proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-05-16 06:37:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
148 Commits 1 Branch 3 Tags 11 MiB
a05c7c57d9
Commit Graph

60 Commits

Author SHA1 Message Date
Gary Ching-Pang Lin
a05c7c57d9 MOK doesn't include the signature owner 2012-12-27 11:42:54 +08:00
Gary Ching-Pang Lin
262d671419 Add a general function for password matching 2012-12-27 11:42:54 +08:00
Gary Ching-Pang Lin
a64ab2ec6b Reboot the system after enrolling/erasing keys 2012-12-27 11:42:45 +08:00
Gary Ching-Pang Lin
4895ca3919 Clear the screen before erasing keys 2012-12-20 12:55:59 +08:00
Matthew Garrett
ed711b02ec Fix up some types 
Type-checking the UEFI calls picked up a couple of problems. Fix them up.
 2012-11-01 09:46:51 -04:00
Matthew Garrett
d77f421bcc Clean up password setting 
Permit clearing of the password, and avoid a case where choosing not to set
a password would result in an error message on exit. Fix the same problem
with MokSB.
 2012-10-24 01:14:50 -04:00
Matthew Garrett
8a1690683f Improve signature validation enable/disable 
The logic used in checking the signature validation password was a bit
ugly. Improve that so it behaves rather more as expected.
 2012-10-24 01:05:45 -04:00
Matthew Garrett
6e05b32d07 Add another missing screen clearing 
Another case where we were drawing text over existing text.
 2012-10-23 23:46:44 -04:00
Matthew Garrett
254c04bcdd Fix password hash calculation 
This was hardcoded, rather than being based on the actual password length,
resulting in incorrect hashes being generated.
 2012-10-23 15:43:29 -04:00
Matthew Garrett
79a5aa039d Update image validation enable/disable 
Update this to match the new mokutil behaviour
 2012-10-23 15:43:10 -04:00
Matthew Garrett
868d5b9038 Delete MokList properly 
A cut and paste error meant that attempts to delete MokList were instead
appending a zero-length addition.
 2012-10-23 13:01:48 -04:00
Matthew Garrett
3a59336199 Fix key database parsing 
The pointer to the certificate needs to be incremented by the size of the
entire certificate, not just the certificate data.
 2012-10-23 13:00:40 -04:00
Matthew Garrett
34f0c4abc0 Clear screen before prompting 
We were drawing prompts on top of existing text, which was less than
ideal.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
16c512f9b5 Don't print SHA1 sum when calculating file fingerprints 
There's no point in printing the SHA1 of a SHA256...
 2012-10-18 17:43:53 -04:00
Matthew Garrett
37635f5414 Clean up timeout counter handling 
Reduce menu redrawing by only redrawing the invalidated section of the menu
during the timeout countdown.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
801d1b936b Add MOK password auth 
Add support for setting an MOK password. The OS passes down a password hash.
MokManager then presents an option for setting a password. Selecting it
prompts the user for the same password again. If they match, the hash is
enrolled into a boot services variable and MokManager will prompt for the
password whenever it's started.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
d08ea5363c Pause on callback failures 
If a callback returns any kind of failure, wait for a keypress in order to
give the user an opportunity to read any failure messages.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
9272bc5b84 Add support for disabling signature verification 
Provide a mechanism for a physically present end user to disable signature
verification. This is handled by the OS passing down a variable that
contains a UINT32 and a SHA256 hash. If this variable is present, MokManager
prompts the user to choose whether to enable or disable signature validation
(depending on the value of the UINT32). They are then asked to type the
passphrase that matches the hash. This then saves a boot services variable
which is checked by shim, and if set will skip verification of signatures.
 2012-10-18 17:41:52 -04:00
Matthew Garrett
1bc1cd96e4 Add section headers 
Provide a little more contextual information when people are in shim
menus.
 2012-10-13 01:07:43 -04:00
Gary Ching-Pang Lin
e65370d770 Reallocate the DevPath space for the volume label 
The size of the DevPath string array was not sufficient to append
the volume label. This patch extends the size for the label and
re-enables the menu freeing.
 2012-10-12 20:09:33 -04:00
Matthew Garrett
0a6565c5ed Switch to using db format for MokList and MokNew 
Using the same format as the UEFI key databases makes it easier for the
kernel to parse and extract keys from MOK, and also permits MOK to contain
multiple key or hash types. Additionally, add support for enrolling hashes.
 2012-10-12 19:55:20 -04:00
Matthew Garrett
e204505d2d Add menu header 
Add a basic header to the menu to make it clearer what's going on.
Define SHIM_VENDOR in order to override the default.
