From 8f1bd605d05077a76502de5510cc937c4f4c62dd Mon Sep 17 00:00:00 2001 From: Mathieu Trudel-Lapierre Date: Mon, 11 Jan 2016 15:40:54 -0500 Subject: [PATCH] shim: mirror MokSBState in runtime so the kernel can make use of it. Signed-off-by: Mathieu Trudel-Lapierre --- shim.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/shim.c b/shim.c index c93d96d..f7841de 100644 --- a/shim.c +++ b/shim.c @@ -1828,6 +1828,33 @@ EFI_STATUS mirror_mok_list_x() return efi_status; } +/* + * Copy the boot-services only MokSBState variable to the runtime-accessible + * MokSBStateRT variable. It's not marked NV, so the OS can't modify it. + */ +EFI_STATUS mirror_mok_sb_state() +{ + EFI_GUID shim_lock_guid = SHIM_LOCK_GUID; + EFI_STATUS efi_status; + UINT8 *Data = NULL; + UINTN DataSize = 0; + + efi_status = get_variable(L"MokSBState", &Data, &DataSize, shim_lock_guid); + if (efi_status != EFI_SUCCESS) + return efi_status; + + efi_status = uefi_call_wrapper(RT->SetVariable, 5, L"MokSBStateRT", + &shim_lock_guid, + EFI_VARIABLE_BOOTSERVICE_ACCESS + | EFI_VARIABLE_RUNTIME_ACCESS, + DataSize, Data); + if (efi_status != EFI_SUCCESS) { + console_error(L"Failed to set MokSBStateRT", efi_status); + } + + return efi_status; +} + /* * Check if a variable exists */ @@ -2489,6 +2516,12 @@ efi_main (EFI_HANDLE passed_image_handle, EFI_SYSTEM_TABLE *passed_systab) efi_status = mirror_mok_list_x(); + /* + * Copy the MOK SB State to a runtime variable so the kernel can + * make use of it + */ + efi_status = mirror_mok_sb_state(); + /* * Create the runtime MokIgnoreDB variable so the kernel can * make use of it