From b8d1bc6e98e54f6fda87ba0a248de7cba5c78f96 Mon Sep 17 00:00:00 2001 From: Gary Ching-Pang Lin Date: Mon, 4 Nov 2013 14:45:33 +0800 Subject: [PATCH] Verify the EFI images with MOK blacklist Signed-off-by: Gary Ching-Pang Lin --- shim.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/shim.c b/shim.c index a2ca2a1..09db150 100644 --- a/shim.c +++ b/shim.c @@ -519,6 +519,7 @@ static EFI_STATUS check_blacklist (WIN_CERTIFICATE_EFI_PKCS *cert, UINT8 *sha256hash, UINT8 *sha1hash) { EFI_GUID secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; + EFI_GUID shim_var = SHIM_LOCK_GUID; EFI_SIGNATURE_LIST *dbx = (EFI_SIGNATURE_LIST *)vendor_dbx; if (check_db_hash_in_ram(dbx, vendor_dbx_size, sha256hash, @@ -542,6 +543,14 @@ static EFI_STATUS check_blacklist (WIN_CERTIFICATE_EFI_PKCS *cert, if (cert && check_db_cert(L"dbx", secure_var, cert, sha256hash) == DATA_FOUND) return EFI_ACCESS_DENIED; + if (check_db_hash(L"MokListX", shim_var, sha256hash, SHA256_DIGEST_SIZE, + EFI_CERT_SHA256_GUID) == DATA_FOUND) { + return EFI_ACCESS_DENIED; + } + if (cert && check_db_cert(L"MokListX", shim_var, cert, sha256hash) == + DATA_FOUND) { + return EFI_ACCESS_DENIED; + } return EFI_SUCCESS; }