summaryrefslogtreecommitdiff
path: root/MokManager.c
AgeCommit message (Collapse)Author
2013-10-23Revert "additional bounds-checking on section sizes"Peter Jones
This reverts commit 21e40f0174814b3d91836e38c7cf95c8f2f1f3a4. In principle I like the idea of what's going on here, but generate_hash() really does need to have the expected result.
2013-10-22additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2013-10-02Add support for disabling db for verificationJosh Boyer
Provide a mechanism for a physically present end user to disable the use of db when doing signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable the use of db for verification purposes (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will cause shim to not use db for verification purposes. If db is to be ignored, shim will export a runtime variable called 'MokIgnoreDB' for the OS to query at runtime. Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
2013-10-01Merge console_control.h and console.hPeter Jones
Since these are topically the same thing, they can live together. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Make verbose stuff use console_notifyPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01MokManager needs to disable the graphics console.Peter Jones
Without this patch, on some machines we never see MokManager's UI. This protocol has never (I think?) been officially published, and yet I still have new hardware that needs it. If you're looking for a reference, look at: EdkCompatibilityPkg/Foundation/Protocol/ConsoleControl/ConsoleControl.c in the edk2 tree from Tiano. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-26Don't use LibGetVariable(), since it doesn't give us real error codes.Peter Jones
2013-09-26Merge variable retrieving functionsGary Ching-Pang Lin
2013-09-26Merge signature.h into efiauthenticated.h and guid.hGary Ching-Pang Lin
Conflicts: shim.c
2013-09-26MokManager: check the suffix of the key fileGary Ching-Pang Lin
2013-09-26MokManager: fetch more info from X509 nameGary Ching-Pang Lin
2013-09-26MokManager: reboot the system after clearing MOK passwordGary Ching-Pang Lin
2013-09-26MokManager: enhance the password prompt for SB stateGary Ching-Pang Lin
2013-09-26MokManager: rearrange the output of MOK infoGary Ching-Pang Lin
2013-09-26MokManager: enhance the password promptGary Ching-Pang Lin
2013-09-26MokManager: remove the duplicate get_keystroke()Gary Ching-Pang Lin
2013-09-26MokManager: draw the countdown screenGary Ching-Pang Lin
2013-09-26MokManager: Remove the unnecessary string duplicationGary Ching-Pang Lin
2013-09-26MokManager: support SHA512-based crypt() hashGary Ching-Pang Lin
2013-09-26MokManager: support crypt() password hashGary Ching-Pang Lin
The password format is introduced for the password hash generated by crypt(), so that the user can import the password hash from /etc/shadow. The packager, especially those who packages 3rd party drivers, can utilize this feature to import a 3rd party certificate without interfering the package installation. This commit implements the sha256-based crypt() hash function. Conflicts: Makefile MokManager.c
2013-09-26Port MokManager to Linux Foundation loader UI codePeter Jones
This is the first stage of porting the MokManager UI to the UI code used by the Linux Foundation UEFI loader. Conflicts: MokManager.c
2013-09-26We have to declare SHIM_LOCK_GUID here as well.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com> Conflicts: MokManager.c
2013-09-26MokManager needs to disable the graphics console.Peter Jones
Without this patch, on some machines we never see MokManager's UI. This protocol has never (I think?) been officially published, and yet I still have new hardware that needs it. If you're looking for a reference, look at: EdkCompatibilityPkg/Foundation/Protocol/ConsoleControl/ConsoleControl.c in the edk2 tree from Tiano. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-01-03Make sure the menu shows when the callback failsGary Ching-Pang Lin
Since Pause() doesn't clear the key from the input queue, the next ReadKeyStroke reads the queued key instead of the new one. If the user presses "Enter", MokManager exits directly without showing the menu again.
2013-01-03Add support for deleting specific keysGary Ching-Pang Lin
2012-12-27MOK doesn't include the signature ownerGary Ching-Pang Lin
2012-12-27Add a general function for password matchingGary Ching-Pang Lin
2012-12-27Reboot the system after enrolling/erasing keysGary Ching-Pang Lin
2012-12-20Clear the screen before erasing keysGary Ching-Pang Lin
2012-11-01Fix up some typesMatthew Garrett
Type-checking the UEFI calls picked up a couple of problems. Fix them up.
2012-10-24Clean up password settingMatthew Garrett
Permit clearing of the password, and avoid a case where choosing not to set a password would result in an error message on exit. Fix the same problem with MokSB.
2012-10-24Improve signature validation enable/disableMatthew Garrett
The logic used in checking the signature validation password was a bit ugly. Improve that so it behaves rather more as expected.
2012-10-23Add another missing screen clearingMatthew Garrett
Another case where we were drawing text over existing text.
2012-10-23Fix password hash calculationMatthew Garrett
This was hardcoded, rather than being based on the actual password length, resulting in incorrect hashes being generated.
2012-10-23Update image validation enable/disableMatthew Garrett
Update this to match the new mokutil behaviour
2012-10-23Delete MokList properlyMatthew Garrett
A cut and paste error meant that attempts to delete MokList were instead appending a zero-length addition.
2012-10-23Fix key database parsingMatthew Garrett
The pointer to the certificate needs to be incremented by the size of the entire certificate, not just the certificate data.
2012-10-18Clear screen before promptingMatthew Garrett
We were drawing prompts on top of existing text, which was less than ideal.
2012-10-18Don't print SHA1 sum when calculating file fingerprintsMatthew Garrett
There's no point in printing the SHA1 of a SHA256...
2012-10-18Clean up timeout counter handlingMatthew Garrett
Reduce menu redrawing by only redrawing the invalidated section of the menu during the timeout countdown.
2012-10-18Add MOK password authMatthew Garrett
Add support for setting an MOK password. The OS passes down a password hash. MokManager then presents an option for setting a password. Selecting it prompts the user for the same password again. If they match, the hash is enrolled into a boot services variable and MokManager will prompt for the password whenever it's started.
2012-10-18Pause on callback failuresMatthew Garrett
If a callback returns any kind of failure, wait for a keypress in order to give the user an opportunity to read any failure messages.
2012-10-18Add support for disabling signature verificationMatthew Garrett
Provide a mechanism for a physically present end user to disable signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable signature validation (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will skip verification of signatures.
2012-10-13Add section headersMatthew Garrett
Provide a little more contextual information when people are in shim menus.
2012-10-12Reallocate the DevPath space for the volume labelGary Ching-Pang Lin
The size of the DevPath string array was not sufficient to append the volume label. This patch extends the size for the label and re-enables the menu freeing.
2012-10-12Switch to using db format for MokList and MokNewMatthew Garrett
Using the same format as the UEFI key databases makes it easier for the kernel to parse and extract keys from MOK, and also permits MOK to contain multiple key or hash types. Additionally, add support for enrolling hashes.
2012-10-11Add menu headerMatthew Garrett
Add a basic header to the menu to make it clearer what's going on. Define SHIM_VENDOR in order to override the default.
2012-10-11Clear screen on exitMatthew Garrett
2012-10-11Add timeout supportMatthew Garrett
We should time out if there aren't any keypresses at the top level menu within a reasonable timeframe.
2012-10-11Fix whitespaceMatthew Garrett
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-24 12:44:41 +0000