proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-06-14 11:10:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't have tons of local guid definitions for no reason at all.

Browse Source 
Signed-off-by: Peter Jones <pjones@redhat.com>
This commit is contained in:
Peter Jones 2017-10-19 14:43:18 -04:00 committed by Peter Jones
parent 4d70f10481
commit b953468e91
17 changed files with 236 additions and 348 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

200
MokManager.c
View File

@ -19,11 +19,6 @@
#define SHIM_VENDOR L"Shim"
#endif
EFI_GUID SHIM_LOCK_GUID = { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} };
EFI_GUID EFI_CERT_SHA224_GUID = { 0xb6e5233, 0xa65c, 0x44c9, {0x94, 0x7, 0xd9, 0xab, 0x83, 0xbf, 0xc8, 0xbd} };
EFI_GUID EFI_CERT_SHA384_GUID = { 0xff3e5307, 0x9fd0, 0x48c9, {0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x1} };
EFI_GUID EFI_CERT_SHA512_GUID = { 0x93e0fae, 0xa6c4, 0x4f50, {0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a} };
#define CERT_STRING L"Select an X509 certificate to enroll:\n\n"
#define HASH_STRING L"Select a file to trust:\n\n"
@ -93,18 +88,13 @@ done:
static BOOLEAN is_sha2_hash (EFI_GUID Type)
{
EFI_GUID Sha224 = EFI_CERT_SHA224_GUID;
EFI_GUID Sha256 = EFI_CERT_SHA256_GUID;
EFI_GUID Sha384 = EFI_CERT_SHA384_GUID;
EFI_GUID Sha512 = EFI_CERT_SHA512_GUID;
if (CompareGuid(&Type, &Sha224) == 0)
if (CompareGuid(&Type, &EFI_CERT_SHA224_GUID) == 0)
return TRUE;
else if (CompareGuid(&Type, &Sha256) == 0)
else if (CompareGuid(&Type, &EFI_CERT_SHA256_GUID) == 0)
return TRUE;
else if (CompareGuid(&Type, &Sha384) == 0)
else if (CompareGuid(&Type, &EFI_CERT_SHA384_GUID) == 0)
return TRUE;
else if (CompareGuid(&Type, &Sha512) == 0)
else if (CompareGuid(&Type, &EFI_CERT_SHA512_GUID) == 0)
return TRUE;
return FALSE;
@ -112,21 +102,15 @@ static BOOLEAN is_sha2_hash (EFI_GUID Type)
static UINT32 sha_size (EFI_GUID Type)
{
EFI_GUID Sha1 = EFI_CERT_SHA1_GUID;
EFI_GUID Sha224 = EFI_CERT_SHA224_GUID;
EFI_GUID Sha256 = EFI_CERT_SHA256_GUID;
EFI_GUID Sha384 = EFI_CERT_SHA384_GUID;
EFI_GUID Sha512 = EFI_CERT_SHA512_GUID;
if (CompareGuid(&Type, &Sha1) == 0)
if (CompareGuid(&Type, &EFI_CERT_SHA1_GUID) == 0)
return SHA1_DIGEST_SIZE;
else if (CompareGuid(&Type, &Sha224) == 0)
else if (CompareGuid(&Type, &EFI_CERT_SHA224_GUID) == 0)
return SHA224_DIGEST_LENGTH;
else if (CompareGuid(&Type, &Sha256) == 0)
else if (CompareGuid(&Type, &EFI_CERT_SHA256_GUID) == 0)
return SHA256_DIGEST_SIZE;
else if (CompareGuid(&Type, &Sha384) == 0)
else if (CompareGuid(&Type, &EFI_CERT_SHA384_GUID) == 0)
return SHA384_DIGEST_LENGTH;
else if (CompareGuid(&Type, &Sha512) == 0)
else if (CompareGuid(&Type, &EFI_CERT_SHA512_GUID) == 0)
return SHA512_DIGEST_LENGTH;
return 0;
@ -134,10 +118,9 @@ static UINT32 sha_size (EFI_GUID Type)
static BOOLEAN is_valid_siglist (EFI_GUID Type, UINT32 SigSize)
{
EFI_GUID CertType = X509_GUID;
UINT32 hash_sig_size;
if (CompareGuid (&Type, &CertType) == 0 && SigSize != 0)
if (CompareGuid (&Type, &X509_GUID) == 0 && SigSize != 0)
return TRUE;
if (!is_sha2_hash (Type))
@ -191,7 +174,6 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
MokListNode *list;
EFI_SIGNATURE_LIST *CertList = Data;
EFI_SIGNATURE_DATA *Cert;
EFI_GUID CertType = X509_GUID;
UINTN dbsize = DataSize;
UINTN count = 0;
void *end = Data + DataSize;
@ -223,7 +205,7 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
}
list[count].Type = CertList->SignatureType;
if (CompareGuid (&CertList->SignatureType, &CertType) == 0) {
if (CompareGuid (&CertList->SignatureType, &X509_GUID) == 0) {
list[count].MokSize = CertList->SignatureSize -
sizeof(EFI_GUID);
list[count].Mok = (void *)Cert->SignatureData;
@ -472,30 +454,25 @@ static void show_x509_info (X509 *X509Cert, UINT8 *hash)
static void show_sha_digest (EFI_GUID Type, UINT8 *hash)
{
EFI_GUID Sha1 = EFI_CERT_SHA1_GUID;
EFI_GUID Sha224 = EFI_CERT_SHA224_GUID;
EFI_GUID Sha256 = EFI_CERT_SHA256_GUID;
EFI_GUID Sha384 = EFI_CERT_SHA384_GUID;
EFI_GUID Sha512 = EFI_CERT_SHA512_GUID;
CHAR16 *text[5];
POOL_PRINT hash_string1;
POOL_PRINT hash_string2;
int i;
int length;
if (CompareGuid(&Type, &Sha1) == 0) {
if (CompareGuid(&Type, &EFI_CERT_SHA1_GUID) == 0) {
length = SHA1_DIGEST_SIZE;
text[0] = L"SHA1 hash";
} else if (CompareGuid(&Type, &Sha224) == 0) {
} else if (CompareGuid(&Type, &EFI_CERT_SHA224_GUID) == 0) {
length = SHA224_DIGEST_LENGTH;
text[0] = L"SHA224 hash";
} else if (CompareGuid(&Type, &Sha256) == 0) {
} else if (CompareGuid(&Type, &EFI_CERT_SHA256_GUID) == 0) {
length = SHA256_DIGEST_SIZE;
text[0] = L"SHA256 hash";
} else if (CompareGuid(&Type, &Sha384) == 0) {
} else if (CompareGuid(&Type, &EFI_CERT_SHA384_GUID) == 0) {
length = SHA384_DIGEST_LENGTH;
text[0] = L"SHA384 hash";
} else if (CompareGuid(&Type, &Sha512) == 0) {
} else if (CompareGuid(&Type, &EFI_CERT_SHA512_GUID) == 0) {
length = SHA512_DIGEST_LENGTH;
text[0] = L"SHA512 hash";
} else {
@ -578,12 +555,11 @@ static void show_efi_hash (EFI_GUID Type, void *Mok, UINTN MokSize)
static void show_mok_info (EFI_GUID Type, void *Mok, UINTN MokSize)
{
EFI_STATUS efi_status;
EFI_GUID CertType = X509_GUID;
if (!Mok || MokSize == 0)
return;
if (CompareGuid (&Type, &CertType) == 0) {
if (CompareGuid (&Type, &X509_GUID) == 0) {
UINT8 hash[SHA1_DIGEST_SIZE];
X509 *X509Cert;
efi_status = get_sha1sum(Mok, MokSize, hash);
@ -893,7 +869,6 @@ static EFI_STATUS match_password (PASSWORD_CRYPT *pw_crypt,
static EFI_STATUS write_db (CHAR16 *db_name, void *MokNew, UINTN MokNewSize)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS status;
UINT32 attributes;
void *old_data = NULL;
@ -902,7 +877,7 @@ static EFI_STATUS write_db (CHAR16 *db_name, void *MokNew, UINTN MokNewSize)
UINTN new_size;
status = uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_APPEND_WRITE,
@ -912,7 +887,7 @@ static EFI_STATUS write_db (CHAR16 *db_name, void *MokNew, UINTN MokNewSize)
}
status = get_variable_attr(db_name, (UINT8 **)&old_data, &old_size,
shim_lock_guid, &attributes);
SHIM_LOCK_GUID, &attributes);
if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
return status;
}
@ -935,7 +910,7 @@ static EFI_STATUS write_db (CHAR16 *db_name, void *MokNew, UINTN MokNewSize)
CopyMem(new_data + old_size, MokNew, MokNewSize);
status = uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS,
new_size, new_data);
@ -955,7 +930,6 @@ out:
static EFI_STATUS store_keys (void *MokNew, UINTN MokNewSize, int authenticate,
BOOLEAN MokX)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
CHAR16 *db_name;
CHAR16 *auth_name;
@ -973,7 +947,7 @@ static EFI_STATUS store_keys (void *MokNew, UINTN MokNewSize, int authenticate,
if (authenticate) {
efi_status = uefi_call_wrapper(RT->GetVariable, 5, auth_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
&attributes, &auth_size, auth);
if (efi_status != EFI_SUCCESS ||
@ -1000,7 +974,7 @@ static EFI_STATUS store_keys (void *MokNew, UINTN MokNewSize, int authenticate,
if (!MokNewSize) {
/* Delete MOK */
efi_status = uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
@ -1020,7 +994,6 @@ static EFI_STATUS store_keys (void *MokNew, UINTN MokNewSize, int authenticate,
static EFI_STATUS mok_enrollment_prompt (void *MokNew, UINTN MokNewSize, int auth,
BOOLEAN MokX)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
CHAR16 *title;
@ -1045,11 +1018,11 @@ static EFI_STATUS mok_enrollment_prompt (void *MokNew, UINTN MokNewSize, int aut
if (auth) {
if (MokX) {
LibDeleteVariable(L"MokXNew", &shim_lock_guid);
LibDeleteVariable(L"MokXAuth", &shim_lock_guid);
LibDeleteVariable(L"MokXNew", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokXAuth", &SHIM_LOCK_GUID);
} else {
LibDeleteVariable(L"MokNew", &shim_lock_guid);
LibDeleteVariable(L"MokAuth", &shim_lock_guid);
LibDeleteVariable(L"MokNew", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokAuth", &SHIM_LOCK_GUID);
}
}
@ -1061,7 +1034,6 @@ static EFI_STATUS mok_enrollment_prompt (void *MokNew, UINTN MokNewSize, int aut
static EFI_STATUS mok_reset_prompt (BOOLEAN MokX)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
CHAR16 *prompt;
@ -1082,11 +1054,11 @@ static EFI_STATUS mok_reset_prompt (BOOLEAN MokX)
}
if (MokX) {
LibDeleteVariable(L"MokXNew", &shim_lock_guid);
LibDeleteVariable(L"MokXAuth", &shim_lock_guid);
LibDeleteVariable(L"MokXNew", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokXAuth", &SHIM_LOCK_GUID);
} else {
LibDeleteVariable(L"MokNew", &shim_lock_guid);
LibDeleteVariable(L"MokAuth", &shim_lock_guid);
LibDeleteVariable(L"MokNew", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokAuth", &SHIM_LOCK_GUID);
}
return EFI_SUCCESS;
@ -1095,8 +1067,6 @@ static EFI_STATUS mok_reset_prompt (BOOLEAN MokX)
static EFI_STATUS write_back_mok_list (MokListNode *list, INTN key_num,
BOOLEAN MokX)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_GUID CertType = X509_GUID;
EFI_STATUS efi_status;
EFI_SIGNATURE_LIST *CertList;
EFI_SIGNATURE_DATA *CertData;
@ -1115,7 +1085,7 @@ static EFI_STATUS write_back_mok_list (MokListNode *list, INTN key_num,
continue;
DataSize += sizeof(EFI_SIGNATURE_LIST);
if (CompareGuid(&(list[i].Type), &CertType) == 0)
if (CompareGuid(&(list[i].Type), &X509_GUID) == 0)
DataSize += sizeof(EFI_GUID);
DataSize += list[i].MokSize;
}
@ -1137,13 +1107,13 @@ static EFI_STATUS write_back_mok_list (MokListNode *list, INTN key_num,
CertList->SignatureType = list[i].Type;
CertList->SignatureHeaderSize = 0;
if (CompareGuid(&(list[i].Type), &CertType) == 0) {
if (CompareGuid(&(list[i].Type), &X509_GUID) == 0) {
CertList->SignatureListSize = list[i].MokSize +
sizeof(EFI_SIGNATURE_LIST) +
sizeof(EFI_GUID);
CertList->SignatureSize = list[i].MokSize + sizeof(EFI_GUID);
CertData->SignatureOwner = shim_lock_guid;
CertData->SignatureOwner = SHIM_LOCK_GUID;
CopyMem(CertData->SignatureData, list[i].Mok, list[i].MokSize);
} else {
CertList->SignatureListSize = list[i].MokSize +
@ -1156,7 +1126,7 @@ static EFI_STATUS write_back_mok_list (MokListNode *list, INTN key_num,
}
efi_status = uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS,
DataSize, Data);
@ -1174,11 +1144,10 @@ static EFI_STATUS write_back_mok_list (MokListNode *list, INTN key_num,
static void delete_cert (void *key, UINT32 key_size,
MokListNode *mok, INTN mok_num)
{
EFI_GUID CertType = X509_GUID;
int i;
for (i = 0; i < mok_num; i++) {
if (CompareGuid(&(mok[i].Type), &CertType) != 0)
if (CompareGuid(&(mok[i].Type), &X509_GUID) != 0)
continue;
if (mok[i].MokSize == key_size &&
@ -1285,8 +1254,6 @@ static void delete_hash_list (EFI_GUID Type, void *hash_list, UINT32 list_size,
static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_GUID CertType = X509_GUID;
EFI_STATUS efi_status;
CHAR16 *db_name;
CHAR16 *auth_name;
@ -1310,7 +1277,7 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
}
efi_status = uefi_call_wrapper(RT->GetVariable, 5, auth_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
&attributes, &auth_size, auth);
if (efi_status != EFI_SUCCESS ||
@ -1332,7 +1299,7 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
return EFI_ACCESS_DENIED;
efi_status = get_variable_attr (db_name, &MokListData, &MokListDataSize,
shim_lock_guid, &attributes);
SHIM_LOCK_GUID, &attributes);
if (efi_status != EFI_SUCCESS) {
if (MokX)
console_errorbox(L"Failed to retrieve MokListX");
