summaryrefslogtreecommitdiff
path: root/shim.h
AgeCommit message (Collapse)Author
2020-08-04Make vendor_dbx correctly propagate as well.Alexander Burmashev
Signed-off-by: Peter Jones <pjones@redhat.com> This is a modified upstream patch, so it applies fine to shim-15 Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
2020-08-04Make building without VENDOR_DB_FILE or VENDOR_CERT_FILE workAlexander Burmashev
When bd89dabf5fc767e3824 added the capability to use an EFI_SECURITY_LIST as VENDOR_DB_FILE instead of VENDOR_CERT_FILE, and then when I subsequently did the cleanup in 2ab1322fae6f3d3bcfbf, we accidentally broke building with both of those disabled, due to the lack of a definition of vendor_authorized when propagating MokDb forward. This patch adds a default definition of vendor_authorized and vendor_authorized_size, which point at 0 values, for building in the case where neither option is in use. Signed-off-by: Peter Jones <pjones@redhat.com> This is a modified upstream patch, so it applies fine to shim-15 Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
2020-08-04Mok: make sure vendor_cert and vendor_db both get propageted forwardAlex Burmashev
Signed-off-by: Peter Jones <pjones@redhat.com> This is a modified upstream patch, so it applies fine to shim-15 Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
2020-08-04Add support for vendor_db built-in shim whitelistAlexander Burmashev
Potential new signing strategies ( for example signing grub, fwupdate and vmlinuz with separate certificates ) require shim to support a vendor provided bundle of trusted certificates and hashes, which allows shim to "whitelist" EFI binaries matching either certificate by signature, or hash in the vendor_db.. Functionality is similar to vendor_dbx ( vendor blacklist ). Patch is a polished version of code, authored by P. Jones. Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
2020-08-04shim: only include shim_cert.h in shim.cGary Lin
The shim_cert array was declared as a static array, and every user of shim_cert.h would create a shim_cert array for its own and grow the file size. To remove the unnecessary duplicate shim_cert arrays, this commit declares shim_cert in shim.c while other users still can access the array through the external variables: build_cert and build_cert_size. Signed-off-by: Gary Lin <glin@suse.com> Upstream-commit-id: 4e2d62f0f4e
2020-08-04mok: consolidate mirroring code in a helper instead of using gotoPeter Jones
There's no reason to complicate the logic with a goto here, instead just pull the logic we're jumping to out to a helper function. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12console: Add console_print and console_print_at helpersHans de Goede
This is a preparation commit for removing the setup_console(1) calls from MokManager and shim so that we don't force the EFI console to switch to text-mode. This commit replaces all direct calls to Print / PrintAt with calls to the new helpers (no functional changes) so that we can delay calling setup_console(1) till the first Print call in a follow-up patch. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2018-03-12shim: Make our variable validation and mirroring table driven.Peter Jones
This makes it so shim's idea of Mok variables all resides in one table of data, and we don't need a bunch of nearly identical ad-hoc functions to handle each of them. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12shim: make everything use a common perror() call.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Don't use uefi_call_wrapper(), ever.Peter Jones
I'm pretty done with typing uefi_call_wrapper() and counting arguments every time. Instead, just make the compiler error if we don't have ms_abi. Also, make it so nothing can use uefi_call_wrapper() directly. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Use gcc's offsetof() instead of hacking out our own.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Don't have tons of local guid definitions for no reason at all.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Move includes around to clean the source tree up a bit.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13try to show errors more usefully.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some defaults and a syntastic file so vim helps more.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-11Ensure that apps launched by shim get correct BS->Exit() behaviorPeter Jones
Right now applications run by shim get our wrapper for Exit(), but it doesn't do as much cleanup as it should - shim itself also exits, but currently is not doing all the cleanup it should be doing. This changes it so all of shim's cleanup is also performed. Based on a patch and lots of review from Gary Lin. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-23Make SHIM_LOCK_GUID a first-class object with a symbol.Peter Jones
Right now the CA is checking if shim builds expose a particular version of the shim protocol. To do this, they're looking for SHIM_LOCK_GUID's value in the resulting binary. Currently, with SHIM_LOCK_GUID as a macro that gets assigned to local variables, that means they have to compensate for mov instructions mixed in with the actual value. This is completely absurd, so promote it to a first-class object with a symbol to make it both easy to find and continuous. Signed-off-by: Peter Jones <pjones@redhat.com>
2012-10-12Switch to using db format for MokList and MokNewMatthew Garrett
Using the same format as the UEFI key databases makes it easier for the kernel to parse and extract keys from MOK, and also permits MOK to contain multiple key or hash types. Additionally, add support for enrolling hashes.
2012-07-05We're not MSABI, so don't advertise this as suchMatthew Garrett
2012-06-18Fix typos.Peter Jones
2012-06-05Install a protocol for sharing code with grubMatthew Garrett
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-04 14:40:59 +0000