efi-boot-shim.git - (mirror of https://github.com/vyos/efi-boot-shim.git)

Age	Commit message (Collapse)	Author
2021-02-19	sbat: make shim to parse it's own .sbat section on init	Javier Martinez Canillas
	This is needed for shim to verify itself when booting, to make sure that shim binaries can't be executed anymore after been revoked by SBAT. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-19	Don't re-parse the SBAT EFI variable for each binary we load.	Javier Martinez Canillas
	On a typical boot we validate at least two binaries; parsing the SBAT EFI variable each time, when it should not be changing, is not worth the effort. This patch moves the parsing out to some setup code, instead of doing it during the verification stage. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19	parse_sbat: handle the realloc failure leak and batch allocations.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19	pe.c: parse SBAT variable and perform basic verification	Alex Burmashev
	Per Peter Jones suggestion, we will be flexible in what data we expect while parsing the variable. Three fields are mandatory: component_generation, component_name_size, component_name However we also support adding comments and additional information to be added after component name, with ',' as a separator. Those information will be ignored and not used for verification purposes. So: grub,1 and grub,1,wow,this,is,my,comment will provide exactly same set of data for verification. [0]: https://github.com/rhboot/shim/blob/main/SBAT.md Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com> Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19	sbat: drop the struct sbat and just use two variables instead	Peter Jones
	The struct sbat isn't doing anything and only has two fields so let's pass pass those two to the functions directly instead of storing it in a struct. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16	sbat: remove unused buffer parameter in parse_sbat() function	Javier Martinez Canillas
	It's a left over from an early implementation that was never cleaned. Reported-by: Christopher Co <christopher.co@microsoft.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-16	sbat: clang-format the whole thing.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-15	sbat: make the includes work like everything else.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13	Add a function to parse the SBAT metadata from the .sbat section	Javier Martinez Canillas
	Parse the SBAT [0] Version-Based Revocation Metadata that's contained in a .sbat data section of the loaded PE binary. This information is used along with data in a SBAT variable to determine if a EFI binary has been revoked. [0]: https://github.com/rhboot/shim/blob/sbat/SBAT.md Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-13	Add the beginning of .sbat parsing stuff	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>