proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-06-10 07:42:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
157 Commits 1 Branch 3 Tags 11 MiB
a24d3ba3bd
Commit Graph

62 Commits

Author SHA1 Message Date
Gary Ching-Pang Lin
4bab48ce88 Make sure the menu shows when the callback fails 
Since Pause() doesn't clear the key from the input queue, the next
ReadKeyStroke reads the queued key instead of the new one. If the
user presses "Enter", MokManager exits directly without showing
the menu again.
 2013-01-03 12:20:30 +08:00
Gary Ching-Pang Lin
990dcdb6a6 Add support for deleting specific keys 2013-01-03 12:20:22 +08:00
Gary Ching-Pang Lin
0c6a8a7501 MOK doesn't include the signature owner 2012-12-27 11:42:54 +08:00
Gary Ching-Pang Lin
5abe73ab81 Add a general function for password matching 2012-12-27 11:42:54 +08:00
Gary Ching-Pang Lin
510dafda53 Reboot the system after enrolling/erasing keys 2012-12-27 11:42:45 +08:00
Gary Ching-Pang Lin
10f0f58b03 Clear the screen before erasing keys 2012-12-20 12:55:59 +08:00
Matthew Garrett
24a602b614 Fix up some types 
Type-checking the UEFI calls picked up a couple of problems. Fix them up.
 2012-11-01 09:46:51 -04:00
Matthew Garrett
0e3ff89ac7 Clean up password setting 
Permit clearing of the password, and avoid a case where choosing not to set
a password would result in an error message on exit. Fix the same problem
with MokSB.
 2012-10-24 01:14:50 -04:00
Matthew Garrett
cccc613733 Improve signature validation enable/disable 
The logic used in checking the signature validation password was a bit
ugly. Improve that so it behaves rather more as expected.
 2012-10-24 01:05:45 -04:00
Matthew Garrett
67a1cc49a9 Add another missing screen clearing 
Another case where we were drawing text over existing text.
 2012-10-23 23:46:44 -04:00
Matthew Garrett
631773c28f Fix password hash calculation 
This was hardcoded, rather than being based on the actual password length,
resulting in incorrect hashes being generated.
 2012-10-23 15:43:29 -04:00
Matthew Garrett
eb4c59b0c8 Update image validation enable/disable 
Update this to match the new mokutil behaviour
 2012-10-23 15:43:10 -04:00
Matthew Garrett
35e185edd9 Delete MokList properly 
A cut and paste error meant that attempts to delete MokList were instead
appending a zero-length addition.
 2012-10-23 13:01:48 -04:00
Matthew Garrett
59f2e0a289 Fix key database parsing 
The pointer to the certificate needs to be incremented by the size of the
entire certificate, not just the certificate data.
 2012-10-23 13:00:40 -04:00
Matthew Garrett
cdde65912a Clear screen before prompting 
We were drawing prompts on top of existing text, which was less than
ideal.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
82408dddba Don't print SHA1 sum when calculating file fingerprints 
There's no point in printing the SHA1 of a SHA256...
 2012-10-18 17:43:53 -04:00
Matthew Garrett
077c2525ab Clean up timeout counter handling 
Reduce menu redrawing by only redrawing the invalidated section of the menu
during the timeout countdown.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
801c0faaf7 Add MOK password auth 
Add support for setting an MOK password. The OS passes down a password hash.
MokManager then presents an option for setting a password. Selecting it
prompts the user for the same password again. If they match, the hash is
enrolled into a boot services variable and MokManager will prompt for the
password whenever it's started.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
310ec753fa Pause on callback failures 
If a callback returns any kind of failure, wait for a keypress in order to
give the user an opportunity to read any failure messages.
 2012-10-18 17:43:53 -04:00
Matthew Garrett
c1faa462e0 Add support for disabling signature verification 
Provide a mechanism for a physically present end user to disable signature
verification. This is handled by the OS passing down a variable that
contains a UINT32 and a SHA256 hash. If this variable is present, MokManager
prompts the user to choose whether to enable or disable signature validation
(depending on the value of the UINT32). They are then asked to type the
passphrase that matches the hash. This then saves a boot services variable
which is checked by shim, and if set will skip verification of signatures.
 2012-10-18 17:41:52 -04:00
Matthew Garrett
ed63bf1c0e Add section headers 
Provide a little more contextual information when people are in shim
menus.
 2012-10-13 01:07:43 -04:00
Gary Ching-Pang Lin
1b3512adf0 Reallocate the DevPath space for the volume label 
The size of the DevPath string array was not sufficient to append
the volume label. This patch extends the size for the label and
re-enables the menu freeing.
 2012-10-12 20:09:33 -04:00
Matthew Garrett
0848fab98d Switch to using db format for MokList and MokNew 
Using the same format as the UEFI key databases makes it easier for the
kernel to parse and extract keys from MOK, and also permits MOK to contain
multiple key or hash types. Additionally, add support for enrolling hashes.
