proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-06-15 04:32:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

MokManager: Add more key list safe checks

Browse Source 
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
This commit is contained in:
Gary Ching-Pang Lin 2014-04-10 14:39:43 +08:00 committed by Peter Jones
parent ab9d755484
commit 7db9f7c71c
1 changed files with 56 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
MokManager.c
View File

@ -155,6 +155,12 @@ static UINT32 count_keys(void *Data, UINTN DataSize)
return 0; return 0;
} }
if (CertList->SignatureListSize == 0 ||
CertList->SignatureListSize <= CertList->SignatureSize) {
console_errorbox(L"Corrupted signature list");
return 0;
}
if (!is_valid_siglist(CertList->SignatureType, CertList->SignatureSize)) { if (!is_valid_siglist(CertList->SignatureType, CertList->SignatureSize)) {
dbsize -= CertList->SignatureListSize; dbsize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList +
@ -570,12 +576,13 @@ static EFI_STATUS list_keys (void *KeyList, UINTN KeyListSize, CHAR16 *title)
} }
MokNum = count_keys(KeyList, KeyListSize); MokNum = count_keys(KeyList, KeyListSize);
if (MokNum == 0) if (MokNum == 0) {
return 0; console_errorbox(L"Invalid key list");
return EFI_ABORTED;
}
keys = build_mok_list(MokNum, KeyList, KeyListSize); keys = build_mok_list(MokNum, KeyList, KeyListSize);
if (!keys) { if (!keys) {
console_notify(L"Failed to construct key list"); console_errorbox(L"Failed to construct key list");
return EFI_ABORTED; return EFI_ABORTED;
} }
@ -1222,7 +1229,13 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
efi_status = get_variable_attr (db_name, &MokListData, &MokListDataSize, efi_status = get_variable_attr (db_name, &MokListData, &MokListDataSize,
shim_lock_guid, &attributes); shim_lock_guid, &attributes);
if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) { if (efi_status != EFI_SUCCESS) {
if (MokX)
console_errorbox(L"Failed to retrieve MokListX");
else
console_errorbox(L"Failed to retrieve MokList");
return EFI_ABORTED;
} else if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
if (MokX) { if (MokX) {
err_str1 = L"MokListX is compromised!"; err_str1 = L"MokListX is compromised!";
err_str2 = L"Erase all keys in MokListX!"; err_str2 = L"Erase all keys in MokListX!";
@ -1231,7 +1244,11 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
err_str2 = L"Erase all keys in MokList!"; err_str2 = L"Erase all keys in MokList!";
} }
console_alertbox((CHAR16 *[]){err_str1, err_str2, NULL}); console_alertbox((CHAR16 *[]){err_str1, err_str2, NULL});
LibDeleteVariable(db_name, &shim_lock_guid); uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
return EFI_ACCESS_DENIED; return EFI_ACCESS_DENIED;
} }
@ -1241,9 +1258,41 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
/* Construct lists */ /* Construct lists */
mok_num = count_keys(MokListData, MokListDataSize); mok_num = count_keys(MokListData, MokListDataSize);
if (mok_num == 0) {
if (MokX) {
err_str1 = L"Failed to construct the key list of MokListX";
err_str2 = L"Reset MokListX!";
} else {
err_str1 = L"Failed to construct the key list of MokList";
err_str2 = L"Reset MokList!";
}
console_alertbox((CHAR16 *[]){err_str1, err_str2, NULL});
uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
efi_status = EFI_ABORTED;
goto error;
}
mok = build_mok_list(mok_num, MokListData, MokListDataSize); mok = build_mok_list(mok_num, MokListData, MokListDataSize);
if (!mok) {
console_errorbox(L"Failed to construct key list");
efi_status = EFI_ABORTED;
goto error;
}
del_num = count_keys(MokDel, MokDelSize); del_num = count_keys(MokDel, MokDelSize);
if (del_num == 0) {
console_errorbox(L"Invalid key delete list");
efi_status = EFI_ABORTED;
goto error;
}
del_key = build_mok_list(del_num, MokDel, MokDelSize); del_key = build_mok_list(del_num, MokDel, MokDelSize);
if (!del_key) {
console_errorbox(L"Failed to construct key list");
efi_status = EFI_ABORTED;
goto error;
}
/* Search and destroy */ /* Search and destroy */
for (i = 0; i < del_num; i++) { for (i = 0; i < del_num; i++) {
@ -1258,6 +1307,7 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
efi_status = write_back_mok_list(mok, mok_num, MokX); efi_status = write_back_mok_list(mok, mok_num, MokX);
error:
if (MokListData) if (MokListData)
FreePool(MokListData); FreePool(MokListData);
if (mok) if (mok)