aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2019-01-08Version: 1.9.2HEADv1.9.2masterJames Bottomley1-1/+1
* add engine option documentation for sign-efi-sig-list * fix sha256 computation for some efi binaries Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-08sha256: do not align raw section sizesJames Bottomley1-3/+5
A vmlinuz hash was failing because it was being aligned up to the context.fileAlignment (which is 32) which adds a spurious 16 bytes to the section size. Additionally, only hash additional data if the remaining data is larger than the security directory. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-07sign-efi-sig-list: add man page entry for engine optionJames Bottomley1-0/+1
This was forgotten when the engine code was added, so include it now. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-06Version: 1.9.1v1.9.1James Bottomley1-1/+1
* fix build on some systems due to library ordering Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-06Makefile: Reverse the order of lib.a and -lcryptoJames Bottomley1-6/+6
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-06Version: 1.9.0v1.9.0James Bottomley1-1/+1
* engine based keys * use SignedData for authenticated variables Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-05use SignedData instead of PKCS7 for variable updatesJames Bottomley1-1/+1
The EFI standard is ambiguous about which one to use for variable updates (it is definite about using PKCS7 for signed binaries). Until recently, the reference platform, tianocore, accepted both. However after patch commit c035e37335ae43229d7e68de74a65f2c01ebc0af Author: Zhang Lubo <lubo.zhang@intel.com> Date: Thu Jan 5 14:58:05 2017 +0800 SecurityPkg: enhance secure boot Config Dxe & Time Based AuthVariable. The acceptance of PKCS7 got broken. This breakage seems to be propagating to the UEFI ecosystem, so update the variable signing tools to emit the SignedData type. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-05support engine based keysJames Bottomley4-8/+107
Add additional arguments to specify an openssl engine (-e for sign-efi-sig-list and --engine for efi-update). If an engine is specified, pass the keyfile to the engine load routines. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-05factor out variable signing codeJames Bottomley5-59/+90
Since we have two uses of the code, consolidate into a library routine so the signing can be done in a single place. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2018-12-18efi-updatevar: remove all authenticated attributes from signaturepai-yi.huang1-3/+3
follow the Commit: 4727744d42ec594d558e5d6c3fcf4c8d63d83186 for sign-efi-sig-list to fix efi-updatevar failure for AMI BIOS. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2018-02-20Version: 1.8.1v1.8.1James Bottomley1-1/+1
* Fix fedora build Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2018-02-20Fix Fedora buildJames Bottomley1-3/+3
Fedora has a whole load of weird and wonderful ideas beyond both Debian and openSUSE about how to install gnu-efi. Fix the build rules to accommodate its eccentricities. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19Version: 1.8.0v1.8.0James Bottomley1-1/+1
* openssl 1.1 support * many other updates Signed-off-by James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19cert-to-efi-hash-list: fix for openssl 1.1James Bottomley1-1/+5
Can't dereference the cert any more. Unfortunately now there's no API to get the cert->cert_info any more (thanks openssl!). Fortunately we can fiddle it with i2d_re_X509_tbs. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-03-01efitools: oid.h: Re-run oid.pl to regenerate oid.h includeNicholas Fish1-0/+2
oid.h: Run oid.pl to regenerate oid.h include Builds against musl libc are failing due to unknown types. This is because lib/asn1/oid.h is stale and needs to be regenerated by running lib/asn1/oid.pl to bring in the types.h include. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-01-16kernel_efivars.c: fix mismatch between UNIX and EFI timePatrick Callaghan1-1/+2
The EFI variable code is failing in January of every year. This is because of a mismatch between EFI_TIME and struct tm. The month in EFI_TIME is 1-12 and in struct tm it's 0-11 meaning that January is an invalid month for EFI_TIME. Fix this by adding one Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-05-13PreLoader: use updated security policy install functionJames Bottomley1-1/+3
