summaryrefslogtreecommitdiff
path: root/Makefile
AgeCommit message (Collapse)Author
2017-04-27Bump version number to 12.latest-release12Peter Jones
Since 87060b2fc effectively means signing with signtool.exe simply does not work correctly, and that's sort of the biggest goal for shim, make this version 12. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-04-10make tag: always tag latest-release as wellPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-04-03Update version to 1111Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-03-27Update version to 10Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-02-23Make shim_version live in a special aligned section.Peter Jones
This makes it so two builds of the same .deb on different hosts won't have wildly different file offsets. Signed-off-by: Peter Jones <pjones@redhat.com>
2016-09-06Update to openssl to 1.0.2eGary Lin
Also update Cryptlib to edk2 r19218 - Undefine NO_BUILTIN_VA_FUNCS in Cryptlib/OpenSSL/ for x86_64 to use the gcc builtins and remove all EFIAPI from the functions - Move the most of defines into the headers instead of Makefile - Remove the global variable 'timeval' - Remove the unused code: crypto/pqueue/* and crypto/ts/* - Include bn.h in MokManager.c due to the changes in openssl Signed-off-by: Gary Lin <glin@suse.com>
2016-09-06fix: filter objcopy versionMorris
see comments here: https://github.com/rhinstaller/shim/commit/d9a4c912c0aa72905ca793b555dcb0afb33e3b30
2016-09-06Add the optional HTTPBoot supportGary Ching-Pang Lin
This commit adds the basic support for HTTPBoot, i.e. to fetch the next stage loader with the HTTP protocol. It requires gnu-efi >= 3.0.3 to support the URI device path and Ip4Config2 or Ip6Config protocol support in the UEFI implementation. To build shim.efi with HTTPBoot support: make ENABLE_HTTPBOOT=1 shim.efi Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2016-09-06read_header/handle_image: treat uninitialized file alignment as PAGE_SIZEPeter Jones
2016-09-06Make LIB_PATH and EFI_PATH per-arch.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2016-09-06Make fallback and mokmanager know about multi-arch.Peter Jones
On baytrail, we've got 32-bit firmware, 32-bit efi utilities, and 64-bit kernel. So since most distros will want 32+64 EFI media booting a 64-bit kernel, we have to name them better on the filesystem. Signed-off-by: Peter Jones <pjones@redhat.com>
2016-05-18Work around binutils version string weirdness.Peter Jones
Nick Clifton wrote to me and explained: Subject: SHIM - objcopy version check broken by RHEL 7.3 binutils Hi Peter, We (the tools group) have run across a small problem with the shim package for RHEL 7.3, whilst testing out a new version of the binutils. It complains that it needs a version of objcopy that is >= 2.23, despite the fact that the version is actually 2.25.1. I tracked the problem down to an extraneous space at the end of the version string being produced by objcopy: "GNU objcopy version 2.25.1-8.el7 " The Makefile in the shim package uses this rule to test the version of objcopy: OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.* //g' | cut -f1-2 -d.` \>= 2.24) But, because of that extra space, the sed expression clips the entire line and so the test fails. The extra space is there because normally the version number would be followed by a date. For example: "GNU objcopy version 2.23.52.0.1-56.el7 20130226" So in this case the sed will extract the date, not the version number, but the test will still pass. I could fix the binutils to remove the space, although it would be a bit messy and it would not fix the problem when a date is appended to the version number. Instead, I would like to propose a small patch to the shim Makefile. If you change the line to: OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.version //g' | cut -f1-2 -d.` \>= 2.24) then the test will work as intended, with or without an extra space at the end of the version and with or without a date appended. Would it be possible to have this change added to the shim package ? Cheers Signed-off-by: Peter Jones <pjones@redhat.com>
2016-05-11Measure state and second stage into TPMMatthew Garrett
Add support for measuring the MOK database and secure boot state into a TPM, and do the same for the second stage loader. This avoids a hole in TPM measurement between the firmware and the second stage loader.