@ -1349,7 +1316,7 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
}
console_alertbox((CHAR16 *[]){err_str1, err_str2, NULL});
uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
@ -1372,7 +1339,7 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
}
console_alertbox((CHAR16 *[]){err_str1, err_str2, NULL});
uefi_call_wrapper(RT->SetVariable, 5, db_name,
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
@ -1400,7 +1367,7 @@ static EFI_STATUS delete_keys (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
/* Search and destroy */
for (i = 0; i < del_num; i++) {
if (CompareGuid(&(del_key[i].Type), &CertType) == 0) {
if (CompareGuid(&(del_key[i].Type), &X509_GUID) == 0) {
delete_cert(del_key[i].Mok, del_key[i].MokSize,
mok, mok_num);
} else if (is_sha2_hash(del_key[i].Type)) {
@ -1424,7 +1391,6 @@ error:
static EFI_STATUS mok_deletion_prompt (void *MokDel, UINTN MokDelSize, BOOLEAN MokX)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
CHAR16 *title;
@ -1448,11 +1414,11 @@ static EFI_STATUS mok_deletion_prompt (void *MokDel, UINTN MokDelSize, BOOLEAN M
}
if (MokX) {
LibDeleteVariable(L"MokXDel", &shim_lock_guid);
LibDeleteVariable(L"MokXDelAuth", &shim_lock_guid);
LibDeleteVariable(L"MokXDel", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokXDelAuth", &SHIM_LOCK_GUID);
} else {
LibDeleteVariable(L"MokDel", &shim_lock_guid);
LibDeleteVariable(L"MokDelAuth", &shim_lock_guid);
LibDeleteVariable(L"MokDel", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokDelAuth", &SHIM_LOCK_GUID);
}
if (MokDel)
@ -1489,7 +1455,6 @@ static CHAR16 get_password_charater (CHAR16 *prompt)
}
static EFI_STATUS mok_sb_prompt (void *MokSB, UINTN MokSBSize) {
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
SIMPLE_TEXT_OUTPUT_MODE SavedMode;
MokSBvar *var = MokSB;
@ -1574,14 +1539,14 @@ static EFI_STATUS mok_sb_prompt (void *MokSB, UINTN MokSBSize) {
ret = console_yes_no((CHAR16 *[]){L"Enable Secure Boot", NULL});
if (ret == 0) {
LibDeleteVariable(L"MokSB", &shim_lock_guid);
LibDeleteVariable(L"MokSB", &SHIM_LOCK_GUID);
return EFI_ABORTED;
}
if (var->MokSBState == 0) {
efi_status = uefi_call_wrapper(RT->SetVariable,
5, L"MokSBState",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
1, &sbval);
@ -1592,7 +1557,7 @@ static EFI_STATUS mok_sb_prompt (void *MokSB, UINTN MokSBSize) {
} else {
efi_status = uefi_call_wrapper(RT->SetVariable,
5, L"MokSBState",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
@ -1609,7 +1574,6 @@ static EFI_STATUS mok_sb_prompt (void *MokSB, UINTN MokSBSize) {
}
static EFI_STATUS mok_db_prompt (void *MokDB, UINTN MokDBSize) {
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
SIMPLE_TEXT_OUTPUT_MODE SavedMode;
MokDBvar *var = MokDB;
@ -1694,14 +1658,14 @@ static EFI_STATUS mok_db_prompt (void *MokDB, UINTN MokDBSize) {
ret = console_yes_no((CHAR16 *[]){L"Use DB certs/hashes", NULL});
if (ret == 0) {
LibDeleteVariable(L"MokDB", &shim_lock_guid);
LibDeleteVariable(L"MokDB", &SHIM_LOCK_GUID);
return EFI_ABORTED;
}
if (var->MokDBState == 0) {
efi_status = uefi_call_wrapper(RT->SetVariable,
5, L"MokDBState",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
1, &dbval);
@ -1712,7 +1676,7 @@ static EFI_STATUS mok_db_prompt (void *MokDB, UINTN MokDBSize) {
} else {
efi_status = uefi_call_wrapper(RT->SetVariable, 5,
L"MokDBState",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
@ -1729,7 +1693,6 @@ static EFI_STATUS mok_db_prompt (void *MokDB, UINTN MokDBSize) {
}
static EFI_STATUS mok_pw_prompt (void *MokPW, UINTN MokPWSize) {
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
UINT8 hash[PASSWORD_CRYPT_SIZE];
UINT8 clear = 0;
@ -1756,7 +1719,7 @@ static EFI_STATUS mok_pw_prompt (void *MokPW, UINTN MokPWSize) {
return EFI_ABORTED;
uefi_call_wrapper(RT->SetVariable, 5, L"MokPWStore",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS,
0, NULL);
@ -1781,7 +1744,7 @@ static EFI_STATUS mok_pw_prompt (void *MokPW, UINTN MokPWSize) {
efi_status = uefi_call_wrapper(RT->SetVariable, 5,
L"MokPWStore",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS,
MokPWSize, MokPW);
@ -1791,7 +1754,7 @@ static EFI_STATUS mok_pw_prompt (void *MokPW, UINTN MokPWSize) {
}
mokpw_done:
LibDeleteVariable(L"MokPW", &shim_lock_guid);
LibDeleteVariable(L"MokPW", &SHIM_LOCK_GUID);
if (MokPW)
FreePool(MokPW);
@ -1837,7 +1800,6 @@ static BOOLEAN verify_certificate(UINT8 *cert, UINTN size)
static EFI_STATUS enroll_file (void *data, UINTN datasize, BOOLEAN hash)
{
EFI_STATUS status = EFI_SUCCESS;
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_SIGNATURE_LIST *CertList;
EFI_SIGNATURE_DATA *CertData;
UINTN mokbuffersize;
@ -1847,11 +1809,10 @@ static EFI_STATUS enroll_file (void *data, UINTN datasize, BOOLEAN hash)
UINT8 sha256[SHA256_DIGEST_SIZE];
UINT8 sha1[SHA1_DIGEST_SIZE];
SHIM_LOCK *shim_lock;
EFI_GUID shim_guid = SHIM_LOCK_GUID;
PE_COFF_LOADER_IMAGE_CONTEXT context;
status = LibLocateProtocol(&shim_guid, (VOID **)&shim_lock);
status = LibLocateProtocol(&SHIM_LOCK_GUID,
(VOID **) &shim_lock);
if (status != EFI_SUCCESS)
goto out;
@ -1901,7 +1862,7 @@ static EFI_STATUS enroll_file (void *data, UINTN datasize, BOOLEAN hash)
CertList->SignatureListSize = mokbuffersize;
CertList->SignatureHeaderSize = 0;
CertData->SignatureOwner = shim_lock_guid;
CertData->SignatureOwner = SHIM_LOCK_GUID;
if (!hash) {
if (!verify_certificate(CertData->SignatureData, datasize))
@ -2043,7 +2004,6 @@ static EFI_STATUS mok_key_enroll(void)
static BOOLEAN verify_pw(BOOLEAN *protected)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
SIMPLE_TEXT_OUTPUT_MODE SavedMode;
UINT8 pwhash[PASSWORD_CRYPT_SIZE];
@ -2054,7 +2014,7 @@ static BOOLEAN verify_pw(BOOLEAN *protected)
*protected = FALSE;
efi_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokPWStore",
&shim_lock_guid, &attributes, &size,
&SHIM_LOCK_GUID, &attributes, &size,
pwhash);
/*
@ -2182,7 +2142,6 @@ static EFI_STATUS enter_mok_menu(EFI_HANDLE image_handle,
int choice = 0;
int mok_changed = 0;
EFI_STATUS efi_status;
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
UINT8 auth[PASSWORD_CRYPT_SIZE];
UINTN auth_size = PASSWORD_CRYPT_SIZE;
UINT32 attributes;
@ -2203,7 +2162,7 @@ static EFI_STATUS enter_mok_menu(EFI_HANDLE image_handle,
UINT32 MokXDelAuth = 0;
efi_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokAuth",
&shim_lock_guid,
&SHIM_LOCK_GUID,
&attributes, &auth_size, auth);
if ((efi_status == EFI_SUCCESS) &&
@ -2211,7 +2170,7 @@ static EFI_STATUS enter_mok_menu(EFI_HANDLE image_handle,
MokAuth = 1;
efi_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokDelAuth",
&shim_lock_guid,
&SHIM_LOCK_GUID,
&attributes, &auth_size, auth);
if ((efi_status == EFI_SUCCESS) &&
@ -2219,7 +2178,7 @@ static EFI_STATUS enter_mok_menu(EFI_HANDLE image_handle,
MokDelAuth = 1;
efi_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokXAuth",
&shim_lock_guid,
&SHIM_LOCK_GUID,
&attributes, &auth_size, auth);
if ((efi_status == EFI_SUCCESS) &&
@ -2227,7 +2186,7 @@ static EFI_STATUS enter_mok_menu(EFI_HANDLE image_handle,
MokXAuth = 1;
efi_status = uefi_call_wrapper(RT->GetVariable, 5, L"MokXDelAuth",
&shim_lock_guid,
&SHIM_LOCK_GUID,
&attributes, &auth_size, auth);
if ((efi_status == EFI_SUCCESS) &&
@ -2414,7 +2373,6 @@ out:
static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
UINTN MokNewSize = 0, MokDelSize = 0, MokSBSize = 0, MokPWSize = 0;
UINTN MokDBSize = 0, MokXNewSize = 0, MokXDelSize = 0;
void *MokNew = NULL;
@ -2427,9 +2385,9 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
EFI_STATUS status;
status = get_variable(L"MokNew", (UINT8 **)&MokNew, &MokNewSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (status == EFI_SUCCESS) {
if (LibDeleteVariable(L"MokNew", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokNew", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
console_notify(L"Failed to delete MokNew");
}
} else if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
@ -2437,9 +2395,9 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
}
status = get_variable(L"MokDel", (UINT8 **)&MokDel, &MokDelSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (status == EFI_SUCCESS) {
if (LibDeleteVariable(L"MokDel", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokDel", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
console_notify(L"Failed to delete MokDel");
}
} else if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
@ -2447,9 +2405,9 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
}
status = get_variable(L"MokSB", (UINT8 **)&MokSB, &MokSBSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (status == EFI_SUCCESS) {
if (LibDeleteVariable(L"MokSB", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokSB", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
console_notify(L"Failed to delete MokSB");
}
} else if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
@ -2457,9 +2415,9 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
}
status = get_variable(L"MokPW", (UINT8 **)&MokPW, &MokPWSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (status == EFI_SUCCESS) {
if (LibDeleteVariable(L"MokPW", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokPW", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
console_notify(L"Failed to delete MokPW");
}
} else if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
@ -2467,9 +2425,9 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
}
status = get_variable(L"MokDB", (UINT8 **)&MokDB, &MokDBSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (status == EFI_SUCCESS) {
if (LibDeleteVariable(L"MokDB", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokDB", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
console_notify(L"Failed to delete MokDB");
}
} else if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
@ -2477,9 +2435,9 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
}
status = get_variable(L"MokXNew", (UINT8 **)&MokXNew, &MokXNewSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (status == EFI_SUCCESS) {
if (LibDeleteVariable(L"MokXNew", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokXNew", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
console_notify(L"Failed to delete MokXNew");
}
} else if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
@ -2487,9 +2445,9 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
}
status = get_variable(L"MokXDel", (UINT8 **)&MokXDel, &MokXDelSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (status == EFI_SUCCESS) {
if (LibDeleteVariable(L"MokXDel", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokXDel", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
console_notify(L"Failed to delete MokXDel");
}
} else if (EFI_ERROR(status) && status != EFI_NOT_FOUND) {
@ -2521,10 +2479,10 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
if (MokXDel)
FreePool (MokXDel);
LibDeleteVariable(L"MokAuth", &shim_lock_guid);
LibDeleteVariable(L"MokDelAuth", &shim_lock_guid);
LibDeleteVariable(L"MokXAuth", &shim_lock_guid);
LibDeleteVariable(L"MokXDelAuth", &shim_lock_guid);
LibDeleteVariable(L"MokAuth", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokDelAuth", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokXAuth", &SHIM_LOCK_GUID);
LibDeleteVariable(L"MokXDelAuth", &SHIM_LOCK_GUID);
return EFI_SUCCESS;
}