PreLoader got broken when security_policy_install() was changed to take an override, deny and allow function. Fix it by supplying the default MoK policy functions. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-05-13security_policy: fully convert to override,allow and deny functionsJames Bottomley1-25/+12
The EFI_SECURITY2_PROTOCOL override hadn't been updated, so do that now. Also remove the now unused security_policy_check_mok() function. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-05-13security_policy: factor out the current MoK hash policiesJames Bottomley2-10/+55
This is so we can use them externally as override, allow and deny functions in PreLoader. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-03-25Version: 1.7.0v1.7.0James Bottomley1-1/+1
New shim replacement system use of pkcs7verify protocol Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-03-25sig-list-to-certs: add -e option to break out all esl payloadsJames Bottomley1-3/+20
When manipulating signatures in user mode, it's often useful to read all the signature lists individually, cat selected ones, authorise the bundle and then write it. Adding a -e option to break out all the individual signature lists saves messing about with dd in the global esl. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-03-25security_policy: convert to using pkcs7verify protocolJames Bottomley2-13/+31
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-03-25shim_protocol: convert to using the pkcs7verify allow and deny functionJames Bottomley3-77/+8
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-03-25pkcs7verify: add allow and deny checkersJames Bottomley2-1/+200
Export useful deny checker which checks explicitly the hashes in MokListX and dbx and an allow checker which checks the hashes first and then does a VerifySignature to see if the signature is allowed. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-03-25variables: add routines to get a list of hash algorithmsJames Bottomley2-0/+53
Since the full list of hash algorithms is finite an known, just dump the list of found hash algorithms to a variable for us to check against. The default is going to be only a single algorithm: sha256. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-03-25guid: add all currently defined hashing guidsJames Bottomley2-0/+21
Also add a table so we can look for them. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-26shim_protocol: add implementation of read_headerJames Bottomley1-1/+8
Apparently the grub chainloader does use this for some reason (in the SUSE patched version) Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-23ShimReplace: add new shim loader simply to install protocolJames Bottomley2-1/+65
The way grub currently works on Linux is that it relies on the shim protocol to verify images. Without this, the secure boot chain is broken. Fix this by adding a shim replacement whose sole job is to install the protocol and call the boot loader via the normal fashion (meaning the bootloader must be signed with a key in the secure boot database). The second stage loader can then use the protocol to verify any images against the secure boot database as well. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-23pkcs7verify: add protocol locate functionJames Bottomley3-1/+63
Add a function which tries to locate the protocol but then tries to load the Pkcs7VerifyDxe.efi file to provide it if it's not found. This allows us to rely on pkcs7verify always being present in the platform, because we can supply it simply by placing a signed copy from tianocore in the root directory. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-23shim_protocol: add protocol installerJames Bottomley3-1/+160
The shim_protocol is necessary because it is used as a callback by grub to verify the signature of linux kernel images. This means that even if you're relying entirely on the secure boot keys, you cannot simply replace shim.efi with grub.efi. Add a shim protocol installer in preparation for adding a replacement shim that does nothing other than install the protocols and execute grub. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-23pkcs7verify: add header and GUID copied from tianocoreJames Bottomley3-0/+211
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-23pcoff: add pecoff_get_signature functionJames Bottomley2-0/+31
This will be used later in the shim_protocol signature verifier. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-14Version: 1.6.1v1.6.1James Bottomley1-1/+1
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-14Fix ARM32 buildJames Bottomley8-0/+52
