summaryrefslogtreecommitdiff
path: root/shim.c
AgeCommit message (Collapse)Author
2013-11-19Clarify meaning of insecure_modeMatthew Garrett
insecure_mode was intended to indicate that the user had explicity disabled checks with mokutil, which means it wasn't the opposite of secure_mode(). Change the names to clarify this and don't show the insecure mode message unless the user has explicitly enabled that mode. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
2013-11-12shim: improve error messagesAndrew Boie
%r when used in Print() will show a string representation of an EFI_STATUS code. Change-Id: I6db47f5213454603bd66177aca378ad01e9f0bd4 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12shim.c: Add support for hashing/relocation of 32-bit binariesMohanraj S
Change-Id: Ib93305f7f1691d1b142567507df1058de62dde06 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-12fix verify_mok()Andrew Boie
() Fix the return value semantics. If the MokList doesn't exist, we are OK. If the MokList was compromised but we were able to erase it, that is OK too. Only if the list can't be nuked do we return an error. () Fix use of potentially uninitialized attribute variable () Actually use the return value when called from verify_buffer. Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2013-11-06Fix check logic for SetupMode variable.Peter Jones
After going back and inspecting this further, the logic for "SetupMode" being present at all was incorrect. Also initialize our state earlier so it's sure to always be set. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-30Don't free GetVariable() return data without checking the status code.Peter Jones
This breaks every machine from before Secure Boot was a thing. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-28We should be checking both mok and the system's SB settingsPeter Jones
When we call hook_system_services(), we're currently only checking mok's setting. We should use secure_mode() instead so it'll check both. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-23Revert "additional bounds-checking on section sizes"Peter Jones
This reverts commit 21e40f0174814b3d91836e38c7cf95c8f2f1f3a4. In principle I like the idea of what's going on here, but generate_hash() really does need to have the expected result.
2013-10-22Don't reject all binaries without a certificate database.Peter Jones
If a binary isn't signed, but its hash is enrolled in db, it won't have a certificate database. So in those cases, don't check it against certificate databases in db/dbx/etc, but we don't need to reject it outright. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-22additional bounds-checking on section sizesKees Cook
This adds additional bounds-checking on the section sizes. Also adds -Wsign-compare to the Makefile and replaces some signed variables with unsigned counteparts for robustness. Signed-off-by: Kees Cook <kees@ubuntu.com>
2013-10-04Unhook system services as we exit.Peter Jones
If we never find a valid thing to boot, we need to undo the weird things we've done. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Try to actually make debug printing look reasonable.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-04Do more strict checking on PE Headers.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Improve PE image bounds checking.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-03Add ident-like blobs to shim.efi for version checking.Peter Jones
I feel dirty.
2013-10-02Add support for disabling db for verificationJosh Boyer
Provide a mechanism for a physically present end user to disable the use of db when doing signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable the use of db for verification purposes (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will cause shim to not use db for verification purposes. If db is to be ignored, shim will export a runtime variable called 'MokIgnoreDB' for the OS to query at runtime. Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
2013-10-02Fix wrong type on console_error() call.Peter Jones
Stupid L"". Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01If we fail to install our protocol, don't continue.Peter Jones
This shouldn't be exploitable unless you've got a way to make InstallProtocol fail and still, for example, have memory free to actually load and run something. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Conditionalize overriding the security policy.Peter Jones
Make OVERRIDE_SECURITY_POLICY a build option. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Merge console_control.h and console.hPeter Jones
Since these are topically the same thing, they can live together. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Make verbose stuff use console_notifyPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01Include shim's vendor_cert in MokListRTPeter Jones
There needs to be some way to communicate to the kernel that it's a trusted key, and since this mechanism already exists, it's by far the easiest.
2013-10-01Harden shim against non-participating bootloaders.Peter Jones
It works like this: during startup of shim, we hook into the system's ExitBootServices() and StartImage(). If the system's StartImage() is called, we automatically unhook, because we're chainloading to something the system can verify. When shim's verify is called, we record what kind of certificate the image was verified against. If the call /succeeds/, we remove our hooks. If ExitBootServices() is called, we check how the bootloader verified whatever it is loading. If it was verified by its hash, we unhook everything and call the system's EBS(). If it was verified by certificate, we check if it has called shim_verify(). If it has, we unhook everything and call the system's EBS() If the bootloader has not verified anything, and is itself verified by a certificate, we display a security violation warning and halt the machine.
2013-10-01Make vendor_cert/vendor_dbx actually replaceable by an external tool.Peter Jones
This moves them both to be computed at runtime from a pointer+offset rather than just a pointer, so that their real address can be entirely derived from the section they're in. This means you can replace the whole .vendor_cert section with a new one with certs that don't have the same size.