45
fallback.c
View File

@ -10,18 +10,13 @@
#include <efi.h>
#include <efilib.h>
#include "ucs2.h"
#include "variables.h"
#include "tpm.h"
#include "shim.h"
EFI_LOADED_IMAGE *this_image = NULL;
EFI_GUID SHIM_LOCK_GUID = { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} };
int
get_fallback_verbose(void)
{
EFI_GUID guid = SHIM_LOCK_GUID;
UINT8 *data = NULL;
UINTN dataSize = 0;
EFI_STATUS efi_status;
@ -32,7 +27,7 @@ get_fallback_verbose(void)
return state;
efi_status = get_variable(L"FALLBACK_VERBOSE",
&data, &dataSize, guid);
&data, &dataSize, SHIM_LOCK_GUID);
if (EFI_ERROR(efi_status)) {
state = 0;
return state;
@ -103,18 +98,17 @@ get_file_size(EFI_FILE_HANDLE fh, UINTN *retsize)
EFI_STATUS rc;
void *buffer = NULL;
UINTN bs = 0;
EFI_GUID finfo = EFI_FILE_INFO_ID;
/* The API here is "Call it once with bs=0, it fills in bs,
* then allocate a buffer and ask again to get it filled. */
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &finfo, &bs, NULL);
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &EFI_FILE_INFO_GUID, &bs, NULL);
if (rc == EFI_BUFFER_TOO_SMALL) {
buffer = AllocateZeroPool(bs);
if (!buffer) {
Print(L"Could not allocate memory\n");
return EFI_OUT_OF_RESOURCES;
}
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &finfo,
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &EFI_FILE_INFO_GUID,
&bs, buffer);
}
/* This checks *either* the error from the first GetInfo, if it isn't
@ -210,7 +204,6 @@ add_boot_option(EFI_DEVICE_PATH *hddp, EFI_DEVICE_PATH *fulldp,
static int i = 0;
CHAR16 varname[] = L"Boot0000";
CHAR16 hexmap[] = L"0123456789ABCDEF";
EFI_GUID global = EFI_GLOBAL_VARIABLE;
EFI_STATUS rc;
for(; i <= 0xffff; i++) {
@ -219,7 +212,7 @@ add_boot_option(EFI_DEVICE_PATH *hddp, EFI_DEVICE_PATH *fulldp,
varname[6] = hexmap[(i & 0x00f0) >> 4];
varname[7] = hexmap[(i & 0x000f) >> 0];
void *var = LibGetVariable(varname, &global);
void *var = LibGetVariable(varname, &GV_GUID);
if (!var) {
int size = sizeof(UINT32) + sizeof (UINT16) +
StrLen(label)*2 + 2 + DevicePathSize(hddp) +
@ -248,9 +241,9 @@ add_boot_option(EFI_DEVICE_PATH *hddp, EFI_DEVICE_PATH *fulldp,
}
rc = uefi_call_wrapper(RT->SetVariable, 5, varname,
&global, EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS,
&GV_GUID, EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS,
size, data);
FreePool(data);
@ -412,7 +405,6 @@ find_boot_option(EFI_DEVICE_PATH *dp, EFI_DEVICE_PATH *fulldp,
int i = 0;
CHAR16 varname[] = L"Boot0000";
CHAR16 hexmap[] = L"0123456789ABCDEF";
EFI_GUID global = EFI_GLOBAL_VARIABLE;
EFI_STATUS rc;
UINTN max_candidate_size = calc_masked_boot_option_size(size);
@ -429,7 +421,7 @@ find_boot_option(EFI_DEVICE_PATH *dp, EFI_DEVICE_PATH *fulldp,
varname[7] = hexmap[(bootorder[i] & 0x000f) >> 0];
UINTN candidate_size = max_candidate_size;
rc = uefi_call_wrapper(RT->GetVariable, 5, varname, &global,
rc = uefi_call_wrapper(RT->GetVariable, 5, varname, &GV_GUID,
NULL, &candidate_size, candidate);
if (EFI_ERROR(rc))
continue;
@ -466,9 +458,8 @@ set_boot_order(void)
{
CHAR16 *oldbootorder;
UINTN size;
EFI_GUID global = EFI_GLOBAL_VARIABLE;
oldbootorder = LibGetVariableAndSize(L"BootOrder", &global, &size);
oldbootorder = LibGetVariableAndSize(L"BootOrder", &GV_GUID, &size);
if (oldbootorder) {
nbootorder = size / sizeof (CHAR16);
bootorder = oldbootorder;
@ -482,7 +473,6 @@ update_boot_order(void)
{
UINTN size;
UINTN len = 0;
EFI_GUID global = EFI_GLOBAL_VARIABLE;
CHAR16 *newbootorder = NULL;
EFI_STATUS rc;
@ -497,12 +487,12 @@ update_boot_order(void)
for (j = 0 ; j < size / sizeof (CHAR16); j++)
VerbosePrintUnprefixed(L"%04x ", newbootorder[j]);
Print(L"\n");
rc = uefi_call_wrapper(RT->GetVariable, 5, L"BootOrder", &global,
rc = uefi_call_wrapper(RT->GetVariable, 5, L"BootOrder", &GV_GUID,
NULL, &len, NULL);
if (rc == EFI_BUFFER_TOO_SMALL)
LibDeleteVariable(L"BootOrder", &global);
LibDeleteVariable(L"BootOrder", &GV_GUID);
rc = uefi_call_wrapper(RT->SetVariable, 5, L"BootOrder", &global,
rc = uefi_call_wrapper(RT->SetVariable, 5, L"BootOrder", &GV_GUID,
EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS,
@ -688,18 +678,17 @@ find_boot_csv(EFI_FILE_HANDLE fh, CHAR16 *dirname)
EFI_STATUS rc;
void *buffer = NULL;
UINTN bs = 0;
EFI_GUID finfo = EFI_FILE_INFO_ID;
/* The API here is "Call it once with bs=0, it fills in bs,
* then allocate a buffer and ask again to get it filled. */
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &finfo, &bs, NULL);
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &EFI_FILE_INFO_GUID, &bs, NULL);
if (rc == EFI_BUFFER_TOO_SMALL) {
buffer = AllocateZeroPool(bs);
if (!buffer) {
Print(L"Could not allocate memory\n");
return EFI_OUT_OF_RESOURCES;
}
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &finfo,
rc = uefi_call_wrapper(fh->GetInfo, 4, fh, &EFI_FILE_INFO_GUID,
&bs, buffer);
}
/* This checks *either* the error from the first GetInfo, if it isn't
@ -960,14 +949,14 @@ static void
__attribute__((__optimize__("0")))
debug_hook(void)
{
EFI_GUID guid = SHIM_LOCK_GUID;
UINT8 *data = NULL;
UINTN dataSize = 0;
EFI_STATUS efi_status;
volatile register int x = 0;
extern char _etext, _edata;
efi_status = get_variable(L"SHIM_DEBUG", &data, &dataSize, guid);
efi_status = get_variable(L"SHIM_DEBUG", &data, &dataSize,
SHIM_LOCK_GUID);
if (EFI_ERROR(efi_status)) {
return;
}