2015-11-17shim: rebuild shim.o if headers changePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-09Cryptlib: Define the va functions for EFIAPIGary Ching-Pang Lin
It turned out that my previous crash fix(*) was wrong. We actually always used the gcc built-in va functions instead of the "real" va functions for EFIAPI, and we are just lucky that ERR_add_error_data didn't crash before. This commit copies the va functions from MdePkg/Include/Base.h in edk2 and introdues NO_BUILTIN_VA_FUNCS for x86_64, so that all the x86_64 build will adopt the new va functions. For safety, I also added EFIAPI to all the functions which use va_* to avoid the potential trouble. (*) a7f4b26cc35204165bd04e75c34e8e7aa2a87ecc Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-09-18Fix recursive reference for RELEASELinn Crosetto
Building 0.9 with GNU Make 4.0 fails with the following error: Makefile:4: *** Recursive variable 'RELEASE' references itself (eventually). Stop. Change RELEASE to simply-expanded. Signed-off-by: Linn Crosetto <linn@hpe.com>
2015-07-28Specify the gnu89 standardGary Ching-Pang Lin
According to the gcc5 porting guideline (*), gcc5 defaults to -std=gnu11 instead of -std=gnu89. Append -std=gnu89 to CFLAGS to avoid the potential problems. (*) https://gcc.gnu.org/gcc-5/porting_to.html Based on the patch from Cristian Rodriguez <crrodriguez@opensuse.org> Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-30Typo on aarch64 :/Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-300.9Version_0.90.9Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-30Improve our debuginfo path printPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-29Add a conditional point for a debugger to attach.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-05-12Make the build failed with objcopy < 2.24Gary Ching-Pang Lin
The wildcard support was introduced in objcopy since binutils 2.24. However, objcopy < 2.24 never issues any warning message with the wildcard and a faulty binary will be generated. This commit makes the build failed as a notification for the usage of binutils < 2.24. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-04-15Explicitly request sysv-style ELF hash sectionsMatthew Garrett
We depend on there being a .hash section in the binary, and that's not the case on distributions that default to building with gnu-style ELF hashes. Explicitly request sysv-style hashes in order to avoid building broken binaries. Signed-off-by: Matthew Garrett <mjg59@coreos.com>
2015-04-13gcc 5.0 changes some include bits, so copy what arm does on x86.Peter Jones
Basically they messed around with stdarg some and now we need to do it the other way. Signed-off-by: Peter Jones <pjones@redhat.com>
2015-04-13Make lib/ use the right CFLAGS.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2014-10-13Bump version to 0.80.8Peter Jones
2014-10-02Use -Werror=sign-compare .Peter Jones
I'm going to have to fix any errors that have this anyway, so may as well do it here properly. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-09-30Revert header changesPeter Jones
Revert "Do the same for ia32..." and "Generate a sane PE header on shim, fallback, and MokManager." This reverts commit 6744a7ef8eca44948565c3d1244ec931ed3f6fee. and commit 0e7ba5947eb38b79de2051ecf3b95055e620475c. These are premature and I can do this without such drastic measures. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-09-21Do the same for ia32...Peter Jones
Once again, on ia32 this time, we see: 00000120 47 84 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 |G...............| Which is where the pointer on ia32 for the Base Relocation Table should be. It points to 0x8447, which isn't a particularly reasonable address as numbers go, and happens to have this data there: 00008440 6f 00 6e 00 66 00 69 00 67 00 75 00 72 00 65 00 |o.n.f.i.g.u.r.e.| 00008450 00 00 49 00 50 00 76 00 36 00 28 00 00 00 2c 00 |..I.P.v.6.(...,.| 00008460 25 00 73 00 2c 00 00 00 29 00 00 00 25 00 64 00 |%.s.,...)...%.d.| 00008470 2e 00 25 00 64 00 2e 00 25 00 64 00 2e 00 25 00 |..%.d...%.d...%.| 00008480 64 00 00 00 44 00 48 00 43 00 50 00 00 00 49 00 |d...D.H.C.P...I.| 00008490 50 00 76 00 34 00 28 00 00 00 2c 00 25 00 73 00 |P.v.4.(...,.%.s.| And so that table is, in theory, this part: 00008447 00 67 00 75 00 72 00 65 00 | .g.u.r.e.| 00008450 00 |. | Which is pretty clearly not a pointer table of any kind. So give ia32 the same treatment as x86_64, and now all arches work basically the same. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-09-21Generate a sane PE header on shim, fallback, and MokManager.Peter Jones