2013-09-26integrate security overrideGary Ching-Pang Lin
2013-09-26Merge variable retrieving functionsGary Ching-Pang Lin
2013-09-26Merge signature.h into efiauthenticated.h and guid.hGary Ching-Pang Lin
Conflicts: shim.c
2013-09-26Free unused memory spaceGary Ching-Pang Lin
2013-09-26Correct the certificate count of the signature listGary Ching-Pang Lin
2013-09-26Since different distros name grub*.efi differently, make it compile-time.Peter Jones
Basically, if you don't want grub.efi, you do: make 'DEFAULT_LOADER=\\\\grubx64.efi' Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-26Remove double-separators from the bootpathGary Ching-Pang Lin
2013-09-26Fix the broken bootpathGary Ching-Pang Lin
- The file path from DevicePathToStr may use slash as the file seperator. Change all slashes to backslashes to avoid the strange bootpath. - Remove the redundant backslashes. - ImagePath no longer requires the leading backslash. - Fix a memory leak Based on the patch from Michal Marek <mmarek@suse.com>
2013-09-24Pass the right arguments to EFI_PXE_BASE_CODE_TFTP_READ_FILESteve Langasek
A wrong pointer was being passed to EFI_PXE_BASE_CODE_TFTP_READ_FILE, preventing us from getting the file size back from the tftp call, ensuring that we don't have enough information to properly secureboot-validate the retrieved image.
2013-09-23Make SHIM_LOCK_GUID a first-class object with a symbol.Peter Jones
Right now the CA is checking if shim builds expose a particular version of the shim protocol. To do this, they're looking for SHIM_LOCK_GUID's value in the resulting binary. Currently, with SHIM_LOCK_GUID as a macro that gets assigned to local variables, that means they have to compensate for mov instructions mixed in with the actual value. This is completely absurd, so promote it to a first-class object with a symbol to make it both easy to find and continuous. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-16Don't print things on the screen by default when everything works.Peter Jones
There's no point to this text, and it generally confuses people. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-16Don't print that fallback isn't found in should_use_fallback()Peter Jones
The call can simply fail if it isn't found - which will be the case on removeable install media. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-06-11Fix some pointer casting issues.Peter Jones
This also fixes the size of an empty vendor_cert or dbx_cert. Signed-off-by: Peter Jones <shim-owner@fedoraproject.org>
2013-05-15Use the correct define on Open.Peter Jones
The value here doesn't actually change any, but we should still use the right name. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-15Add some error messages when things don't work.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-15Remove some unnecessary code.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-15Fix some minor type errors.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Make shim use fallback when appropriate.Peter Jones
If we're called as /BOOT/EFI/BOOT*.EFI, and /BOOT/EFI/FALLBACK.EFI exists, give it a shot. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Adopt the UEFI shell style LoadOptionsGary Ching-Pang Lin
The previous commit, 14d4b8e, caused shim failed to parse the name of the 2nd stage loader in UEFI shell. Amend parsing of the name the 2nd stage loader to be compatible with UEFI shell. To create an boot entry for elilo.efi: # efibootmgr -c -L "shim elilo" -l "efi\\shim.efi" -u "shim.efi elilo.efi"
2013-04-26Get rid of extra label.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-26Don't put the directory in the file path twice.Peter Jones
Sometimes when we're creating paths, the ImagePath can contain the directory name already. If that happens, don't add it in again. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-26UEFI Shell sticks the UCS2 of li->FilePath in li->LoadOptions. Ignore it.Peter Jones
If li->LoadOptions tells us to execute our own binary, it's clearly not what we want to do for the second stage. So simply ignore that case. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-01-03Add support for deleting specific keysGary Ching-Pang Lin
2012-12-10Get the second stage loader from the Load OptionsGary Ching-Pang Lin
This commit replaces the 2nd stage loader path with the first argument in the Load Options and moves the rest arguments (if any) to the Load Options for the 2nd stage loader. For example, to make shim to load elilo.efi, just create a new boot entry with efibootmgr: # efibootmgr -c -L "shim elilo" -l "efi\\shim.efi" -u "elilo.efi"
2012-11-27Remove debug codeMatthew Garrett
secure_mode() was altered to always return true for debug purposes, and this accidentally got committed to mainline. Fix that.
2012-11-26Sign MokManager with a locally-generated keyMatthew Garrett
shim needs to verify that MokManager hasn't been modified, but we want to be able to support configurations where shim is shipped without a vendor certificate. This patch adds support for generating a certificate at build time, incorporating the public half into shim and signing MokManager with the private half. It uses pesign and nss, but still requires openssl for key generation. Anyone using sbsign will need to figure this out for themselves.
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-28 02:40:20 +0000