This is a complete hack: the efi.h headers include a Which allows arm32 to build efi binaries, but wreaks havoc if you just want to use EFI definitions in normal C code. We hack around this in the libraries by doing an extra However, there should be a better way ... Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-12arm build fixesJames Bottomley19-335/+191
This is a monster bunch. Firstly, eliminate the efi call wrapper thunking. On the security policy override, this was done via an x86_64 asm routine which won't work on non-x86. The build arm objects using the -O binary objcopy method and take the linker scripts from gnu-efi rather than hand rolling. Confine the EFI building machinery to its own include file (not having this correct was causing an OBS build failure on arm) Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-09Version: 1.6.0v1.6.0James Bottomley1-1/+1
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-09enable arm buildsJames Bottomley1-1/+7
Now that the x86 specific thunk is removed, efitools should build for arm Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2016-02-09security_policy: switch to EFIAPI calling conventionJames Bottomley3-119/+13
Remove the assembly thunk that converts between EFI and C calling conventions on x86_64 and use the EFIAPI tag instead, which informs gcc to use the EFI calling conventions for the function. This means security_policy.o can now be built unconditionally for all architectures Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2015-03-17flash-var: new routine for manipulating variables in flash imagesJames Bottomley4-1/+335
It only currently does secure variables and is primarily designed for embedding keys in EFI bios images. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-03-17guid: add authenticated variable guidJames Bottomley2-0/+2
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-03-17guid.c: add function to calculate owner GUID for known authenticated variablesJames Bottomley2-0/+23
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-03-12Version: 1.5.3v1.5.3James Bottomley1-1/+1
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-03-12Fix month offset problemJames Bottomley3-2/+4
ktgsmith reports that we have a cocup constructing the EFI_TIMESTAMP because the unix value tm_mon is 0-11 and the EFI_TIMESTAMP Month field is 1-12. Fix this by adding one everywhere we use tm_mon. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-01-22Version: 1.5.2v1.5.2James Bottomley1-1/+1
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-01-22sha256: Calculate hashes correctly for both X64 and IA32James Bottomley5-22/+41
In fact, the hash calculation was working more by luck than judgement. We need to be very careful dealing with the sections to make sure we use the correct part of the optional header. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-01-21pecoff: handle both IA32 and X64 imagesJames Bottomley1-10/+26
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2015-01-06Make alterations for 32 bit cross compileJames Bottomley5-15/+110
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22Version 1.5.1v1.5.1James Bottomley1-1/+1
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22cert-to-efi-hash-list: only hash over TBSCertificateJames Bottomley1-1/+1
The UEFI spec mandates this, but Tianocore was hashing over the whole certificate. Now that Tianocore is patched, construct the correct hash. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22Version 1.5.0v1.5.0James Bottomley1-1/+1
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22cert-to-efi-hash-list: add man pageJames Bottomley1-0/+30
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22Makefile: Consolidate auth file building rulesJames Bottomley2-5/+16
It's getting a bit complex with hashes, blacklists, updates etc, so consolidate Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22KeyTool: Display revocation signature hashesJames Bottomley1-0/+20
Add the correct types for signature revocation hashes Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22cert-to-efi-hash-list: binary for blacklisting by hashJames Bottomley5-3/+263
The UEFI spec includes the ability to blacklist in dbx by key hash rather than by key (including a revocation timestamp). Implement this. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22cert-to-efi-sig-list: clear FIPS errors on module loadJames Bottomley1-0/+5
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22ReadVars, UpdateVars: add support for dbtJames Bottomley2-16/+27
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22KeyTool: add support for dbtJames Bottomley1-6/+24
