summaryrefslogtreecommitdiff
path: root/shim.c
AgeCommit message (Collapse)Author
2018-04-04read_header(): fix the case where signatures have been removed.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-23Revert "Allow shim to handle multiple trusted certificates"Peter Jones
This was merged before it was really ready - verify_trusted_cert needs to check each certificate against vendor_dbx, "dbx", and "MokListX", or else it can enable a blacklisted certificate accidentally. This reverts commit 8721bbe6fb1bfdfbc8bd16e05673929e4cbbdedc.
2018-03-19Fix i386 pointer type error.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-15Avoid a minor scan-build complaint.Peter Jones
scan-build doesn't like it when we assign return values but don't use them. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-14Allow shim to handle multiple trusted certificatesMichael Brown
Allow shim to perform verification against a list of trusted certificates by simply concatenating the DER files. Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>
2018-03-14Allow memory allocated by handle_image() to be freedMichael Brown
There is currently no way for a caller of handle_image() to free the memory allocated to hold the relocated executable. Fix by adding the allocated memory address and number of pages as returned parameters from handle_image(). Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>
2018-03-14Remove global entry_point variableMichael Brown
Treat entry_point as a returned parameter from handle_image(), rather than using a global variable. Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>
2018-03-14Do not modify original imageMichael Brown
relocate_coff() currently modifies the PE header within the raw data. This appears to be unnecessary, and causes a verification failure if a second attempt is made to verify the same data buffer. Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>
2018-03-12console: Do not set EFI console to textmode until something is printedHans de Goede
Remove the setup_console(1) calls from shim and instead make lib/console.c make that call when necessary. This avoids shim forcing the EFI console to switch to text-mode if nothing is printed. This commit also modifies MokManager to work the same way for consistency, even though MokManager will always print something. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2018-03-12console: Add console_print and console_print_at helpersHans de Goede
This is a preparation commit for removing the setup_console(1) calls from MokManager and shim so that we don't force the EFI console to switch to text-mode. This commit replaces all direct calls to Print / PrintAt with calls to the new helpers (no functional changes) so that we can delay calling setup_console(1) till the first Print call in a follow-up patch. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2018-03-12shim: Don't overwrite EFI_LOADED_IMAGE's LoadOptions when not neededTamas K Lengyel
When the firmware is using EFI_LOAD_OPTION to specify options for the secondary loader, the shim will properly detect that and return in set_second_stage. Later howerer in handle_image EFI_LOADED_IMAGE is being overwritten with load_option irrespective of the fact that load_option was never set. This effectively prevents the EFI_LOAD_OPTION from reaching the secondary loader. Only overwrite EFI_LOADED_IMAGE's LoadOptions when load_option is not NULL solves the problem. Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-12Fix a minor merge error.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: Make our variable validation and mirroring table driven.Peter Jones
This makes it so shim's idea of Mok variables all resides in one table of data, and we don't need a bunch of nearly identical ad-hoc functions to handle each of them. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: make everything use a common perror() call.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: Improve the bounds checking of ImageAddress()Peter Jones
Make ImageAddress() directly check for overflow in its math. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: main(): Don't save the value from mok_ignore_db()Peter Jones
We don't really care if setting MokIgnoreDB fails; don't save the return. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: generate_hash(): make clang-analyzer not get confused.Peter Jones
clang-analyzer thinks that because we're not checking for NULL from ImageAddress() it can be NULL, but doesn't realize we've already checked that value once before. Check it again, it can't hurt. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: Mitigate a minor clang-analyzer complaint.Peter Jones
Clang believes "SumOfBytesHashed" is never used, because the thing that uses that computed value is #if 0'd currently. Just swizzle the #if's so that line is also not compiled. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Don't use uefi_call_wrapper(), ever.Peter Jones