23
httpboot.c
View File

@ -254,7 +254,6 @@ extract_hostname (CONST CHAR8 *url, CHAR8 **hostname)
static EFI_HANDLE
get_nic_handle (EFI_MAC_ADDRESS *mac)
{
EFI_GUID http_binding_guid = EFI_HTTP_SERVICE_BINDING_PROTOCOL_GUID;
EFI_DEVICE_PATH *unpacked = NULL;
EFI_DEVICE_PATH *Node;
EFI_DEVICE_PATH *temp_path = NULL;
@ -269,7 +268,7 @@ get_nic_handle (EFI_MAC_ADDRESS *mac)
protocol */
status = uefi_call_wrapper(BS->LocateHandleBuffer, 5,
ByProtocol,
&http_binding_guid,
&EFI_HTTP_BINDING_GUID,
NULL,
&NoHandles,
&buffer);
@ -325,16 +324,13 @@ is_unspecified_addr (EFI_IPv6_ADDRESS ip6)
static EFI_STATUS
set_ip6(EFI_HANDLE *nic, IPv6_DEVICE_PATH *ip6node)
{
EFI_GUID ip6_config_guid = EFI_IP6_CONFIG_PROTOCOL_GUID;
EFI_IP6_CONFIG_PROTOCOL *ip6cfg;
EFI_IP6_CONFIG_MANUAL_ADDRESS ip6;
EFI_IPv6_ADDRESS gateway;
EFI_STATUS status;
status = uefi_call_wrapper(BS->HandleProtocol, 3,
nic,
&ip6_config_guid,
(VOID **)&ip6cfg);
status = uefi_call_wrapper(BS->HandleProtocol, 3, nic,
&EFI_IP6_CONFIG_GUID, (VOID **)&ip6cfg);
if (EFI_ERROR (status))
return status;
@ -367,16 +363,13 @@ set_ip6(EFI_HANDLE *nic, IPv6_DEVICE_PATH *ip6node)
static EFI_STATUS
set_ip4(EFI_HANDLE *nic, IPv4_DEVICE_PATH *ip4node)
{
EFI_GUID ip4_config2_guid = EFI_IP4_CONFIG2_PROTOCOL_GUID;
EFI_IP4_CONFIG2_PROTOCOL *ip4cfg2;
EFI_IP4_CONFIG2_MANUAL_ADDRESS ip4;
EFI_IPv4_ADDRESS gateway;
EFI_STATUS status;
status = uefi_call_wrapper(BS->HandleProtocol, 3,
nic,
&ip4_config2_guid,
(VOID **)&ip4cfg2);
status = uefi_call_wrapper(BS->HandleProtocol, 3, nic,
&EFI_IP4_CONFIG2_GUID, (VOID **)&ip4cfg2);
if (EFI_ERROR (status))
return status;
@ -656,8 +649,6 @@ http_fetch (EFI_HANDLE image, EFI_HANDLE device,
CHAR8 *hostname, CHAR8 *uri, BOOLEAN is_ip6,
VOID **buffer, UINT64 *buf_size)
{
EFI_GUID http_binding_guid = EFI_HTTP_SERVICE_BINDING_PROTOCOL_GUID;
EFI_GUID http_protocol_guid = EFI_HTTP_PROTOCOL_GUID;
EFI_SERVICE_BINDING *service;
EFI_HANDLE http_handle;
EFI_HTTP_PROTOCOL *http;
@ -669,7 +660,7 @@ http_fetch (EFI_HANDLE image, EFI_HANDLE device,
/* Open HTTP Service Binding Protocol */
status = uefi_call_wrapper(BS->OpenProtocol, 6, device,
&http_binding_guid, (VOID **)&service,
&EFI_HTTP_BINDING_GUID, (VOID **)&service,
image, NULL, EFI_OPEN_PROTOCOL_GET_PROTOCOL);
if (EFI_ERROR (status))
return status;
@ -684,7 +675,7 @@ http_fetch (EFI_HANDLE image, EFI_HANDLE device,
/* Get the http protocol */
status = uefi_call_wrapper(BS->HandleProtocol, 3, http_handle,
&http_protocol_guid, (VOID **)&http);
&EFI_HTTP_PROTOCOL_GUID, (VOID **)&http);
if (EFI_ERROR (status)) {
perror(L"Failed to get http\n");
goto error;

10
include/Http.h
View File

@ -22,16 +22,6 @@
#ifndef SHIM_HTTP_H
#define SHIM_HTTP_H
#define EFI_HTTP_SERVICE_BINDING_PROTOCOL_GUID \
{ \
0xbdc8e6af, 0xd9bc, 0x4379, {0xa7, 0x2a, 0xe0, 0xc4, 0xe7, 0x5d, 0xae, 0x1c } \
}
#define EFI_HTTP_PROTOCOL_GUID \
{ \
0x7a59b29b, 0x910b, 0x4171, {0x82, 0x42, 0xa8, 0x5a, 0x0d, 0xf2, 0x5b, 0x5b } \
}
typedef struct _EFI_HTTP_PROTOCOL EFI_HTTP_PROTOCOL;
///

5
include/Ip4Config2.h
View File

@ -20,11 +20,6 @@ This Protocol is introduced in UEFI Specification 2.5
#include <efiip.h>
#define EFI_IP4_CONFIG2_PROTOCOL_GUID \
{ \
0x5b446ed1, 0xe30b, 0x4faa, {0x87, 0x1a, 0x36, 0x54, 0xec, 0xa3, 0x60, 0x80 } \
}
typedef struct _EFI_IP4_CONFIG2_PROTOCOL EFI_IP4_CONFIG2_PROTOCOL;

5
include/Ip6Config.h
View File

@ -17,11 +17,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#include <efiip.h>
#define EFI_IP6_CONFIG_PROTOCOL_GUID \
{ \
0x937fe521, 0x95ae, 0x4d1a, {0x89, 0x29, 0x48, 0xbc, 0xd9, 0x0a, 0xd3, 0x1a } \
}
typedef struct _EFI_IP6_CONFIG_PROTOCOL EFI_IP6_CONFIG_PROTOCOL;
///

3
include/console.h
View File

@ -26,9 +26,6 @@ void
console_reset(void);
#define NOSEL 0x7fffffff
#define EFI_CONSOLE_CONTROL_PROTOCOL_GUID \
{ 0xf42f7782, 0x12e, 0x4c12, {0x99, 0x56, 0x49, 0xf9, 0x43, 0x4, 0xf7, 0x21} }
typedef struct _EFI_CONSOLE_CONTROL_PROTOCOL EFI_CONSOLE_CONTROL_PROTOCOL;
typedef enum {

22
include/efiauthenticated.h
View File

@ -60,28 +60,6 @@ typedef struct {
#define WIN_CERT_TYPE_EFI_PKCS115 0x0EF0
#define WIN_CERT_TYPE_EFI_GUID 0x0EF1
#define EFI_CERT_X509_GUID \
(EFI_GUID) { \
0xa5c059a1, 0x94e4, 0x4aa7, {0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72} \
}
#define EFI_CERT_RSA2048_GUID \
(EFI_GUID) { \
0x3c5766e8, 0x269c, 0x4e34, {0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6} \
}
#define EFI_CERT_TYPE_PKCS7_GUID \
(EFI_GUID) { \
0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} \
}
/*
* WIN_CERTIFICATE_UEFI_GUID.CertType
*/
#define EFI_CERT_TYPE_RSA2048_SHA256_GUID \
{0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } }
/*
* WIN_CERTIFICATE_UEFI_GUID.CertData
*/