dbt is the signature timestamp database supported by UEFI 2.4 Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-22variable.h: add dbt detection supportJames Bottomley1-1/+2
There's an OS indication for the timestamp signature database, so add the definition. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-20KeyTool: consolidate definitions in keyinfo variableJames Bottomley1-17/+4
Remove an internal copy Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-19Version 1.4.4v1.4.4James Bottomley1-1/+1
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-19Make: allow creation of multiple db certificatesJames Bottomley2-3/+2
These are rule preparations for multi-sign Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-18Add MS KEK update bundleJames Bottomley2-2/+124
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-17Add more .auth file generatorsJames Bottomley2-20/+21
Generate pk signed updates for db and generate blacklists of DB and the ms-uefi cert for dbx Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-17console.c: Fix longstanding bug (causing crashes)James Bottomley1-6/+5
The switch between a variable length selector and a fixed one is wrong. It's hardcoded to be rows - 10 instead of rows - 6 - title_lines. This means when you have exactly the right number of rows in the selector it switches over to a variable selector too early and displays non-existent selector lines (which may run off the end of memory and crash). Also tidy up the selector to keep a blank line between the title and the beginning of the selector. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-17sign-efi-sig-list: fix timestampsJames Bottomley2-7/+19
The original bug which required timestamps a year in the future is long gone, so kill the hardcoding and use the correct timestamp from the current date. Also fix a race condition where noPK.auth could have the same timestamp as PK.auth on fast build machines and thus fail to update. Convert all times to platform local and use ISO date format for the -t option. Finally zero the timestamp for update requests as required by the spec Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-17Build an update bundle for the Microsoft db keyJames Bottomley2-1/+45
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-16Makefile: add targets for DB and KEK update as well as replaceJames Bottomley1-1/+9
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-16Keytool: Add ability to execute binary (no arguments)James Bottomley1-1/+50
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-16Fix Make cleanJames Bottomley2-0/+3
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-07version 1.4.3v1.4.3James Bottomley1-1/+1
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-12-07sign-efi-sig-list: remove all authenticated attributes from signatureJames Bottomley1-3/+4
UEFI section 7.2.1 requires this and the current PKCS7 routines leave attributes like s/mime types and signing time in there. Fix this by using the PCKS7_NOATTRS flag. Signed-off-by: James Bottomley <JBottomley@Parallels.com> # Please enter the commit message for your changes. Lines starting # with '#' will be ignored, and an empty message aborts the commit. # Explicit paths specified without -i or -o; assuming --only paths... # On branch master # Your branch is up-to-date with 'origin/master'. # # Changes to be committed: # modified: sign-efi-sig-list.c # # Untracked files: # acer/ # lib/kernel_efivars.c.rej # tmp.sig # # Please enter the commit message for your changes. Lines starting # with '#' will be ignored, and an empty message aborts the commit. # # Date: Sun Dec 7 13:09:37 2014 -0800 # # On branch master # Your branch is ahead of 'origin/master' by 2 commits. # (use "git push" to publish your local commits) # # Changes to be committed: # modified: sign-efi-sig-list.c # # Untracked files: # acer/ # lib/kernel_efivars.c.rej # tmp.sig #
2014-12-07sign-efi-sig-list: fixs FIPS module verification errorsJames Bottomley1-0/+5
On openSUSE at least, the FIPS module is loaded separately. Unfortunately this will cause openssl to fail the FIPS verification on loading all ciphers: 139983138506384:error:2D06C06E:FIPS routines:FIPS_module_mode_set:fingerprint does not match:fips.c:429: The error is harmless, but annoying, so clear it out of the error buffer after loading everything. Signed-off-by: James Bottomley <JBottomley@Parallels.com> # Please enter the commit message for your changes. Lines starting # with '#' will be ignored, and an empty message aborts the commit. # Explicit paths specified without -i or -o; assuming --only paths... # On branch master # Your branch is up-to-date with 'origin/master'. # # Changes to be committed: # modified: sign-efi-sig-list.c # # Untracked files: # acer/ # lib/kernel_efivars.c.rej # tmp.sig #