It turns out a7249a65 was masking a second problem - on some binaries, when we actually don't have any base relocations at all, binutils' "objcopy --target efi-app-x86_64" is generating a PE header with a base relocations pointer that happily points into the middle of our text section. So with shim processing base relocations correctly, it refuses to load those binaries. For example, on one binary I just built: 00000130 00 a0 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 |................| which says there's a Base Relocation Table at 0xa000 that's 0xa bytes long. That's here: 0000a000 58 00 29 00 00 00 00 00 48 00 44 00 28 00 50 00 |X.).....H.D.(.P.| 0000a010 61 00 72 00 74 00 25 00 64 00 2c 00 53 00 69 00 |a.r.t.%.d.,.S.i.| 0000a020 67 00 25 00 67 00 29 00 00 00 00 00 00 00 00 00 |g.%.g.).........| 0000a030 48 00 44 00 28 00 50 00 61 00 72 00 74 00 25 00 |H.D.(.P.a.r.t.%.| So the table is: 0000a000 58 00 29 00 00 00 00 00 48 00 |X.).....H. | That wouldn't be so bad, except those binaries are MokManager.efi, fallback.efi, and shim.efi, and sometimes they're .reloc, which we're actually trying to handle correctly now because grub builds with a real and valid .reloc table. So though I didn't think there was any hair left on this yak, more shaving ensues. With this change, instead of letting objcopy do whatever it likes, we switch to "-O binary" and merely link in a header that's appropriate for our binaries. This is the same method Ard wrote for aarch64, and it seems to work fine in either place (modulo some minor changes.) At some point this should be merged into gnu-efi instead of carrying our own crt0-efi-x86_64.S, but that's a less immediate problem. I did not need this problem. Signed-off-by: Peter Jones <pjones@redhat.com>
2014-08-12Add support for 32-bit ARMArd Biesheuvel
This adds support for building the shim for a 32-bit ARM UEFI environment. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2014-08-12Add support for 64-bit ARM (AArch64)Ard Biesheuvel
This adds support for building the shim for a 64-bit ARM UEFI environment. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2014-08-12Factor out x86-isms and add cross compile supportArd Biesheuvel
This patch cleans up and refactors the Makefiles to better allow new architectures to be added: - remove unused Makefile definitions - import Makefile definitions from top level rather than redefining - move x86 specific CFLAGS to inside ifeq() blocks - remove x86 inline asm - allow $(FORMAT) to be overridden: this is necessary as there exists no EFI or PE/COFF aware objcopy for ARM Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2014-06-25Exclude ca.crt while signing EFI imagesGary Ching-Pang Lin
If ca.crt was added into the certificate database, ca.crt would be the first certificate in the signature. Because shim couldn't verify ca.crt with the embedded shim.cer, it failed to load MokManager.efi.signed and fallback.efi.signed. Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2014-04-11additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2013-11-12allow 32-bit compilation with 64-bit compilerAndrew Boie
Also removed unused LIB_PATH from some Makefiles. Change-Id: I7d28d18f7531b51b6121a2ffb88bcaedec57c467 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12propagate some path variablesAndrew Boie
If these are overridden on the command line, pass them along to the sub-makes. Change-Id: I531ccb5d2f5e4be8e99d4892cdcfffffc1ad9877 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fix fallback.so build dependencyAndrew Boie
Exposed during parallel builds Change-Id: I9867858166dcafd69438f37ee5da14a267ace8f4 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-06Bump version to 0.7.0.7Peter Jones
Do not use 0.6; on some machines it misunderstands the SetupMode variable. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Make tag its own make target, and make it sign tags.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-31Bump version to 0.6Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-23Revert "additional bounds-checking on section sizes"Peter Jones
This reverts commit 21e40f0174814b3d91836e38c7cf95c8f2f1f3a4. In principle I like the idea of what's going on here, but generate_hash() really does need to have the expected result.
2013-10-22additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2013-10-04Bump version to 0.50.5Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Add ident-like blobs to shim.efi for version checking.Peter Jones
I feel dirty.
2013-10-02Remove "shim.cer" on "make clean".Peter Jones
If we don't do this, an old key winds up being reused and MokManager.efi.signed is signed with a different key than shim_cert reflects. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Conditionalize overriding the security policy.Peter Jones
Make OVERRIDE_SECURITY_POLICY a build option. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Merge console_control.h and console.hPeter Jones
Since these are topically the same thing, they can live together. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Make verbose stuff use console_notifyPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Harden shim against non-participating bootloaders.Peter Jones
It works like this: during startup of shim, we hook into the system's ExitBootServices() and StartImage(). If the system's StartImage() is called, we automatically unhook, because we're chainloading to something the system can verify. When shim's verify is called, we record what kind of certificate the image was verified against. If the call /succeeds/, we remove our hooks. If ExitBootServices() is called, we check how the bootloader verified whatever it is loading. If it was verified by its hash, we unhook everything and call the system's EBS(). If it was verified by certificate, we check if it has called shim_verify(). If it has, we unhook everything and call the system's EBS() If the bootloader has not verified anything, and is itself verified by a certificate, we display a security violation warning and halt the machine.
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-05 18:38:30 +0000