 2012-10-11 09:55:14 -04:00
Matthew Garrett
5f292f8f91 Clear screen on exit 2012-10-11 09:45:14 -04:00
Matthew Garrett
202b5c3e12 Add timeout support 
We should time out if there aren't any keypresses at the top level menu
within a reasonable timeframe.
 2012-10-11 09:44:27 -04:00
Matthew Garrett
66fe4506fb Fix whitespace 2012-10-11 09:26:16 -04:00
Gary Ching-Pang Lin
dfbe823b53 Remove unnecessary newline 
The newline character shouldn't be present in the menu item string
 2012-10-11 09:24:06 -04:00
Gary Ching-Pang Lin
d6332c078f Pass the size of MokNew to the key enrollment function 
The size of MokNew was missing and it caused crash when enrolling new MOKs
with mokutil
 2012-10-11 09:24:06 -04:00
Matthew Garrett
4aeb0a9162 Callbacks should return INTN, not UINTN 2012-10-09 09:44:55 -04:00
Matthew Garrett
41f5d6095f Remove unused variable 2012-10-09 09:43:37 -04:00
Matthew Garrett
c9696a1c97 Don't lose the last file in top-level directories 
The filesystem callback was failing to account for the additional menu
item to return to the filesystem list, and so the last file entry in the
root directory would be missing from the list.
 2012-10-09 09:43:08 -04:00
Matthew Garrett
d1c2586c23 Fix filesystem enrollment 
We would always enrol a single key, deleting any existing keys in the
database. Fix that up.
 2012-10-08 17:35:50 -04:00
Matthew Garrett
1e9de96f8a Add an auth argument to store_keys() 
If the user is manually installing keys from a filesystem then we don't need
to ask for the key password.
 2012-10-08 17:34:55 -04:00
Matthew Garrett
cb22de62e7 Add __attribute__ ((packed)) to MokListNode definition 
Packing this lets us use MokListNode with the binary MokList representation.
 2012-10-08 17:33:32 -04:00
Matthew Garrett
9201fa9ec6 Disable menu freeing 
This looks like it ought to work, but is currently failing. Leaking here
isn't a big deal, so just disable it until I figure out what's wrong.
 2012-10-06 17:52:38 -04:00
Matthew Garrett
a68a0c7b03 Fix menucount 
Menucount wasn't being incremented for the final top level menu, so
the file explorer menu item wasn't appearing.
 2012-10-06 17:39:21 -04:00
Matthew Garrett
c9d2ff8c40 Free menus and add statics 
Make sure we free menu items after exiting a menu. Also, add some missing
static annotations.
 2012-10-06 17:30:49 -04:00
Matthew Garrett
24eace9953 Fix menu items 
Only show the MOK manipulation menu item if MokNew existed
 2012-10-06 17:30:46 -04:00
Matthew Garrett
27a8fc9fd1 Always show the MokManager UI 
If someone explicitly starts MokManager then we want to show the UI
 2012-10-06 17:22:33 -04:00
Matthew Garrett
d991c4a178 Add filesystem browsing and enrollment 
Add a basic menu system and file explorer. This makes it possible for the
user to enrol keys from media from within shim rather than having to boot
an OS first. This would permit vendors to distribute a signed shim without
having to install their own keys first - the keys could be stored on the
install media instead.
 2012-10-05 19:04:57 -04:00
Gary Ching-Pang Lin
577029ad75 Don't show the invalid key number 2012-10-04 17:39:59 +08:00
Gary Ching-Pang Lin
3ece2b337e Use the same function to get commands and password 2012-10-04 17:39:54 +08:00
Gary Ching-Pang Lin
67f1e0b259 Print the key number for the non-existent key also 2012-10-04 16:28:52 +08:00
Gary Ching-Pang Lin
0692f833c9 Don't print Backspace as we print nothing 2012-10-02 18:17:29 +08:00
Gary Ching-Pang Lin
5e43e91f3d Calculate SHA1 fingerprint 
openssl shows sha1 fingerprint by default.
 2012-10-02 14:51:42 +08:00
Gary Ching-Pang Lin
5816917f72 Replace functions with the ones in gnu-efi 2012-10-02 12:58:32 +08:00
Gary Ching-Pang Lin
f3104a7314 Use LibDeleteVariable in gnu-efi 2012-10-02 11:55:44 +08:00
Gary Ching-Pang Lin
aa8e90679d More tips for the MOK password 2012-09-27 16:54:38 +08:00
Gary Ching-Pang Lin
44423f01a4 Filter out newline from the password array 2012-09-26 17:19:27 +08:00
Gary Ching-Pang Lin
a4c1e5965f correct wording 2012-09-26 16:36:53 +08:00
Gary Ching-Pang Lin
ff857b4b8d Define the max length of password 2012-09-24 17:27:52 +08:00