23
include/guid.h
View File

@ -3,17 +3,36 @@
#include <efi.h>
extern EFI_GUID BDS_GUID;
extern EFI_GUID GV_GUID;
extern EFI_GUID SIG_DB;
extern EFI_GUID X509_GUID;
extern EFI_GUID RSA2048_GUID;
extern EFI_GUID PKCS7_GUID;
extern EFI_GUID IMAGE_PROTOCOL;
extern EFI_GUID SIMPLE_FS_PROTOCOL;
extern EFI_GUID EFI_FILE_INFO_GUID;
extern EFI_GUID EFI_FILE_SYSTEM_INFO_GUID;
extern EFI_GUID EFI_CERT_RSA2048_GUID;
extern EFI_GUID EFI_CERT_SHA1_GUID;
extern EFI_GUID EFI_CERT_SHA256_GUID;
extern EFI_GUID MOK_OWNER;
extern EFI_GUID EFI_CERT_SHA224_GUID;
extern EFI_GUID EFI_CERT_SHA384_GUID;
extern EFI_GUID EFI_CERT_SHA512_GUID;
extern EFI_GUID EFI_CERT_TYPE_PKCS7_GUID;
extern EFI_GUID EFI_CERT_TYPE_RSA2048_SHA256_GUID;
extern EFI_GUID EFI_CERT_TYPE_X509_GUID;
extern EFI_GUID EFI_CONSOLE_CONTROL_GUID;
extern EFI_GUID EFI_HTTP_BINDING_GUID;
extern EFI_GUID EFI_HTTP_PROTOCOL_GUID;
extern EFI_GUID EFI_IP4_CONFIG2_GUID;
extern EFI_GUID EFI_IP6_CONFIG_GUID;
extern EFI_GUID EFI_LOADED_IMAGE_GUID;
extern EFI_GUID EFI_TPM_GUID;
extern EFI_GUID EFI_TPM2_GUID;
extern EFI_GUID EFI_SECURE_BOOT_DB_GUID;
extern EFI_GUID EFI_SIMPLE_FILE_SYSTEM_GUID;
extern EFI_GUID SECURITY_PROTOCOL_GUID;
extern EFI_GUID SECURITY2_PROTOCOL_GUID;
extern EFI_GUID SHIM_LOCK_GUID;
#endif /* SHIM_GUID_H */

3
include/tpm.h
View File

@ -3,9 +3,6 @@
#include <efilib.h>
#define EFI_TPM_GUID {0xf541796d, 0xa62e, 0x4954, {0xa7, 0x75, 0x95, 0x84, 0xf6, 0x1b, 0x9c, 0xdd }};
#define EFI_TPM2_GUID {0x607f766c, 0x7455, 0x42be, {0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f }};
#define TPM_ALG_SHA 0x00000004
#define EV_IPL 0x0000000d

15
lib/console.c
View File

@ -8,15 +8,13 @@
#include <efilib.h>
#include <stdarg.h>
#include <stdbool.h>
#include <console.h>
#include <variables.h>
#include <errors.h>
#include "shim.h"
#include <Library/BaseCryptLib.h>
#include <openssl/err.h>
#include <openssl/crypto.h>
#include "shim.h"
static int
count_lines(CHAR16 *str_arr[])
{
@ -417,13 +415,12 @@ VOID
setup_verbosity(VOID)
{
EFI_STATUS status;
EFI_GUID guid = SHIM_LOCK_GUID;
UINT8 verbose_check;
UINTN verbose_check_size;
verbose_check_size = 1;
status = get_variable(L"SHIM_VERBOSE", (void *)&verbose_check,
&verbose_check_size, guid);
&verbose_check_size, SHIM_LOCK_GUID);
verbose = 0;
if (!EFI_ERROR(status))
verbose = verbose_check;
@ -432,13 +429,13 @@ setup_verbosity(VOID)
VOID setup_console (int text)
{
EFI_STATUS status;
EFI_GUID console_control_guid = EFI_CONSOLE_CONTROL_PROTOCOL_GUID;
EFI_CONSOLE_CONTROL_PROTOCOL *concon;
static EFI_CONSOLE_CONTROL_SCREEN_MODE mode =
EfiConsoleControlScreenGraphics;
EFI_CONSOLE_CONTROL_SCREEN_MODE new_mode;
status = LibLocateProtocol(&console_control_guid, (VOID **)&concon);
status = LibLocateProtocol(&EFI_CONSOLE_CONTROL_GUID,
(VOID **)&concon);
if (status != EFI_SUCCESS)
return;

27
lib/guid.c
View File

@ -4,19 +4,36 @@
* see COPYING file
*/
#include <guid.h>
#include "shim.h"
/* all the necessary guids */
EFI_GUID BDS_GUID = { 0x8108ac4e, 0x9f11, 0x4d59, { 0x85, 0x0e, 0xe2, 0x1a, 0x52, 0x2c, 0x59, 0xb2 } };
EFI_GUID GV_GUID = EFI_GLOBAL_VARIABLE;
EFI_GUID SIG_DB = { 0xd719b2cb, 0x3d3a, 0x4596, {0xa3, 0xbc, 0xda, 0xd0, 0xe, 0x67, 0x65, 0x6f }};
EFI_GUID X509_GUID = { 0xa5c059a1, 0x94e4, 0x4aa7, {0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72} };
EFI_GUID RSA2048_GUID = { 0x3c5766e8, 0x269c, 0x4e34, {0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6} };
EFI_GUID PKCS7_GUID = { 0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} };
EFI_GUID IMAGE_PROTOCOL = LOADED_IMAGE_PROTOCOL;
EFI_GUID SIMPLE_FS_PROTOCOL = SIMPLE_FILE_SYSTEM_PROTOCOL;
EFI_GUID EFI_FILE_INFO_GUID = EFI_FILE_INFO_ID;
EFI_GUID EFI_FILE_SYSTEM_INFO_GUID = EFI_FILE_SYSTEM_INFO_ID;
EFI_GUID EFI_CERT_RSA2048_GUID = { 0x3c5766e8, 0x269c, 0x4e34, {0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6} };
EFI_GUID EFI_CERT_SHA1_GUID = { 0x826ca512, 0xcf10, 0x4ac9, {0xb1, 0x87, 0xbe, 0x1, 0x49, 0x66, 0x31, 0xbd }};
EFI_GUID EFI_CERT_SHA256_GUID = { 0xc1c41626, 0x504c, 0x4092, { 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28 } };
EFI_GUID MOK_OWNER = { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} };
EFI_GUID EFI_CERT_SHA224_GUID = { 0xb6e5233, 0xa65c, 0x44c9, {0x94, 0x7, 0xd9, 0xab, 0x83, 0xbf, 0xc8, 0xbd} };
EFI_GUID EFI_CERT_SHA384_GUID = { 0xff3e5307, 0x9fd0, 0x48c9, {0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x1} };
EFI_GUID EFI_CERT_SHA512_GUID = { 0x93e0fae, 0xa6c4, 0x4f50, {0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a} };
EFI_GUID EFI_CERT_TYPE_PKCS7_GUID = { 0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} };
EFI_GUID EFI_CERT_TYPE_RSA2048_SHA256_GUID = { 0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } };
EFI_GUID EFI_CERT_TYPE_X509_GUID = { 0xa5c059a1, 0x94e4, 0x4aa7, {0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72} };
EFI_GUID EFI_CONSOLE_CONTROL_GUID = { 0xf42f7782, 0x12e, 0x4c12, {0x99, 0x56, 0x49, 0xf9, 0x43, 0x4, 0xf7, 0x21} };
EFI_GUID EFI_HTTP_BINDING_GUID = { 0xbdc8e6af, 0xd9bc, 0x4379, {0xa7, 0x2a, 0xe0, 0xc4, 0xe7, 0x5d, 0xae, 0x1c } };
EFI_GUID EFI_HTTP_PROTOCOL_GUID = { 0x7a59b29b, 0x910b, 0x4171, {0x82, 0x42, 0xa8, 0x5a, 0x0d, 0xf2, 0x5b, 0x5b } };
EFI_GUID EFI_IP4_CONFIG2_GUID = { 0x5b446ed1, 0xe30b, 0x4faa, {0x87, 0x1a, 0x36, 0x54, 0xec, 0xa3, 0x60, 0x80 } };
EFI_GUID EFI_IP6_CONFIG_GUID = { 0x937fe521, 0x95ae, 0x4d1a, {0x89, 0x29, 0x48, 0xbc, 0xd9, 0x0a, 0xd3, 0x1a } };
EFI_GUID EFI_LOADED_IMAGE_GUID = EFI_LOADED_IMAGE_PROTOCOL_GUID;
EFI_GUID EFI_TPM_GUID = { 0xf541796d, 0xa62e, 0x4954, {0xa7, 0x75, 0x95, 0x84, 0xf6, 0x1b, 0x9c, 0xdd } };
EFI_GUID EFI_TPM2_GUID = { 0x607f766c, 0x7455, 0x42be, {0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f } };
EFI_GUID EFI_SECURE_BOOT_DB_GUID = { 0xd719b2cb, 0x3d3a, 0x4596, { 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f } };
EFI_GUID EFI_SIMPLE_FILE_SYSTEM_GUID = SIMPLE_FILE_SYSTEM_PROTOCOL;
EFI_GUID SECURITY_PROTOCOL_GUID = { 0xA46423E3, 0x4617, 0x49f1, {0xB9, 0xFF, 0xD1, 0xBF, 0xA9, 0x11, 0x58, 0x39 } };
EFI_GUID SECURITY2_PROTOCOL_GUID = { 0x94ab2f58, 0x1438, 0x4ef1, {0x91, 0x52, 0x18, 0x94, 0x1a, 0x3a, 0x0e, 0x68 } };
EFI_GUID SHIM_LOCK_GUID = {0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 } };

