eddaed0c11
Asking the user for the UID mapping isn't working very well, as it requires lots of manual handholding. It also doesn't work very well when the device vendor does not actually have a PCI ID or if the vendor has split into two entities. Just use the OUI address as an additional VendorID and match any of the device IDs against any of the metadata-supplied values. |
||
|---|---|---|
| .. | ||
| fuzzing | ||
| create-fuzzing-targets.py | ||
| dbxtool.h2m | ||
| fu-dbxtool.c | ||
| fu-efi-image.c | ||
| fu-efi-image.h | ||
| fu-efi-signature-common.c | ||
| fu-efi-signature-common.h | ||
| fu-efi-signature-list.c | ||
| fu-efi-signature-list.h | ||
| fu-efi-signature-parser.c | ||
| fu-efi-signature-parser.h | ||
| fu-efi-signature.c | ||
| fu-efi-signature.h | ||
| fu-fuzzer.c | ||
| fu-plugin-uefi-dbx.c | ||
| fu-self-test.c | ||
| fu-uefi-dbx-common.c | ||
| fu-uefi-dbx-common.h | ||
| fu-uefi-dbx-device.c | ||
| fu-uefi-dbx-device.h | ||
| meson.build | ||
| README.md | ||
UEFI dbx Support
Introduction
Updating the UEFI revocation database prevents starting EFI binaries with known security issues, and is typically no longer done from a firmware update due to the risk of the machine being "bricked" if the bootloader is not updated first.
This plugin also checks if the UEFI dbx contains all the most recent revoked checksums. The result will be stored in an security attribute for HSI.
Firmware Format
The daemon will decompress the cabinet archive and extract a firmware blob in EFI_SIGNATURE_LIST format.
See https://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf for details.
This plugin supports the following protocol ID:
- org.uefi.dbx
GUID Generation
These devices use the GUID constructed of the uppercase SHA256 of the X509 certificates found in the system KEK and optionally the EFI architecture. e.g.
UEFI\CRT_{sha256}UEFI\CRT_{sha256}&ARCH_{arch}
...where arch is typically one of IA32, X64, ARM or AA64
Vendor ID Security
The vendor ID is hardcoded to UEFI:Microsoft for all devices.
External interface access
This plugin requires:
- read/write access to
/sys/firmware/efi/efivars