I'm pretty done with typing uefi_call_wrapper() and counting arguments every time. Instead, just make the compiler error if we don't have ms_abi. Also, make it so nothing can use uefi_call_wrapper() directly. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: Use EFI_ERROR() instead of comparing to EFI_SUCCESS everywhere.Peter Jones
Also consistently name our status variable "efi_status" unless there's a good reason not to, such as already having another one of those. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: relocate_coff(): get rid of "FixupData" stuffPeter Jones
"FixupData" in the edk2 tree is a log of the relocations that happened, which is allocated by the "client" calling relocate, and written into while it does relocations. Since we never allocate that log anywhere, FixupData is always NULL, and so covscan says: 318 case EFI_IMAGE_REL_BASED_HIGH: 319 Fixup16 = (UINT16 *) Fixup; 320 *Fixup16 = (UINT16) (*Fixup16 + ((UINT16) ((UINT32) Adjust >> 16))); null: At condition FixupData != NULL, the value of FixupData must be NULL. dead_error_condition: The condition FixupData != NULL cannot be true. 321 if (FixupData != NULL) { CID 182859 (#1 of 4): Logically dead code (DEADCODE)dead_error_begin: Execution cannot reach this statement: *((UINT16 *)FixupData) = *F.... 322 *(UINT16 *) FixupData = *Fixup16; 323 FixupData = FixupData + sizeof (UINT16); 324 } 325 break; And it's right; all four occurrances are deadcode that never do anything but confuse the reader. Kill it with fire. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: check_db_cert_in_ram(): clear openssl errors /before/ returning.Peter Jones
Covscan says: 455 if (IsFound) { 456 tpm_measure_variable(dbname, guid, CertSize, Cert->SignatureData); 457 return DATA_FOUND; CID 182850 (#1 of 1): Structurally dead code (UNREACHABLE)unreachable: This code cannot be reached: drain_openssl_errors();. 458 drain_openssl_errors(); 459 } else { 460 LogError(L"AuthenticodeVerify(): %d\n", IsFound); 461 } And, well... woops. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: ensure generate_hash() never operates on a negative (signed) number.Peter Jones
Covscan noticed: 746static EFI_STATUS generate_hash (char *data, unsigned int datasize_in, 747 PE_COFF_LOADER_IMAGE_CONTEXT *context, 748 UINT8 *sha256hash, UINT8 *sha1hash) 749 750{ ... 764 CID 182849 (#1 of 1): Unsigned compared against 0 (NO_EFFECT)unsigned_compare: This less-than-zero comparison of an unsigned value is never true. datasize_in < 0U. 765 if (datasize_in < 0) { 766 perror(L"Invalid data size\n"); 767 return EFI_INVALID_PARAMETER; 768 } And I guess that's a fair point, but some of the callers take the size as a signed integer. So we should be handling that on all the input cases instead of getting that far. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Don't have tons of local guid definitions for no reason at all.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Rename generate_path() because we have 2 of it.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-08Fix failure to boot on systems without a TPMHans de Goede
This commit fixes 2 issues with the TPM support code: 1) Remove "REQUIRE_TPM ?=" line from the Makefile, further down the Makefile checks if REQUIRE_TPM is undefined, but the above line sets it to an empty string, which is not the same as undefined. Without this handle_image fails after the tpm_log_pe() call even if REQUIRE_TPM=1 once was not set when building the shim 2) When secure-boot is disabled then shim_verify() would exit with the status of tpm_log_pe(), which on systems with a TPM is an error. Combined with the recent change to always install the shim protocols, this causes grub to refuse to boot any kernel since the verify() call now always fails. This commit fixes this by explicitly setting status = EFI_SUCCESS when secure-boot is disabled. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2018-03-06shim: Ignore UEFI LoadOptions that are just NUL characters.Peter Jones
I don't know when or why we ever see this, but it's easy enough to avoid. Resolves github issue #95 Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-06Install shim_lock protocol even when SecureBoot is offTamas K Lengyel
Currently the shim_lock protocol is only installed when SecureBoot is enabled. However, having Verify just measure into the TPM without SecureBoot is a useful feature. Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Add REQUIRE_TPM flag to treat TPM related errors as criticalTamas K Lengyel
Currently TPM related errors are being silently discarded. Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Measure into the TPM even if SecureBoot is off in shim_lock verifyTamas K Lengyel
Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Log measurements in PCR4 for applications being verified through shim_lockTamas K Lengyel
