proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-06-13 03:25:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add REQUIRE_TPM flag to treat TPM related errors as critical

Browse Source 
Currently TPM related errors are being silently discarded.

Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
This commit is contained in:
Tamas K Lengyel 2017-11-08 15:10:18 -07:00 committed by Peter Jones
parent 555ef92650
commit ba06a4362d
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
Makefile
View File

@ -33,6 +33,7 @@ DEBUGINFO ?= $(prefix)/lib/debug/
DEBUGSOURCE ?= $(prefix)/src/debug/
OSLABEL ?= $(EFIDIR)
DEFAULT_LOADER ?= \\\\grub$(ARCH_SUFFIX).efi
REQUIRE_TPM ?=
ARCH ?= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.*\((.*)\|version\) //g' | cut -f1-2 -d.` \>= 2.24)
@ -68,6 +69,10 @@ ifneq ($(origin ENABLE_HTTPBOOT), undefined)
CFLAGS += -DENABLE_HTTPBOOT
endif
ifneq ($(origin REQUIRE_TPM), undefined)
CFLAGS += -DREQUIRE_TPM
endif
ifeq ($(ARCH),x86_64)
CFLAGS += -mno-mmx -mno-sse -mno-red-zone -nostdinc \
-maccumulate-outgoing-args -m64 \

13
shim.c
View File

@ -1308,7 +1308,12 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize,
return efi_status;
/* Measure the binary into the TPM */
tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize, sha1hash, 4);
efi_status = tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize, sha1hash, 4);
#ifdef REQUIRE_TPM
if (efi_status != EFI_SUCCESS) {
return efi_status;
}
#endif
if (secure_mode ()) {
efi_status = verify_buffer(data, datasize, &context,
@ -1818,7 +1823,11 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
goto done;
/* Measure the binary into the TPM */
tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, sha1hash, 4);
status = tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, sha1hash, 4);
#ifdef REQUIRE_TPM
if (status != EFI_SUCCESS)
goto done;
#endif
if (!secure_mode())
goto done;