5e 00 42 00 6f 00 6f 00 74 00 6c 00 |....^.B.o.o.t.l.| 00000010 6f 00 61 00 64 00 65 00 72 00 20 00 54 00 65 00 |o.a.d.e.r. .T.e.| 00000020 73 00 74 00 20 00 28 00 36 00 34 00 2d 00 62 00 |s.t. .(.6.4.-.b.| 00000030 69 00 74 00 29 00 00 00 04 01 2a 00 01 00 00 00 |i.t.).....*.....| 00000040 00 08 00 00 00 00 00 00 00 00 08 00 00 00 00 00 |................| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 01 01 04 04 30 00 5c 00 45 00 46 00 49 00 5c 00 |....0.\.E.F.I.\.| 00000070 42 00 4f 00 4f 00 54 00 5c 00 74 00 65 00 73 00 |B.O.O.T.\.t.e.s.| 00000080 74 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 |t.x.6.4...e.f.i.| 00000090 00 00 7f ff 04 00 |......| 00000096 after reboot, fallback has to create a new one due to the previous boot option is hidden and masked by AMI BIOS: 00000000 09 00 00 00 76 00 42 00 6f 00 6f 00 74 00 6c 00 |....v.B.o.o.t.l.| 00000010 6f 00 61 00 64 00 65 00 72 00 20 00 54 00 65 00 |o.a.d.e.r. .T.e.| 00000020 73 00 74 00 20 00 28 00 36 00 34 00 2d 00 62 00 |s.t. .(.6.4.-.b.| 00000030 69 00 74 00 29 00 00 00 01 04 14 00 e7 75 e2 99 |i.t.)........u..| 00000040 a0 75 37 4b a2 e6 c5 38 5e 6c 00 cb 7f ff 04 00 |.u7K...8^l......| 00000050 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 |..*.............| 00000060 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 00 00 00 00 01 01 04 04 30 00 5c 00 |............0.\.| 00000080 45 00 46 00 49 00 5c 00 42 00 4f 00 4f 00 54 00 |E.F.I.\.B.O.O.T.| 00000090 5c 00 74 00 65 00 73 00 74 00 78 00 36 00 34 00 |\.t.e.s.t.x.6.4.| 000000a0 2e 00 65 00 66 00 69 00 00 00 7f ff 04 00 |..e.f.i.......| 000000ae And after several reboot, fallback will have to create more boot options because AMI BIOS corrupts the previous ones. We can get the valid device path if just skipping the masked device path and its next end path. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-08-11fallback: fix double free of dpLans Zhang
If the boot option recorded in csv is not in a media device path, the corresponding full device path will be referred for creating the boot variable. However, the current code logic always frees the full device path (full_device_path) and the media device path (dp) separately. In order to resolve this issue, always check whether dp equals to full_device_path before freeing dp. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-08-03Add README.tpm to explain which PCRs we extend things to.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Add MokListX to MokVars.txtPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Make fallback aware of tpm measurements, and reboot if tpm is used.Peter Jones
Since booting the entry with fallback in the stack of things that got measured will result in all the wrong PCR values, in the cases where TPM is present and enabled, use ->Reset() instead of loading the Boot#### variable and executing its target. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Make tpm.c build right on 32-bit platforms.Peter Jones
EFI_PHYSICAL_ADDRESS is UINT64 everywhere, so you can't just copy a 32-bit pointer to it. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Always measure all of MokSBState, MokList, and MokListXPeter Jones
Even if errors occurred, always try to measure all of our Mok entries. This way we won't fail on e.g. MokList not being set. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Measure stage 2 according to specMatthew Garrett
We're currently measuring the raw second stage loader into PCR 9, but we're closer to spec if we measure the semi-parsed PE into PCR 4. The hash that's logged is the same as the hash used for the Authenticode validation, so refactor shim.c a little to separate out the hash generation.
2017-08-01Extend PCR 7Matthew Garrett
It's desirable to be able to use PCR 7 for all TPM policy on Secure Boot systems, but right now Shim doesn't record any information about its configuration or the signature used to launch the second stage loader. Add support for that.