2014-05-27safer mount output parsingsakaki1-1/+1
When trying it recently on a Gentoo box (running LVM), I encountered a problem - all the programs would exit with "No efivarfs filesystem is mounted" Tracking this down, it turns out that the output of the mount command contains an extra field (in Gentoo anyway) when it is an LVM mount - so for example, I get: # mount -l proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) none on /run type tmpfs (rw,nosuid,nodev,relatime,mode=755) udev on /dev type devtmpfs (rw,nosuid,relatime,size=10240k,nr_inodes=995888,mode=755) devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620) sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime) /dev/mapper/vg1-root on / type ext4 (rw,noatime,discard,errors=remount-ro,data=ordered) *[root]* tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev) tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755) cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd) efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime) tmpfs on /tmp type tmpfs (rw) fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime) /dev/mapper/vg1-home on /home type ext4 (rw,relatime,discard,data=ordered) *[home]* Note the entries in bold ('[root]' and '[home]'). These mess up the sscanf parsing in the kernel_variable_init() function, getting it out of step, and ultimately meaning that it fails to recognize the efivarfs entry. Hence the error. The enclosed small patch fixes this, by switching the final "%*s\n" in the sscanf to "%*[^\n]\n", which will consume anything up to the newline. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2014-01-18kernel_efivars: Fix detection of efivarfs filesystem path.Edwin1-2/+2
Make init correctly detect the efivarfs filesystem path based on mount output. Before this patch code only works when the efivarfs filesystem is the last entry in the mount output. Signed-off-by: Edwin de Caluwe <edwindecaluwe@gmail.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-09-19Makefile/Make.rules: don't rely on vim-corev1.4.2Greg Kroah-Hartman3-2/+52
This adds the xxdi.pl script to replace the call to 'xxd -i', removing a build dependancy on vim-core, which some distros don't really want to have (i.e. Gentoo and its build derivatives like ChromeOS and CoreOS.) Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-04-17COPYING: complete lib/ transition to LGPLJames Bottomley1-1/+512
This just tidies up the transition by actually adding a copy of LGPLv2.1 to the COPYING file and also adding a future permission from contributors for the code to change licence if a move into or out of lib/ is deemed necessary. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-19efi-readvar: add MokList as possible variable to read fromJames Bottomley1-2/+2
2013-03-11COPYING: update licence: GPLv2+openSSL and LGPLv2.1James Bottomley1-1/+4
The licence is changed to make all files in lib/ distributed under LGPL 2.1 to make it easy for the library components to be incorporated into other works not necessarily distributed under GPL. All other programmes are distributed under GPLv2 with an openSSL additional permission so the binaries could be linked with openSSL should someone wish to add cryptographic details. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-08security_policy: check that the override is actually installedJames Bottomley1-0/+8
Read back the memory we wrote to for installing it and verify that it was changed. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-07cert-to-efi-sig-list: remove unimplemented RSA2048 certificate supportJames Bottomley1-9/+2
2013-03-07efitools: fix build warnings in cert-to-efi-sig-list.cJiri Kosina1-0/+1
Fix cert-to-efi-sig-list.c:60:4: warning: implicit declaration of function ‘str_to_guid’ [-Wimplicit-function-declaration] by properly including guid.h Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-05Version: 1.4.1v1.4.1James Bottomley1-1/+1
2013-03-05UpdateVars: need %s not %d to print a filenameJames Bottomley1-1/+1
2013-03-05PreLoader: add keystroke check to start HashToolJames Bottomley1-0/+5
This adds a no wait keystroke check to PreLoader. If you boot up and hold down the 'H' key, it will automatically start HashTool even if the hash of the loader is already enrolled. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-05console: add new console_check_for_keystroke() functionJames Bottomley2-0/+26
