summaryrefslogtreecommitdiff
path: root/include/sbat.h
AgeCommit message (Collapse)Author
2025-02-18Allow indepdent SkuSi and SBAT revocation updatesJan Setje-Eilers
While a revocations.efi binary can contain either SBAT revocations, SkuSi revocations, or both, it is desirable to package them separately so that higher level tools such as fwupd can decide which ones to put in place at a given moment. This changes revocations.efi to revocations_sbat.efi and revocations_sku.efi Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2024-01-22Try to load revocations.efi even if directory read failsJan Setje-Eilers
Network booting tends to expose things like a tfpt server as a filesystem that doesn't implement directory listing This will blindly try to ingest a revocations.efi file in those cases, even if that may result in some console noise when the file does not exist. Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2024-01-22Rename "previous" revocations to "automatic"Jan Setje-Eilers
When the term previous was introduced for revocations to be automatically applied there was a hope that everytime a new revocation was built into shim, the previous revocation could be applied automatically. Further experience has shown the real world to be more complex than that. The automatic payload will realistically contain a set of revocations governed by both the cadence at which a distro's customer base updates as well as the severity of the issue being revoked. This is not a functional change. Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2023-12-05shim should not self revokeJan Setje-Eilers
Before applying an updated SbatLevel shim should re-run introspection and never apply a revocation level that would prevent the currently running shim from booting. The proper way forward is to update shim first. Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2023-12-05BS Variables for bootmgr revocationsJan Setje-Eilers
This adds support for applying SkuSiPolicy UEFI BS variables. These varaibles are needed for non-dbx based Windows revocations and are described here: https://support.microsoft.com/en-us/topic/kb5027455-guidance-for-blocking-vulnerable-windows-boot-managers-522bb851-0a61-44ad-aa94-ad11119c5e91 Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2023-12-05Allow SbatLevel data from external binaryJan Setje-Eilers
Ingest SBAT Levels from revocations binary thereby allowing level requirements to be updated independently from shipping a new shim. Do not automatically apply any revocations from a stock shim at this point. Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2022-08-03Make SBAT variable payload introspectableChris Coulson
Given a set of EFI variables and boot assets, it should be possible to compute what the value of PCR 7 will be on the next boot. As shim manages the contents of the SbatLevel variable and this is measured to PCR 7, export the payloads that shim contains in a new COFF section (.sbatlevel) so that it can be introspected by code outside of shim. The new section works a bit like .vendor_cert - it contains a header and then the payload. In this case, the header contains no size fields because the strings are NULL terminated. Shim uses this new section internally in set_sbat_uefi_variable. The .sbatlevel section starts with a 4 byte version field which is not used by shim but may be useful for external auditors if the format of the section contents change in the future. Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
2022-05-24Update SBAT generation requirements for 05/24/22Jan Setje-Eilers
bump shim SBAT generation requirement to 2 for CVE-2022-28737 bump GRUB2 SBAT generation requirement to 2 for CVE-2021-3695 Signed-off-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
2022-05-18sbat policy: make our policy change actions symbolicPeter Jones
There are a couple of places where the code we've got right now just uses integers to decode one of our MoK variables. That's bad. This patch replaces those with symbolic names. Signed-off-by: Peter Jones <pjones@redhat.com>
2022-05-18sbat.h: minor reformatting for legibilityPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2022-05-17SBAT revocation managementJan Setje-Eilers
Support for updating SBAT revocations to latest or previous revocations. Allow SBAT revocations to be reset to empty metadata only when UEFI Secure Boot is disabled. Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
2021-03-27Change SBAT variable name to SbatLevelJan Setje-Eilers
Because a few shim builds were signed that did not properly initialize the SBAT variable, and in doing so deleted valid SBAT variables, we need to use a different name. This changes the name from "SBAT" to "SbatLevel". Signed-off-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
2021-03-27Move the check for the SBAT variable properties to its own function.Jan Setje-Eilers
This moves the check for the SBAT variable's attributes and contents into its own function, so that test cases can be written against it. Signed-off-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
2021-03-12sbat variable: use UEFI_VAR_NV_BS_RT when we've got ENABLE_SHIM_DEVELPeter Jones
This makes it so that if you build with ENABLE_SHIM_DEVEL, the SBAT we use is named SBAT_DEVEL instead of SBAT, and it's expected to have EFI_VARIABLE_RUNTIME_ACCESS set. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-03-11If the SBAT UEFI variable is not set, initialize it as a bootservices variable.Jan Setje-Eilers
2021-02-25sbat: fix the residual "resource section" for SBATGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2021-02-25Make verify_sbat() more testablePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25SBAT: make our SBAT variable parser use the CSV parserPeter Jones
This makes our SBAT variable parser use the generic CSV parser, and also changes its API slightly to produce a more testable intermediate interface. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25SBAT: make our sbat section parser use the csv parserPeter Jones
This makes the .sbat section parser use parse_csv_data(). It also re-names a couple of the structs, because they were still too easy to get lost in. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: make shim to parse it's own .sbat section on initJavier Martinez Canillas
This is needed for shim to verify itself when booting, to make sure that shim binaries can't be executed anymore after been revoked by SBAT. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-19Don't re-parse the SBAT EFI variable for each binary we load.Javier Martinez Canillas
On a typical boot we validate at least two binaries; parsing the SBAT EFI variable each time, when it should not be changing, is not worth the effort. This patch moves the parsing out to some setup code, instead of doing it during the verification stage. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19parse_sbat: handle the realloc failure leak and batch allocations.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19pe.c: parse SBAT variable and perform basic verificationAlex Burmashev
Per Peter Jones suggestion, we will be flexible in what data we expect while parsing the variable. Three fields are mandatory: component_generation, component_name_size, component_name However we also support adding comments and additional information to be added after component name, with ',' as a separator. Those information will be ignored and not used for verification purposes. So: grub,1 and grub,1,wow,this,is,my,comment will provide exactly same set of data for verification. [0]: https://github.com/rhboot/shim/blob/main/SBAT.md Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com> Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: drop the struct sbat and just use two variables insteadPeter Jones
The struct sbat isn't doing anything and only has two fields so let's pass pass those two to the functions directly instead of storing it in a struct. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16sbat: remove unused buffer parameter in parse_sbat() functionJavier Martinez Canillas
It's a left over from an early implementation that was never cleaned. Reported-by: Christopher Co <christopher.co@microsoft.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-16sbat: clang-format the whole thing.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-15sbat: make the includes work like everything else.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13Add a function to parse the SBAT metadata from the .sbat sectionJavier Martinez Canillas
Parse the SBAT [0] Version-Based Revocation Metadata that's contained in a .sbat data section of the loaded PE binary. This information is used along with data in a SBAT variable to determine if a EFI binary has been revoked. [0]: https://github.com/rhboot/shim/blob/sbat/SBAT.md Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-13Add the beginning of .sbat parsing stuffPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-24 22:59:49 +0000