summaryrefslogtreecommitdiff
path: root/include/sbat.h
AgeCommit message (Collapse)Author
2022-05-24Update SBAT generation requirements for 05/24/22Jan Setje-Eilers
bump shim SBAT generation requirement to 2 for CVE-2022-28737 bump GRUB2 SBAT generation requirement to 2 for CVE-2021-3695 Signed-off-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
2022-05-18sbat policy: make our policy change actions symbolicPeter Jones
There are a couple of places where the code we've got right now just uses integers to decode one of our MoK variables. That's bad. This patch replaces those with symbolic names. Signed-off-by: Peter Jones <pjones@redhat.com>
2022-05-18sbat.h: minor reformatting for legibilityPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2022-05-17SBAT revocation managementJan Setje-Eilers
Support for updating SBAT revocations to latest or previous revocations. Allow SBAT revocations to be reset to empty metadata only when UEFI Secure Boot is disabled. Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2021-03-27Change SBAT variable name to SbatLevelJan Setje-Eilers
Because a few shim builds were signed that did not properly initialize the SBAT variable, and in doing so deleted valid SBAT variables, we need to use a different name. This changes the name from "SBAT" to "SbatLevel". Signed-off-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
2021-03-27Move the check for the SBAT variable properties to its own function.Jan Setje-Eilers
This moves the check for the SBAT variable's attributes and contents into its own function, so that test cases can be written against it. Signed-off-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
2021-03-12sbat variable: use UEFI_VAR_NV_BS_RT when we've got ENABLE_SHIM_DEVELPeter Jones
This makes it so that if you build with ENABLE_SHIM_DEVEL, the SBAT we use is named SBAT_DEVEL instead of SBAT, and it's expected to have EFI_VARIABLE_RUNTIME_ACCESS set. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-03-11If the SBAT UEFI variable is not set, initialize it as a bootservices variable.Jan Setje-Eilers
2021-02-25sbat: fix the residual "resource section" for SBATGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2021-02-25Make verify_sbat() more testablePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25SBAT: make our SBAT variable parser use the CSV parserPeter Jones
This makes our SBAT variable parser use the generic CSV parser, and also changes its API slightly to produce a more testable intermediate interface. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25SBAT: make our sbat section parser use the csv parserPeter Jones
This makes the .sbat section parser use parse_csv_data(). It also re-names a couple of the structs, because they were still too easy to get lost in. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: make shim to parse it's own .sbat section on initJavier Martinez Canillas
This is needed for shim to verify itself when booting, to make sure that shim binaries can't be executed anymore after been revoked by SBAT. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-19Don't re-parse the SBAT EFI variable for each binary we load.Javier Martinez Canillas
On a typical boot we validate at least two binaries; parsing the SBAT EFI variable each time, when it should not be changing, is not worth the effort. This patch moves the parsing out to some setup code, instead of doing it during the verification stage. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19parse_sbat: handle the realloc failure leak and batch allocations.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19pe.c: parse SBAT variable and perform basic verificationAlex Burmashev
Per Peter Jones suggestion, we will be flexible in what data we expect while parsing the variable. Three fields are mandatory: component_generation, component_name_size, component_name However we also support adding comments and additional information to be added after component name, with ',' as a separator. Those information will be ignored and not used for verification purposes. So: grub,1 and grub,1,wow,this,is,my,comment will provide exactly same set of data for verification. [0]: https://github.com/rhboot/shim/blob/main/SBAT.md Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com> Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: drop the struct sbat and just use two variables insteadPeter Jones
The struct sbat isn't doing anything and only has two fields so let's pass pass those two to the functions directly instead of storing it in a struct. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16sbat: remove unused buffer parameter in parse_sbat() functionJavier Martinez Canillas
It's a left over from an early implementation that was never cleaned. Reported-by: Christopher Co <christopher.co@microsoft.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-16sbat: clang-format the whole thing.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-15sbat: make the includes work like everything else.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13Add a function to parse the SBAT metadata from the .sbat sectionJavier Martinez Canillas
Parse the SBAT [0] Version-Based Revocation Metadata that's contained in a .sbat data section of the loaded PE binary. This information is used along with data in a SBAT variable to determine if a EFI binary has been revoked. [0]: https://github.com/rhboot/shim/blob/sbat/SBAT.md Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-13Add the beginning of .sbat parsing stuffPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-01 16:35:25 +0000