 2012-10-12 19:55:20 -04:00
Matthew Garrett
c48993f8b0 Add menu header 
Add a basic header to the menu to make it clearer what's going on.
Define SHIM_VENDOR in order to override the default.
 2012-10-11 09:55:14 -04:00
Matthew Garrett
f031aeca57 Clear screen on exit 2012-10-11 09:45:14 -04:00
Matthew Garrett
bb47e3138e Add timeout support 
We should time out if there aren't any keypresses at the top level menu
within a reasonable timeframe.
 2012-10-11 09:44:27 -04:00
Matthew Garrett
4a6f5c6f87 Fix whitespace 2012-10-11 09:26:16 -04:00
Gary Ching-Pang Lin
20b954b004 Remove unnecessary newline 
The newline character shouldn't be present in the menu item string
 2012-10-11 09:24:06 -04:00
Gary Ching-Pang Lin
948cedb3c6 Pass the size of MokNew to the key enrollment function 
The size of MokNew was missing and it caused crash when enrolling new MOKs
with mokutil
 2012-10-11 09:24:06 -04:00
Matthew Garrett
fb620efef8 Callbacks should return INTN, not UINTN 2012-10-09 09:44:55 -04:00
Matthew Garrett
3839b92b85 Remove unused variable 2012-10-09 09:43:37 -04:00
Matthew Garrett
fcb7401ed6 Don't lose the last file in top-level directories 
The filesystem callback was failing to account for the additional menu
item to return to the filesystem list, and so the last file entry in the
root directory would be missing from the list.
 2012-10-09 09:43:08 -04:00
Matthew Garrett
cfa77df48e Fix filesystem enrollment 
We would always enrol a single key, deleting any existing keys in the
database. Fix that up.
 2012-10-08 17:35:50 -04:00
Matthew Garrett
27db5b66aa Add an auth argument to store_keys() 
If the user is manually installing keys from a filesystem then we don't need
to ask for the key password.
 2012-10-08 17:34:55 -04:00
Matthew Garrett
ae46cf9d05 Add __attribute__ ((packed)) to MokListNode definition 
Packing this lets us use MokListNode with the binary MokList representation.
 2012-10-08 17:33:32 -04:00
Matthew Garrett
19423e7f2b Disable menu freeing 
This looks like it ought to work, but is currently failing. Leaking here
isn't a big deal, so just disable it until I figure out what's wrong.
 2012-10-06 17:52:38 -04:00
Matthew Garrett
ea5bba7315 Fix menucount 
Menucount wasn't being incremented for the final top level menu, so
the file explorer menu item wasn't appearing.
 2012-10-06 17:39:21 -04:00
Matthew Garrett
13f88088c9 Free menus and add statics 
Make sure we free menu items after exiting a menu. Also, add some missing
static annotations.
 2012-10-06 17:30:49 -04:00
Matthew Garrett
d2188bbf12 Fix menu items 
Only show the MOK manipulation menu item if MokNew existed
 2012-10-06 17:30:46 -04:00
Matthew Garrett
ba3c876b24 Always show the MokManager UI 
If someone explicitly starts MokManager then we want to show the UI
 2012-10-06 17:22:33 -04:00
Matthew Garrett
e4889c525b Add filesystem browsing and enrollment 
Add a basic menu system and file explorer. This makes it possible for the
user to enrol keys from media from within shim rather than having to boot
an OS first. This would permit vendors to distribute a signed shim without
having to install their own keys first - the keys could be stored on the
install media instead.
 2012-10-05 19:04:57 -04:00
Gary Ching-Pang Lin
0e81abac81 Don't show the invalid key number 2012-10-04 17:39:59 +08:00
Gary Ching-Pang Lin
8bddd68127 Use the same function to get commands and password 2012-10-04 17:39:54 +08:00
Gary Ching-Pang Lin
419c5e3577 Print the key number for the non-existent key also 2012-10-04 16:28:52 +08:00
Gary Ching-Pang Lin
27129e60a6 Don't print Backspace as we print nothing 2012-10-02 18:17:29 +08:00
Gary Ching-Pang Lin
3b8cc123ce Calculate SHA1 fingerprint 
openssl shows sha1 fingerprint by default.
 2012-10-02 14:51:42 +08:00
Gary Ching-Pang Lin
7ad1f3b86d Replace functions with the ones in gnu-efi 2012-10-02 12:58:32 +08:00
Gary Ching-Pang Lin
000e235101 Use LibDeleteVariable in gnu-efi 2012-10-02 11:55:44 +08:00
Gary Ching-Pang Lin
a737c14265 More tips for the MOK password 2012-09-27 16:54:38 +08:00
Gary Ching-Pang Lin
77e0d721ec Filter out newline from the password array 2012-09-26 17:19:27 +08:00