27
lib/simple_file.c
View File

@ -9,9 +9,6 @@
#include "shim.h"
static EFI_GUID FILE_INFO = EFI_FILE_INFO_ID;
static EFI_GUID FS_INFO = EFI_FILE_SYSTEM_INFO_ID;
EFI_STATUS
simple_file_open_by_handle(EFI_HANDLE device, CHAR16 *name, EFI_FILE **file, UINT64 mode)
{
@ -20,7 +17,7 @@ simple_file_open_by_handle(EFI_HANDLE device, CHAR16 *name, EFI_FILE **file, UIN
EFI_FILE *root;
efi_status = uefi_call_wrapper(BS->HandleProtocol, 3, device,
&SIMPLE_FS_PROTOCOL, (void **)&drive);
&EFI_SIMPLE_FILE_SYSTEM_GUID, (void **)&drive);
if (efi_status != EFI_SUCCESS) {
Print(L"Unable to find simple file protocol (%d)\n", efi_status);
@ -81,8 +78,8 @@ simple_dir_read_all_by_handle(EFI_HANDLE image, EFI_FILE *file, CHAR16* name, EF
char buf[4096];
UINTN size = sizeof(buf);
EFI_FILE_INFO *fi = (void *)buf;
status = uefi_call_wrapper(file->GetInfo, 4, file, &FILE_INFO,
status = uefi_call_wrapper(file->GetInfo, 4, file, &EFI_FILE_INFO_GUID,
&size, fi);
if (status != EFI_SUCCESS) {
Print(L"Failed to get file info\n");
@ -151,10 +148,9 @@ simple_file_read_all(EFI_FILE *file, UINTN *size, void **buffer)
*size = sizeof(buf);
fi = (void *)buf;
efi_status = uefi_call_wrapper(file->GetInfo, 4, file, &FILE_INFO,
size, fi);
efi_status = uefi_call_wrapper(file->GetInfo, 4, file,
&EFI_FILE_INFO_GUID, size, fi);
if (efi_status != EFI_SUCCESS) {
Print(L"Failed to get file info\n");
return efi_status;
@ -199,7 +195,7 @@ simple_volume_selector(CHAR16 **title, CHAR16 **selected, EFI_HANDLE *h)
int val;
uefi_call_wrapper(BS->LocateHandleBuffer, 5, ByProtocol,
&SIMPLE_FS_PROTOCOL, NULL, &count, &vol_handles);
&EFI_SIMPLE_FILE_SYSTEM_GUID, NULL, &count, &vol_handles);
if (!count || !vol_handles)
return EFI_NOT_FOUND;
@ -218,7 +214,7 @@ simple_volume_selector(CHAR16 **title, CHAR16 **selected, EFI_HANDLE *h)
status = uefi_call_wrapper(BS->HandleProtocol, 3,
vol_handles[i],
&SIMPLE_FS_PROTOCOL,
&EFI_SIMPLE_FILE_SYSTEM_GUID,
(void **)&drive);
if (status != EFI_SUCCESS || !drive)
continue;
@ -227,14 +223,13 @@ simple_volume_selector(CHAR16 **title, CHAR16 **selected, EFI_HANDLE *h)
if (status != EFI_SUCCESS)
continue;
status = uefi_call_wrapper(root->GetInfo, 4, root, &FS_INFO,
&size, fi);
status = uefi_call_wrapper(root->GetInfo, 4, root,
&EFI_FILE_SYSTEM_INFO_GUID, &size, fi);
if (status != EFI_SUCCESS)
continue;
name = fi->VolumeLabel;
if (!name || StrLen(name) == 0 || StrCmp(name, L" ") == 0)
if (!name || StrLen(name) == 0 || StrCmp(name, L" ") == 0)
name = DevicePathToStr(DevicePathFromHandle(vol_handles[i]));
entries[i] = AllocatePool((StrLen(name) + 2) * sizeof(CHAR16));
@ -264,7 +259,6 @@ simple_volume_selector(CHAR16 **title, CHAR16 **selected, EFI_HANDLE *h)
FreePool(entries);
FreePool(vol_handles);
return EFI_SUCCESS;
}
@ -304,7 +298,6 @@ simple_dir_filter(EFI_HANDLE image, CHAR16 *name, CHAR16 *filter,
*count = 0;
status = simple_dir_read_all(image, name, entries, &tot);
if (status != EFI_SUCCESS)
goto out;
ptr = next = *entries;

2
lib/variables.c
View File

@ -323,7 +323,7 @@ variable_enroll_hash(CHAR16 *var, EFI_GUID owner,
l->SignatureListSize = sizeof(sig);
l->SignatureSize = 16 +32; /* UEFI defined */
CopyMem(&d->SignatureData, hash, SHA256_DIGEST_SIZE);
d->SignatureOwner = MOK_OWNER;
d->SignatureOwner = SHIM_LOCK_GUID;
if (CompareGuid(&owner, &SIG_DB) == 0)
status = SetSecureVariable(var, sig, sizeof(sig), owner,

