From ba06a4362d22b41887bb4121694e0562cefa5385 Mon Sep 17 00:00:00 2001 From: Tamas K Lengyel Date: Wed, 8 Nov 2017 15:10:18 -0700 Subject: Add REQUIRE_TPM flag to treat TPM related errors as critical Currently TPM related errors are being silently discarded. Signed-off-by: Tamas K Lengyel --- shim.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'shim.c') diff --git a/shim.c b/shim.c index 51c58327..90a5ea04 100644 --- a/shim.c +++ b/shim.c @@ -1308,7 +1308,12 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize, return efi_status; /* Measure the binary into the TPM */ - tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize, sha1hash, 4); + efi_status = tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize, sha1hash, 4); +#ifdef REQUIRE_TPM + if (efi_status != EFI_SUCCESS) { + return efi_status; + } +#endif if (secure_mode ()) { efi_status = verify_buffer(data, datasize, &context, @@ -1818,7 +1823,11 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size) goto done; /* Measure the binary into the TPM */ - tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, sha1hash, 4); + status = tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, sha1hash, 4); +#ifdef REQUIRE_TPM + if (status != EFI_SUCCESS) + goto done; +#endif if (!secure_mode()) goto done; -- cgit v1.2.3