proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-08-04 10:01:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

mok: also mirror the build cert to MokListRT

Browse Source 
If the build cert is enabled, we should also mirror it to MokListRT.

Signed-off-by: Gary Lin <glin@suse.com>
Upstream-commit-id: aecbe1f99b6
This commit is contained in:
Gary Lin 2018-12-19 12:40:02 +08:00 committed by Peter Jones
parent 7a3638173e
commit 3d62232feb
1 changed files with 72 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
mok.c
View File

@ -68,6 +68,10 @@ struct mok_state_variable {
*/
UINT8 **addend_source;
UINT32 *addend_size;
#if defined(ENABLE_SHIM_CERT)
UINT8 **build_cert;
UINT32 *build_cert_size;
#endif /* defined(ENABLE_SHIM_CERT) */
UINT32 yes_attr;
UINT32 no_attr;
UINT32 flags;
@ -90,6 +94,10 @@ struct mok_state_variable mok_state_variables[] = {
.no_attr = EFI_VARIABLE_RUNTIME_ACCESS,
.addend_source = &vendor_cert,
.addend_size = &vendor_cert_size,
#if defined(ENABLE_SHIM_CERT)
.build_cert = &build_cert,
.build_cert_size = &build_cert_size,
#endif /* defined(ENABLE_SHIM_CERT) */
.flags = MOK_MIRROR_KEYDB |
MOK_VARIABLE_LOG,
.pcr = 14,
@ -130,6 +138,22 @@ struct mok_state_variable mok_state_variables[] = {
{ NULL, }
};
inline BOOLEAN check_vendor_cert(struct mok_state_variable *v)
{
return (v->addend_source && v->addend_size &&
*v->addend_source && *v->addend_size) ? TRUE : FALSE;
}
#if defined(ENABLE_SHIM_CERT)
inline BOOLEAN check_build_cert(struct mok_state_variable *v)
{
return (v->build_cert && v->build_cert_size &&
*v->build_cert && *v->build_cert_size) ? TRUE : FALSE;
}
#define check_addend(v) (check_vendor_cert(v) || check_build_cert(v))
#else
#define check_addend(v) check_vendor_cert(v)
#endif /* defined(ENABLE_SHIM_CERT) */
static EFI_STATUS nonnull(1)
mirror_one_mok_variable(struct mok_state_variable *v)
{
@ -138,15 +162,27 @@ mirror_one_mok_variable(struct mok_state_variable *v)
UINTN FullDataSize = 0;
uint8_t *p = NULL;
if ((v->flags & MOK_MIRROR_KEYDB) &&
v->addend_source && *v->addend_source &&
v->addend_size && *v->addend_size) {
if ((v->flags & MOK_MIRROR_KEYDB) && check_addend(v)) {
EFI_SIGNATURE_LIST *CertList = NULL;
EFI_SIGNATURE_DATA *CertData = NULL;
#if defined(ENABLE_SHIM_CERT)
FullDataSize = v->data_size;
if (check_build_cert(v)) {
FullDataSize += sizeof (*CertList)
+ sizeof (EFI_GUID)
+ *v->build_cert_size;
}
if (check_vendor_cert(v)) {
FullDataSize += sizeof (*CertList)
+ sizeof (EFI_GUID)
+ *v->addend_size;
}
#else
FullDataSize = v->data_size
+ sizeof (*CertList)
+ sizeof (EFI_GUID)
+ *v->addend_size;
#endif /* defined(ENABLE_SHIM_CERT) */
FullData = AllocatePool(FullDataSize);
if (!FullData) {
perror(L"Failed to allocate space for MokListRT\n");
@ -158,6 +194,35 @@ mirror_one_mok_variable(struct mok_state_variable *v)
CopyMem(p, v->data, v->data_size);
p += v->data_size;
}
#if defined(ENABLE_SHIM_CERT)
if (check_build_cert(v) == FALSE)
goto skip_build_cert;
CertList = (EFI_SIGNATURE_LIST *)p;
p += sizeof (*CertList);
CertData = (EFI_SIGNATURE_DATA *)p;
p += sizeof (EFI_GUID);
CertList->SignatureType = EFI_CERT_TYPE_X509_GUID;
CertList->SignatureListSize = *v->build_cert_size
+ sizeof (*CertList)
+ sizeof (*CertData)
-1;
CertList->SignatureHeaderSize = 0;
CertList->SignatureSize = *v->build_cert_size +
sizeof (EFI_GUID);
CertData->SignatureOwner = SHIM_LOCK_GUID;
CopyMem(p, *v->build_cert, *v->build_cert_size);
p += *v->build_cert_size;
if (check_vendor_cert(v) == FALSE)
goto skip_vendor_cert;
skip_build_cert:
#endif /* defined(ENABLE_SHIM_CERT) */
CertList = (EFI_SIGNATURE_LIST *)p;
p += sizeof (*CertList);
CertData = (EFI_SIGNATURE_DATA *)p;
@ -174,6 +239,9 @@ mirror_one_mok_variable(struct mok_state_variable *v)
CertData->SignatureOwner = SHIM_LOCK_GUID;
CopyMem(p, *v->addend_source, *v->addend_size);
#if defined(ENABLE_SHIM_CERT)
skip_vendor_cert:
#endif /* defined(ENABLE_SHIM_CERT) */
if (v->data && v->data_size)
FreePool(v->data);
v->data = FullData;
@ -247,9 +315,7 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
UINT32 attrs = 0;
BOOLEAN delete = FALSE, present, addend;
addend = (v->addend_source && v->addend_size &&
*v->addend_source && *v->addend_size)
? TRUE : FALSE;
addend = check_addend(v);
efi_status = get_variable_attr(v->name,
&v->data, &v->data_size,