proxmox-mirrors/fwupd
1
0
Fork 0
mirror of https://git.proxmox.com/git/fwupd synced 2025-08-15 23:29:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
proxmox/bookworm
fwupd/plugins/uefi-dbx
History
Richard Hughes a18deb7081 Convert the man pages to MarkDown format 
We've got a new contributor that wants to make the man pages actually helpful
and interesting. Rather than making them use troff, just convert the document
from a more modern format using pandoc.

Use a meson feature to auto-disable the manpages if pandoc is not available.
2023-02-23 10:46:18 +00:00
..
fuzzing uefi-dbx: Add a plugin that analyses the UEFI dbx variable 2020-05-07 16:59:36 +01:00
dbxtool.md Convert the man pages to MarkDown format 2023-02-23 10:46:18 +00:00
fu-dbxtool.c Move the getting the ESP to the context 2022-09-22 14:31:06 +01:00
fu-efi-image.c Split out the memory helpers to a new source file 2022-06-14 14:36:52 -05:00
fu-efi-image.h trivial: reformat the whole tree to match new format 2021-08-24 11:18:40 -05:00
fu-self-test.c Split out the GByte helpers to a new source file 2022-06-14 14:36:52 -05:00
fu-uefi-dbx-common.c uefi-dbx: Ignore failure to mount the ESP if unsupported 2022-12-16 14:58:03 +00:00
fu-uefi-dbx-common.h Move the getting the ESP to the context 2022-09-22 14:31:06 +01:00
fu-uefi-dbx-device.c Move the getting the ESP to the context 2022-09-22 14:31:06 +01:00
fu-uefi-dbx-device.h trivial: reformat the whole tree to match new format 2021-08-24 11:18:40 -05:00
fu-uefi-dbx-plugin.c Build many more plugins as builtin 2022-09-28 17:01:23 +01:00
fu-uefi-dbx-plugin.h Build many more plugins as builtin 2022-09-28 17:01:23 +01:00
meson.build Convert the man pages to MarkDown format 2023-02-23 10:46:18 +00:00
README.md Include the plugin README text in the generated docs 2023-01-10 14:58:30 +00:00
uefi-dbx.quirk uefi-dbx: No not allow the DBX update for specific motherboards 2022-03-07 22:12:06 +00:00

README.md

title: Plugin: UEFI dbx

Introduction

Updating the UEFI revocation database prevents starting EFI binaries with known security issues, and is typically no longer done from a firmware update due to the risk of the machine being "bricked" if the bootloader is not updated first.

This plugin also checks if the UEFI dbx contains all the most recent revoked checksums. The result will be stored in an security attribute for HSI.

Firmware Format

The daemon will decompress the cabinet archive and extract a firmware blob in EFI_SIGNATURE_LIST format.

See https://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf for details.

This plugin supports the following protocol ID:

  • org.uefi.dbx

GUID Generation

These devices use the GUID constructed of the uppercase SHA256 of the X509 certificates found in the system KEK and optionally the EFI architecture. e.g.

  • UEFI\CRT_{sha256}
  • UEFI\CRT_{sha256}&ARCH_{arch}

...where arch is typically one of IA32, X64, ARM or AA64

Update Behavior

The firmware is deployed when the machine is in normal runtime mode, but it is only activated when the system is restarted.

Vendor ID Security

The vendor ID is hardcoded to UEFI:Microsoft for all devices.

External Interface Access

This plugin requires:

  • read/write access to /sys/firmware/efi/efivars