2017-08-01fallback.c: be more correct with device path code.Peter Jones
Rob Clark noticed while, implementing a UEFI like backend on u-boot, that if a File Handle actually returns a meaningful device path from DevicePathFromHandle(), we wind up with a horribly wrong device path in the boot variable. He's right, normal UEFI doesn't return that, which means FileDevicePath() in our code currently does nothing at all. Instead of all that, pass in the device's handle, and it'll do what we're doing after the fact there. Here's the log from a current run: FS0:\> \efi\BOOT\BOOTX64.EFI System BootOrder not found. Initializing defaults. find_boot_options:778:Found directory named "fedora" try_boot_csv:532:Found file "\EFI\fedora\BOOT.CSV" try_boot_csv:544:File looks like: ?shim.efi,Fedora,,This is the boot entry for Fedora populate_stanza:495:CSV data: "shim.efi,Fedora,,This is the boot entry for Fedora" populate_stanza:501:filename: "shim.efi" populate_stanza:508:label: "Fedora" populate_stanza:514:arguments: "" add_to_boot_list:430:file DP: PciRoot(0)/Pci(0x1F,0x2)/Sata(0x0,0x0,0x0)/HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi FindSubDevicePath:78:input device path: "PciRoot(0)/Pci(0x1F,0x2)/Sata(0x0,0x0,0x0)/HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi" FindSubDevicePath:86:sub-path (4,1): "HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi" add_to_boot_list:452:04 01 2A 00 01 00 00 00 00 08 00 00 00 00 00 00 add_to_boot_list:452:00 40 06 00 00 00 00 00 2A 27 84 65 B9 D7 2A 44 add_to_boot_list:452:B8 A4 19 B5 EC 45 66 F4 02 02 04 04 2E 00 5C 00 add_to_boot_list:452:45 00 46 00 49 00 5C 00 66 00 65 00 64 00 6F 00 add_to_boot_list:452:72 00 61 00 5C 00 73 00 68 00 69 00 6D 00 2E 00 add_to_boot_list:452:65 00 66 00 69 00 00 00 7F FF 04 00 add_to_boot_list:459:device path: "HD(Part1,Sig6584272A-D7B9-442A-B8A4-19B5EC4566F4)/\EFI\fedora\shim.efi" Creating boot entry "Boot0000" with label "Fedora" for file "\EFI\fedora\shim.efi" AddOption - Boot0000, then CurrentCount = 0x00000008 update_boot_order:390:nbootorder: 7 BootOrder: 0000 0002 0001 0003 0005 0006 0004 Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-01Make fallback debug printing be dynamic at runtime.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-31fallback: Minor whitespace cleanupPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-24Make it possible to build in a subdirectory.Peter Jones
This lets you do: mkdir build-x64 build-ia32 cd build-x64 make TOPDIR=.. -f ../Makefile cd ../build-ia32 setarch i686 -B make ARCH=ia32 TOPDIR=.. -f ../Makefile And not worry about generated sources and headers mixing and matching. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-24README.fallback: correct the path of BOOT.CSV in layout exampleLans Zhang
BOOT.CSV should be placed in fedora directory in order to locate the base directory of files recorded in $FILENAME column. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-07-24Exit our dir->Read() loop if it says there's 0 bytes of data to read.Peter Jones
When dir->Read() says bs=0, we shouldn't try to allocate a buffer and read into it. On edk2 this works because there's an implicit (possibly accidental) minimum size of one pool list entry that can be allocated, so you wind up getting (I think) 8 bytes. When Rob Clark tried to run this under uboot's emulated UEFI environment, dir->Read() returned 0 and when we passed that to AllocateZeroPool() less good things happened. So just check for that case and exit appropriately. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-18Make ARCH overridablePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-17httpboot: fix OVMF crashLans Zhang
This is a typical typo. The free operation should be done if uri was allocated. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-20tpm2_present(): remove unused tpm2 protocol argument.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-06-15shim/tpm: Avoid passing an usupported event log format to GetEventLogs()Javier Martinez Canillas
The TCG EFI Protocol Specification for family "2.0" mentions that not all TPM2 chips may support the EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 (crypto agile) log format. So instead of always use this log format, the GetCapability() function should be used to determine which format is supported by the TPM. For example, the Intel PTT firmware based TPM found in Lenovo Thinkapd X1 Carbon (4th gen), only supports SHA-1 (EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2) log format. So a call to GetEventLog() using the crypto agile format was returning EFI_INVALID_PARAMETER, making tpm_log_event() function to fail. This was preventing shim to correctly measure the second stage bootloader: $ tpm2_listpcrs -L 0x04:9 Bank/Algorithm: TPM_ALG_SHA1(0x0004) PCR_09: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 After passing a supported log format to GetEventLog(), it succeeds and so shim is able to call the HashLogExtendEvent() EFI function correctly: $ tpm2_listpcrs -L 0x04:9 Bank/Algorithm: TPM_ALG_SHA1(0x0004) PCR_09: 07 5a 7e d3 75 64 ad 91 1a 34 17 17 c2 34 10 2b 58 5b de b7 Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15shim/tpm: Take out GetCapability() call from tpm2_present() logicJavier Martinez Canillas
The EFI_TCG2_PROTOCOL.GetCapability() function is used to learn if a TPM2 chip is present. But the protocol capability information is also needed for other reasons, for example to determine what event log formats are supported by the firmware. Take out the GetCapability() call from the tpm2_present() logic and reduce that function to just checking if a TPM2 chip is available or not, so the capabilities can later be used to determine the supported TPM log formats. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15shim/tpm: Remove magic numbersJavier Martinez Canillas
When measuring data into the TPM and generating events logs, the event type is set to EV_IPL (0xd), and for TPM1.2 the algorithm will always be set to SHA-1 (0x4). So, add some macro-defined constants for these instead of having them as magic numbers to make the code more readable. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2017-06-15update verification_method if the loaded image is signed by shim/vendor certLans Zhang
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-15become more friendly for the cross compilationLans Zhang
Allow to overwrite certain settings from the external. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-15skip the error message when creating MokListRT if vendor cert is emptyLans Zhang
EFI_NOT_FOUND will be returned when creating MokListRT if vendor cert is empty. This is harmless, meaningless and skippable. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-15fix compilerer errors in security policyMax Resch
When compiling with -Werror security policy can't be compiled because of type errors. This commit fixes this problem.
2017-04-27Bump version number to 12.latest-release12Peter Jones
Since 87060b2fc effectively means signing with signtool.exe simply does not work correctly, and that's sort of the biggest goal for shim, make this version 12. Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-21 15:16:54 +0000