163
shim.c
View File

@ -71,8 +71,6 @@ static UINT32 load_options_size;
__perror_ret; \
})
EFI_GUID SHIM_LOCK_GUID = { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} };
/*
* The vendor certificate used for validating the second stage loader
*/
@ -438,10 +436,9 @@ static CHECK_STATUS check_db_cert_in_ram(EFI_SIGNATURE_LIST *CertList,
EFI_SIGNATURE_DATA *Cert;
UINTN CertSize;
BOOLEAN IsFound = FALSE;
EFI_GUID CertType = X509_GUID;
while ((dbsize > 0) && (dbsize >= CertList->SignatureListSize)) {
if (CompareGuid (&CertList->SignatureType, &CertType) == 0) {
if (CompareGuid (&CertList->SignatureType, &EFI_CERT_TYPE_X509_GUID) == 0) {
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
CertSize = CertList->SignatureSize - sizeof(EFI_GUID);
if (verify_x509(Cert->SignatureData, CertSize)) {
@ -570,52 +567,50 @@ static CHECK_STATUS check_db_hash(CHAR16 *dbname, EFI_GUID guid, UINT8 *data,
static EFI_STATUS check_blacklist (WIN_CERTIFICATE_EFI_PKCS *cert,
UINT8 *sha256hash, UINT8 *sha1hash)
{
EFI_GUID secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
EFI_GUID shim_var = SHIM_LOCK_GUID;
EFI_SIGNATURE_LIST *dbx = (EFI_SIGNATURE_LIST *)vendor_dbx;
if (check_db_hash_in_ram(dbx, vendor_dbx_size, sha256hash,
SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID,
L"dbx", secure_var) ==
DATA_FOUND) {
SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID, L"dbx",
EFI_SECURE_BOOT_DB_GUID) == DATA_FOUND) {
LogError(L"binary sha256hash found in vendor dbx\n");
return EFI_SECURITY_VIOLATION;
}
if (check_db_hash_in_ram(dbx, vendor_dbx_size, sha1hash,
SHA1_DIGEST_SIZE, EFI_CERT_SHA1_GUID,
L"dbx", secure_var) ==
DATA_FOUND) {
SHA1_DIGEST_SIZE, EFI_CERT_SHA1_GUID, L"dbx",
EFI_SECURE_BOOT_DB_GUID) == DATA_FOUND) {
LogError(L"binary sha1hash found in vendor dbx\n");
return EFI_SECURITY_VIOLATION;
}
if (cert && check_db_cert_in_ram(dbx, vendor_dbx_size, cert,
sha256hash, L"dbx",
secure_var) == DATA_FOUND) {
if (cert &&
check_db_cert_in_ram(dbx, vendor_dbx_size, cert, sha256hash, L"dbx",
EFI_SECURE_BOOT_DB_GUID) == DATA_FOUND) {
LogError(L"cert sha256hash found in vendor dbx\n");
return EFI_SECURITY_VIOLATION;
}
if (check_db_hash(L"dbx", secure_var, sha256hash, SHA256_DIGEST_SIZE,
EFI_CERT_SHA256_GUID) == DATA_FOUND) {
if (check_db_hash(L"dbx", EFI_SECURE_BOOT_DB_GUID, sha256hash,
SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID) == DATA_FOUND) {
LogError(L"binary sha256hash found in system dbx\n");
return EFI_SECURITY_VIOLATION;
}
if (check_db_hash(L"dbx", secure_var, sha1hash, SHA1_DIGEST_SIZE,
EFI_CERT_SHA1_GUID) == DATA_FOUND) {
if (check_db_hash(L"dbx", EFI_SECURE_BOOT_DB_GUID, sha1hash,
SHA1_DIGEST_SIZE, EFI_CERT_SHA1_GUID) == DATA_FOUND) {
LogError(L"binary sha1hash found in system dbx\n");
return EFI_SECURITY_VIOLATION;
}
if (cert && check_db_cert(L"dbx", secure_var, cert, sha256hash) ==
DATA_FOUND) {
if (cert &&
check_db_cert(L"dbx", EFI_SECURE_BOOT_DB_GUID,
cert, sha256hash) == DATA_FOUND) {
LogError(L"cert sha256hash found in system dbx\n");
return EFI_SECURITY_VIOLATION;
}
if (check_db_hash(L"MokListX", shim_var, sha256hash, SHA256_DIGEST_SIZE,
EFI_CERT_SHA256_GUID) == DATA_FOUND) {
if (check_db_hash(L"MokListX", SHIM_LOCK_GUID, sha256hash,
SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID) == DATA_FOUND) {
LogError(L"binary sha256hash found in Mok dbx\n");
return EFI_SECURITY_VIOLATION;
}
if (cert && check_db_cert(L"MokListX", shim_var, cert, sha256hash) ==
DATA_FOUND) {
if (cert &&
check_db_cert(L"MokListX", SHIM_LOCK_GUID,
cert, sha256hash) == DATA_FOUND) {
LogError(L"cert sha256hash found in Mok dbx\n");
return EFI_SECURITY_VIOLATION;
}
@ -636,18 +631,15 @@ static void update_verification_method(verification_method_t method)
static EFI_STATUS check_whitelist (WIN_CERTIFICATE_EFI_PKCS *cert,
UINT8 *sha256hash, UINT8 *sha1hash)
{
EFI_GUID secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
EFI_GUID shim_var = SHIM_LOCK_GUID;
if (!ignore_db) {
if (check_db_hash(L"db", secure_var, sha256hash, SHA256_DIGEST_SIZE,
if (check_db_hash(L"db", EFI_SECURE_BOOT_DB_GUID, sha256hash, SHA256_DIGEST_SIZE,
EFI_CERT_SHA256_GUID) == DATA_FOUND) {
update_verification_method(VERIFIED_BY_HASH);
return EFI_SUCCESS;
} else {
LogError(L"check_db_hash(db, sha256hash) != DATA_FOUND\n");
}
if (check_db_hash(L"db", secure_var, sha1hash, SHA1_DIGEST_SIZE,
if (check_db_hash(L"db", EFI_SECURE_BOOT_DB_GUID, sha1hash, SHA1_DIGEST_SIZE,
EFI_CERT_SHA1_GUID) == DATA_FOUND) {
verification_method = VERIFIED_BY_HASH;
update_verification_method(VERIFIED_BY_HASH);
@ -655,7 +647,7 @@ static EFI_STATUS check_whitelist (WIN_CERTIFICATE_EFI_PKCS *cert,
} else {
LogError(L"check_db_hash(db, sha1hash) != DATA_FOUND\n");
}
if (cert && check_db_cert(L"db", secure_var, cert, sha256hash)
if (cert && check_db_cert(L"db", EFI_SECURE_BOOT_DB_GUID, cert, sha256hash)
== DATA_FOUND) {
verification_method = VERIFIED_BY_CERT;
update_verification_method(VERIFIED_BY_CERT);
@ -665,16 +657,17 @@ static EFI_STATUS check_whitelist (WIN_CERTIFICATE_EFI_PKCS *cert,
}
}
if (check_db_hash(L"MokList", shim_var, sha256hash, SHA256_DIGEST_SIZE,
EFI_CERT_SHA256_GUID) == DATA_FOUND) {
if (check_db_hash(L"MokList", SHIM_LOCK_GUID, sha256hash,
SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID)
== DATA_FOUND) {
verification_method = VERIFIED_BY_HASH;
update_verification_method(VERIFIED_BY_HASH);
return EFI_SUCCESS;
} else {
LogError(L"check_db_hash(MokList, sha256hash) != DATA_FOUND\n");
}
if (cert && check_db_cert(L"MokList", shim_var, cert, sha256hash) ==
DATA_FOUND) {
if (cert && check_db_cert(L"MokList", SHIM_LOCK_GUID, cert, sha256hash)
== DATA_FOUND) {
verification_method = VERIFIED_BY_CERT;
update_verification_method(VERIFIED_BY_CERT);
return EFI_SUCCESS;
@ -990,18 +983,17 @@ done:
* Ensure that the MOK database hasn't been set or modified from an OS
*/
static EFI_STATUS verify_mok (void) {
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS status = EFI_SUCCESS;
UINT8 *MokListData = NULL;
UINTN MokListDataSize = 0;
UINT32 attributes;
status = get_variable_attr(L"MokList", &MokListData, &MokListDataSize,
shim_lock_guid, &attributes);
SHIM_LOCK_GUID, &attributes);
if (!EFI_ERROR(status) && attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
perror(L"MokList is compromised!\nErase all keys in MokList!\n");
if (LibDeleteVariable(L"MokList", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokList", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
perror(L"Failed to erase MokList\n");
return EFI_SECURITY_VIOLATION;
}
@ -1023,7 +1015,6 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
EFI_STATUS status = EFI_SECURITY_VIOLATION;
WIN_CERTIFICATE_EFI_PKCS *cert = NULL;
unsigned int size = datasize;
EFI_GUID shim_var = SHIM_LOCK_GUID;
if (context->SecDir->Size != 0) {
if (context->SecDir->Size >= size) {
@ -1107,7 +1098,8 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
shim_cert, sizeof(shim_cert), sha256hash,
SHA256_DIGEST_SIZE)) {
update_verification_method(VERIFIED_BY_CERT);
tpm_measure_variable(L"Shim", shim_var, sizeof(shim_cert), shim_cert);
tpm_measure_variable(L"Shim", SHIM_LOCK_GUID,
sizeof(shim_cert), shim_cert);
status = EFI_SUCCESS;
drain_openssl_errors();
return status;
@ -1125,7 +1117,8 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
vendor_cert, vendor_cert_size,
sha256hash, SHA256_DIGEST_SIZE)) {
update_verification_method(VERIFIED_BY_CERT);
tpm_measure_variable(L"Shim", shim_var, vendor_cert_size, vendor_cert);
tpm_measure_variable(L"Shim", SHIM_LOCK_GUID,
vendor_cert_size, vendor_cert);
status = EFI_SUCCESS;
drain_openssl_errors();
return status;
@ -1515,7 +1508,6 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize,
static int
should_use_fallback(EFI_HANDLE image_handle)
{
EFI_GUID loaded_image_protocol = LOADED_IMAGE_PROTOCOL;
EFI_LOADED_IMAGE *li;
unsigned int pathlen = 0;
CHAR16 *bootpath = NULL;
@ -1526,7 +1518,7 @@ should_use_fallback(EFI_HANDLE image_handle)
int ret = 0;
rc = uefi_call_wrapper(BS->HandleProtocol, 3, image_handle,
&loaded_image_protocol, (void **)&li);
&EFI_LOADED_IMAGE_GUID, (void **)&li);
if (EFI_ERROR(rc)) {
perror(L"Could not get image for bootx64.efi: %r\n", rc);
return 0;
@ -1683,8 +1675,6 @@ error:
static EFI_STATUS load_image (EFI_LOADED_IMAGE *li, void **data,
int *datasize, CHAR16 *PathName)
{
EFI_GUID simple_file_system_protocol = SIMPLE_FILE_SYSTEM_PROTOCOL;
EFI_GUID file_info_id = EFI_FILE_INFO_ID;
EFI_STATUS efi_status;
EFI_HANDLE device;
EFI_FILE_INFO *fileinfo = NULL;
@ -1698,9 +1688,8 @@ static EFI_STATUS load_image (EFI_LOADED_IMAGE *li, void **data,
* Open the device
*/
efi_status = uefi_call_wrapper(BS->HandleProtocol, 3, device,
&simple_file_system_protocol,
&EFI_SIMPLE_FILE_SYSTEM_GUID,
(void **)&drive);
if (efi_status != EFI_SUCCESS) {
perror(L"Failed to find fs: %r\n", efi_status);
goto error;
@ -1736,7 +1725,7 @@ static EFI_STATUS load_image (EFI_LOADED_IMAGE *li, void **data,
* Find out how big the file is in order to allocate the storage
* buffer
*/
efi_status = uefi_call_wrapper(grub->GetInfo, 4, grub, &file_info_id,
efi_status = uefi_call_wrapper(grub->GetInfo, 4, grub, &EFI_FILE_INFO_GUID,
&buffersize, fileinfo);
if (efi_status == EFI_BUFFER_TOO_SMALL) {
@ -1748,7 +1737,7 @@ static EFI_STATUS load_image (EFI_LOADED_IMAGE *li, void **data,
goto error;
}
efi_status = uefi_call_wrapper(grub->GetInfo, 4, grub,
&file_info_id, &buffersize,
&EFI_FILE_INFO_GUID, &buffersize,
fileinfo);
}
@ -1872,7 +1861,6 @@ static EFI_STATUS shim_read_header(void *data, unsigned int datasize,
*/
EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath)
{
EFI_GUID loaded_image_protocol = LOADED_IMAGE_PROTOCOL;
EFI_STATUS efi_status;
EFI_LOADED_IMAGE *li, li_bak;
CHAR16 *PathName = NULL;
@ -1886,8 +1874,7 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath)
* binary in order to find our path
*/
efi_status = uefi_call_wrapper(BS->HandleProtocol, 3, image_handle,
&loaded_image_protocol, (void **)&li);
&EFI_LOADED_IMAGE_GUID, (void **)&li);
if (efi_status != EFI_SUCCESS) {
perror(L"Unable to init protocol\n");
return efi_status;
@ -2022,12 +2009,11 @@ EFI_STATUS init_grub(EFI_HANDLE image_handle)
*/
EFI_STATUS measure_mok()
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status, ret = EFI_SUCCESS;
UINT8 *Data = NULL;
UINTN DataSize = 0;
efi_status = get_variable(L"MokList", &Data, &DataSize, shim_lock_guid);
efi_status = get_variable(L"MokList", &Data, &DataSize, SHIM_LOCK_GUID);
if (!EFI_ERROR(efi_status)) {
efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)(UINTN)Data,
DataSize, 14, (CHAR8 *)"MokList");
@ -2040,7 +2026,7 @@ EFI_STATUS measure_mok()
ret = efi_status;
}
efi_status = get_variable(L"MokListX", &Data, &DataSize, shim_lock_guid);
efi_status = get_variable(L"MokListX", &Data, &DataSize, SHIM_LOCK_GUID);
if (!EFI_ERROR(efi_status)) {
efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)(UINTN)Data,
DataSize, 14, (CHAR8 *)"MokListX");
@ -2054,10 +2040,10 @@ EFI_STATUS measure_mok()
}
efi_status = get_variable(L"MokSBState", &Data, &DataSize,
shim_lock_guid);
SHIM_LOCK_GUID);
if (!EFI_ERROR(efi_status)) {
efi_status = tpm_measure_variable(L"MokSBState",
shim_lock_guid,
SHIM_LOCK_GUID,
DataSize, Data);
if (!EFI_ERROR(efi_status)) {
efi_status = tpm_log_event((EFI_PHYSICAL_ADDRESS)
@ -2082,7 +2068,6 @@ EFI_STATUS measure_mok()
*/
EFI_STATUS mirror_mok_list()
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
UINT8 *Data = NULL;
UINTN DataSize = 0;
@ -2092,7 +2077,7 @@ EFI_STATUS mirror_mok_list()
EFI_SIGNATURE_DATA *CertData = NULL;
uint8_t *p = NULL;
efi_status = get_variable(L"MokList", &Data, &DataSize, shim_lock_guid);
efi_status = get_variable(L"MokList", &Data, &DataSize, SHIM_LOCK_GUID);
if (efi_status != EFI_SUCCESS)
DataSize = 0;
@ -2118,7 +2103,7 @@ EFI_STATUS mirror_mok_list()
CertData = (EFI_SIGNATURE_DATA *)p;
p += sizeof (EFI_GUID);
CertList->SignatureType = EFI_CERT_X509_GUID;
CertList->SignatureType = EFI_CERT_TYPE_X509_GUID;
CertList->SignatureListSize = vendor_cert_size
+ sizeof (*CertList)
+ sizeof (*CertData)
@ -2135,7 +2120,7 @@ EFI_STATUS mirror_mok_list()
if (FullDataSize) {
efi_status = uefi_call_wrapper(RT->SetVariable, 5, L"MokListRT",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS,
FullDataSize, FullData);
@ -2153,17 +2138,17 @@ EFI_STATUS mirror_mok_list()
*/
EFI_STATUS mirror_mok_list_x()
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
UINT8 *Data = NULL;
UINTN DataSize = 0;
efi_status = get_variable(L"MokListX", &Data, &DataSize, shim_lock_guid);
efi_status = get_variable(L"MokListX", &Data, &DataSize,
SHIM_LOCK_GUID);
if (efi_status != EFI_SUCCESS)
return efi_status;
efi_status = uefi_call_wrapper(RT->SetVariable, 5, L"MokListXRT",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS,
DataSize, Data);
@ -2180,22 +2165,21 @@ EFI_STATUS mirror_mok_list_x()
*/
EFI_STATUS mirror_mok_sb_state()
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status;
UINT8 *Data = NULL;
UINTN DataSize = 0;
efi_status = get_variable(L"MokSBState", &Data, &DataSize, shim_lock_guid);
efi_status = get_variable(L"MokSBState", &Data, &DataSize, SHIM_LOCK_GUID);
if (efi_status == EFI_SUCCESS) {
UINT8 *Data_RT = NULL;
UINTN DataSize_RT = 0;
efi_status = get_variable(L"MokSBStateRT", &Data_RT,
&DataSize_RT, shim_lock_guid);
&DataSize_RT, SHIM_LOCK_GUID);
if (efi_status == EFI_SUCCESS) {
efi_status = uefi_call_wrapper(RT->SetVariable, 5,
L"MokSBStateRT",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_NON_VOLATILE,
@ -2204,7 +2188,7 @@ EFI_STATUS mirror_mok_sb_state()
efi_status = uefi_call_wrapper(RT->SetVariable, 5,
L"MokSBStateRT",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS,
DataSize, Data);
@ -2221,13 +2205,12 @@ EFI_STATUS mirror_mok_sb_state()
static BOOLEAN check_var(CHAR16 *varname)
{
EFI_STATUS efi_status;
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
UINTN size = sizeof(UINT32);
UINT32 MokVar;
UINT32 attributes;
efi_status = uefi_call_wrapper(RT->GetVariable, 5, varname,
&shim_lock_guid, &attributes,
&SHIM_LOCK_GUID, &attributes,
&size, (void *)&MokVar);
if (efi_status == EFI_SUCCESS || efi_status == EFI_BUFFER_TOO_SMALL)
@ -2265,7 +2248,6 @@ EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
*/
static EFI_STATUS check_mok_sb (void)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS status = EFI_SUCCESS;
UINT8 MokSBState;
UINTN MokSBStateSize = sizeof(MokSBState);
@ -2274,8 +2256,9 @@ static EFI_STATUS check_mok_sb (void)
user_insecure_mode = 0;
ignore_db = 0;
status = uefi_call_wrapper(RT->GetVariable, 5, L"MokSBState", &shim_lock_guid,
&attributes, &MokSBStateSize, &MokSBState);
status = uefi_call_wrapper(RT->GetVariable, 5, L"MokSBState",
&SHIM_LOCK_GUID, &attributes,
&MokSBStateSize, &MokSBState);
if (status != EFI_SUCCESS)
return EFI_SECURITY_VIOLATION;
@ -2285,7 +2268,7 @@ static EFI_STATUS check_mok_sb (void)
*/
if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
perror(L"MokSBState is compromised! Clearing it\n");
if (LibDeleteVariable(L"MokSBState", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokSBState", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
perror(L"Failed to erase MokSBState\n");
}
status = EFI_SECURITY_VIOLATION;
@ -2304,14 +2287,14 @@ static EFI_STATUS check_mok_sb (void)
static EFI_STATUS check_mok_db (void)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS status = EFI_SUCCESS;
UINT8 MokDBState;
UINTN MokDBStateSize = sizeof(MokDBState);
UINT32 attributes;
status = uefi_call_wrapper(RT->GetVariable, 5, L"MokDBState", &shim_lock_guid,
&attributes, &MokDBStateSize, &MokDBState);
status = uefi_call_wrapper(RT->GetVariable, 5, L"MokDBState",
&SHIM_LOCK_GUID, &attributes,
&MokDBStateSize, &MokDBState);
if (status != EFI_SUCCESS)
return EFI_SECURITY_VIOLATION;
@ -2323,7 +2306,7 @@ static EFI_STATUS check_mok_db (void)
*/
if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
perror(L"MokDBState is compromised! Clearing it\n");
if (LibDeleteVariable(L"MokDBState", &shim_lock_guid) != EFI_SUCCESS) {
if (LibDeleteVariable(L"MokDBState", &SHIM_LOCK_GUID) != EFI_SUCCESS) {
perror(L"Failed to erase MokDBState\n");
}
status = EFI_SECURITY_VIOLATION;
@ -2338,7 +2321,6 @@ static EFI_STATUS check_mok_db (void)
static EFI_STATUS mok_ignore_db()
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
EFI_STATUS efi_status = EFI_SUCCESS;
UINT8 Data = 1;
UINTN DataSize = sizeof(UINT8);
@ -2347,7 +2329,7 @@ static EFI_STATUS mok_ignore_db()
if (ignore_db) {
efi_status = uefi_call_wrapper(RT->SetVariable, 5, L"MokIgnoreDB",
&shim_lock_guid,
&SHIM_LOCK_GUID,
EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS,
DataSize, (void *)&Data);
@ -2360,8 +2342,6 @@ static EFI_STATUS mok_ignore_db()
}
EFI_GUID bds_guid = { 0x8108ac4e, 0x9f11, 0x4d59, { 0x85, 0x0e, 0xe2, 0x1a, 0x52, 0x2c, 0x59, 0xb2 } };
static inline EFI_STATUS
get_load_option_optional_data(UINT8 *data, UINTN data_size,
UINT8 **od, UINTN *ods)
@ -2581,7 +2561,7 @@ EFI_STATUS set_second_stage (EFI_HANDLE image_handle)
if (li->LoadOptionsSize > 16) {
if (CompareGuid((EFI_GUID *)(li->LoadOptions
+ (li->LoadOptionsSize - 16)),
&bds_guid) == 0)
&BDS_GUID) == 0)
li->LoadOptionsSize -= 16;
}
@ -2747,7 +2727,6 @@ static EFI_HANDLE shim_lock_handle;
EFI_STATUS
install_shim_protocols(void)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
SHIM_LOCK *shim_lock;
EFI_STATUS efi_status;
@ -2768,7 +2747,7 @@ install_shim_protocols(void)
* replacements. So even though it will participate and verify
* the kernel, the systab never finds out.
*/
efi_status = LibLocateProtocol(&shim_lock_guid, (VOID **)&shim_lock);
efi_status = LibLocateProtocol(&SHIM_LOCK_GUID, (VOID **)&shim_lock);
if (!EFI_ERROR(efi_status))
uninstall_shim_protocols();
@ -2776,7 +2755,7 @@ install_shim_protocols(void)
* Install the protocol
*/
efi_status = uefi_call_wrapper(BS->InstallProtocolInterface, 4,
&shim_lock_handle, &shim_lock_guid,
&shim_lock_handle, &SHIM_LOCK_GUID,
EFI_NATIVE_INTERFACE, &shim_lock_interface);
if (EFI_ERROR(efi_status)) {
console_error(L"Could not install security protocol",
@ -2800,13 +2779,11 @@ install_shim_protocols(void)
void
uninstall_shim_protocols(void)
{
EFI_GUID shim_lock_guid = SHIM_LOCK_GUID;
/*
* If we're back here then clean everything up before exiting
*/
uefi_call_wrapper(BS->UninstallProtocolInterface, 3, shim_lock_handle,
&shim_lock_guid, &shim_lock_interface);
&SHIM_LOCK_GUID, &shim_lock_interface);
if (!secure_mode())
return;
@ -2880,7 +2857,6 @@ static void
__attribute__((__optimize__("0")))
debug_hook(void)
{
EFI_GUID guid = SHIM_LOCK_GUID;
UINT8 *data = NULL;
UINTN dataSize = 0;
EFI_STATUS efi_status;
@ -2890,7 +2866,8 @@ debug_hook(void)
if (x)
return;
efi_status = get_variable(L"SHIM_DEBUG", &data, &dataSize, guid);
efi_status = get_variable(L"SHIM_DEBUG", &data, &dataSize,
SHIM_LOCK_GUID);
if (EFI_ERROR(efi_status)) {
return;
}
@ -2901,7 +2878,7 @@ debug_hook(void)
Print(L"Pausing for debugger attachment.\n");
Print(L"To disable this, remove the EFI variable SHIM_DEBUG-%g .\n",
&guid);
&SHIM_LOCK_GUID);
x = 1;
while (x++) {
/* Make this so it can't /totally/ DoS us. */

