proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-08-04 21:59:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Re-add whitelisting - needed for protocol validation

Browse Source
This commit is contained in:
Matthew Garrett 2012-07-05 16:39:25 -04:00
parent 041dd2b42a
commit b2058cf897
1 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
shim.c
View File

@ -314,6 +314,16 @@ static EFI_STATUS check_blacklist (WIN_CERTIFICATE_EFI_PKCS *cert, UINT8 *hash)
return EFI_SUCCESS;
}
static EFI_STATUS check_whitelist (WIN_CERTIFICATE_EFI_PKCS *cert, UINT8 *hash)
{
if (check_db_hash(L"db", hash) == DATA_FOUND)
return EFI_SUCCESS;
if (check_db_cert(L"db", cert, hash) == DATA_FOUND)
return EFI_SUCCESS;
return EFI_ACCESS_DENIED;
}
/*
* Check whether we're in Secure Boot and user mode
*/
@ -347,7 +357,7 @@ static BOOLEAN secure_mode (void)
* Check that the signature is valid and matches the binary
*/
static EFI_STATUS verify_buffer (char *data, int datasize,
PE_COFF_LOADER_IMAGE_CONTEXT *context)
PE_COFF_LOADER_IMAGE_CONTEXT *context, int whitelist)
{
unsigned int size = datasize;
unsigned int ctxsize;
@ -514,6 +524,15 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
goto done;
}
if (whitelist) {
status = check_whitelist(cert, hash);
if (status == EFI_SUCCESS) {
Print(L"Binary is whitelisted\n");
goto done;
}
}
if (!AuthenticodeVerify(cert->CertData,
context->SecDir->Size - sizeof(cert->Hdr),
vendor_cert, sizeof(vendor_cert), hash,
@ -603,7 +622,7 @@ static EFI_STATUS handle_grub (void *data, int datasize)
}
if (secure_mode ()) {
efi_status = verify_buffer(data, datasize, &context);
efi_status = verify_buffer(data, datasize, &context, 0);
if (efi_status != EFI_SUCCESS) {
Print(L"Verification failed\n");
@ -869,7 +888,7 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
if (status != EFI_SUCCESS)
return status;
status = verify_buffer(buffer, size, &context);
status = verify_buffer(buffer, size, &context, 1);
return status;
}