Currently the only measurement the shim logs in the TPM is that of the EFI application it directly loads. However, there are no measurements being taken of application that are being verified through the shim_lock protocol. In this patch we extend PCR4 for any binary for which Verify is being called through the shim_lock protocol. Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-02-01Uninstall shim protocols before re-installing themMathieu Trudel-Lapierre
Make sure if we chainload things, a chainloaded bootloader will be able to use the latest systab replacements and protocols. They need to match for things to validate correctly. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-12-19"in_protocol" is used in more than shim.o; make it not static.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13try to show errors more usefully.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some debugging data to the last malformed binary check...Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Revert lots of Cryptlib updates.Peter Jones
OpenSSL changes quite a bit of the key validation, and most of the keys I can find in the wild aren't marked as trusted by the new checker. Intel noticed this too: https://github.com/vathpela/edk2/commit/f536d7c3ed but instead of fixing the compatibility error, they switched their test data to match the bug. So that's pretty broken. For now, I'm reverting OpenSSL 1.1.0e, because we need those certs in the wild to work. This reverts commit 513cbe2aea689bf968f171f894f3d4cdb43524d5. This reverts commit e9cc33d6f2b7f35c6f5e349fd83fb9ae0bc66226. This reverts commit 80d49f758ead0180bfe6161931838e0578248303. This reverts commit 9bc647e2b23bcfd69a0077c0717fbc454c919a57. This reverts commit ae75df6232ad30f3e8736e9449692d58a7439260. This reverts commit e883479f35644d17db7efed710657c8543cfcb68. This reverts commit 97469449fda5ba933a64280917e776487301a127. This reverts commit e39692647f78e13d757ddbfdd36f440d5f526050. This reverts commit 0f3dfc01e2d5e7df882c963dd8dc4a0dfbfc96ad. This reverts commit 4da6ac819510c7cc4ba21d7a735d69b45daa5873. This reverts commit d064bd7eef201f26cb926450a76260b5187ac689. This reverts commit 9bc86cfd6f9387f0da9d5c0102b6aa5627e91c91. This reverts commit ab9a05a10f16b33f7ee1e9da360c7801eebdb9d2. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Drain the OpenSSL error stack and report crypto verification errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Init openssl so we can use its debug facilities.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Make msleep() be a thingPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Add ENABLE_SHIM_CERT to make MokManager/fallback signing optional.Peter Jones
This makes shim not create its own keyring and sign MokManager and fallback by default. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Always measure all of MokSBState, MokList, and MokListXPeter Jones
Even if errors occurred, always try to measure all of our Mok entries. This way we won't fail on e.g. MokList not being set. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-03Measure stage 2 according to specMatthew Garrett
We're currently measuring the raw second stage loader into PCR 9, but we're closer to spec if we measure the semi-parsed PE into PCR 4. The hash that's logged is the same as the hash used for the Authenticode validation, so refactor shim.c a little to separate out the hash generation.
2017-08-01Extend PCR 7Matthew Garrett
It's desirable to be able to use PCR 7 for all TPM policy on Secure Boot systems, but right now Shim doesn't record any information about its configuration or the signature used to launch the second stage loader. Add support for that.
2017-06-15update verification_method if the loaded image is signed by shim/vendor certLans Zhang
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-06-15skip the error message when creating MokListRT if vendor cert is emptyLans Zhang
EFI_NOT_FOUND will be returned when creating MokListRT if vendor cert is empty. This is harmless, meaningless and skippable. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-04-27Fix buffer overrun / damaged options passed to second_stage.John S. Gruber
start is a UCS-2 character pointer and loader_len is a number of bytes. Adjust loader_len to count characters before adding to the start pointer.
2017-04-11shim: Remove the obsolete OBJ_cleanupGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2017-04-03generate_hash(): fix the regressionLans Zhang
The commit 03b9f800 introduces an issue in case the gap between SumOfBytesHashed and context->SecDir->VirtualAddress exists. This would be a typo because a formal PE image always meet SumOfBytesHashed + hashsize == context->SecDir->VirtualAddress either the gap exists or not. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2017-04-03Ignore BDS when it tells us we got our own path on the command line.Peter Jones
Sometimes we get our own path in LoadOptions for no clear reason. Don't execute it, just ignore it. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-03-27Fix some i386 type casting errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-01 17:13:26 +0000