2
shim.h
View File

@ -95,8 +95,6 @@
#include "shim_cert.h"
#endif
extern EFI_GUID SHIM_LOCK_GUID;
INTERFACE_DECL(_SHIM_LOCK);
typedef

9
tpm.c
View File

@ -23,9 +23,6 @@ typedef struct {
UINTN measuredcount = 0;
VARIABLE_RECORD *measureddata = NULL;
EFI_GUID tpm_guid = EFI_TPM_GUID;
EFI_GUID tpm2_guid = EFI_TPM2_GUID;
static BOOLEAN tpm_present(efi_tpm_protocol_t *tpm)
{
EFI_STATUS status;
@ -126,7 +123,7 @@ static EFI_STATUS tpm_locate_protocol(efi_tpm_protocol_t **tpm,
*tpm = NULL;
*tpm2 = NULL;
status = LibLocateProtocol(&tpm2_guid, (VOID **)tpm2);
status = LibLocateProtocol(&EFI_TPM2_GUID, (VOID **)tpm2);
/* TPM 2.0 */
if (status == EFI_SUCCESS) {
BOOLEAN old_caps;
@ -144,7 +141,7 @@ static EFI_STATUS tpm_locate_protocol(efi_tpm_protocol_t **tpm,
return EFI_SUCCESS;
}
} else {
status = LibLocateProtocol(&tpm_guid, (VOID **)tpm);
status = LibLocateProtocol(&EFI_TPM_GUID, (VOID **)tpm);
if (EFI_ERROR(status))
return status;
@ -214,7 +211,7 @@ static EFI_STATUS tpm_log_event_raw(EFI_PHYSICAL_ADDRESS buf, UINTN size,
UINT32 eventnum = 0;
EFI_PHYSICAL_ADDRESS lastevent;
status = LibLocateProtocol(&tpm_guid, (VOID **)&tpm);
status = LibLocateProtocol(&EFI_TPM_GUID, (VOID **)&tpm);
if (status != EFI_SUCCESS)
return EFI_SUCCESS;