This new function will check if a key has been pressed without waiting and return true if it has. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-05variables: Fix SetMem cockupJames Bottomley2-4/+4
SetMem takes the arguments dest, size, character, not like the unix memset prototype (thanks EFI committe). Fix this in a couple of places where a variable wasn't getting zeroed. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-01Fix for Ubuntu BuildsJames Bottomley1-1/+1
2013-03-01fix for debian builds (include sys/wait.h for WEXITSTATUS)James Bottomley2-1/+2
2013-03-01Version 1.4.0v1.4.0James Bottomley1-1/+1
for in linux key manipulations
2013-03-01efi-keytool is vestigial, don't build itJames Bottomley1-1/+1
2013-03-01efi-updatevar: Add variable deletion as an optionJames Bottomley2-8/+73
Enable a -d <sig>[-<entry>] option to delete signature <entry> of Signature List <sig> or the entire signature list. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-03-01efi-updatevar: add ability to update in User ModeJames Bottomley2-8/+148
For this to work, you must possess the secret key for the relevant signing variable (PK for PK and KEK or KEK for db and dbx). We actually check the private key against all public keys in the variable to make sure everything is OK and then do a signed update. so to add the hash of HelloWorld.efi to db, the command issued would be efi-updatevar -k KEK.key -b HelloWorld.efi db Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-02-28efi-updatevar: use hash_to_esl() functionJames Bottomley1-5/+14
-g <guid> for -b now works
2013-02-28kernel_efivars: separate out hash to esl conversion function for later useJames Bottomley2-9/+28
2013-02-28efi-updatevar: add ability to insert X509 key from certificate fileJames Bottomley2-23/+79
Also accept certificate file in DER format with .der or .cer extension. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-02-28guid: return error if str_to_guid() failsJames Bottomley2-7/+11
2013-02-28efi-readvar: add option to save signature listsJames Bottomley1-4/+23
2013-02-28efi-readvar: add documentation and variable list restrictionsJames Bottomley2-6/+96
2013-02-27Makefile: Correct a cockup in .auth file generationJames Bottomley2-3/+9
The .auth file generator is completely wrong: the PK and KEK have to be signed with PK; DB has to be signed with KEK
2013-02-27efi-updatevar: add utility to perform the tasks of UpdateVars.efiJames Bottomley6-2/+304
2013-02-27kernel_efivars: fix check for fedoraJames Bottomley1-4/+15
For some weird reason, mount -l -t efivarfs is illegal on fedora. Just do mount -l and grep for efivarfs.
2013-02-27efi-keytool, efi-readvar: begin constructing linux versions of efi toolsJames Bottomley4-1/+161
keytool is basically vestigial. readvar does most of what ReadVar.efi does. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-02-27guid: add compare_guid() function for linux executablesJames Bottomley2-0/+7
2013-02-27kernel_efivars: add library routine to parse efivarfs entriesJames Bottomley5-17/+170
This will be the basis for reconstructing most of the efi tools as linux utilities Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-02-23Version 1.3.6v1.3.6James Bottomley1-1/+1
2013-02-23Make.rules: add a finder for all the daft places gnu-efi installs on distrosJames Bottomley1-2/+5
2013-02-18PreLoader: add check to permit booting on a non secure boot systemJames Bottomley1-1/+29
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-02-04Version 1.3.5v1.3.5James Bottomley1-1/+1
2013-02-04PreLoader: per Microsoft request, remove KeyTool from authorised hashJames Bottomley1-1/+1
2013-02-02ReadVars: add -c option (no print)James Bottomley1-3/+7
2013-01-22ReadVars: Update to allow single variable selection and asn1 parse x509James Bottomley2-34/+117
2013-01-22UpdateVars: Factor out argsplitJames Bottomley4-46/+61
2013-01-22ReadVars: add Mok VariableJames Bottomley1-2/+2
2013-01-22UpdateVars: Fix to work on shells that don't erroneously have a trailing spaceJames Bottomley1-7/+9
2013-01-22UpdateVars: Add ability to calculate hash from binaryJames Bottomley1-4/+20
2013-01-22UpdateVars: Allow updating of MoK variablesJames Bottomley1-6/+21
2013-01-20Version 1.3.4v1.3.4James Bottomley1-1/+1
2013-01-20security_policy: per UEFI spec, explicit hash can override forbidden sigJames Bottomley1-7/+0
to override and explicit hash, there has to be a hash in dbx
2013-01-20configtable: remove rest of debugging printsJames Bottomley1-3/+5
2013-01-20security_policy: don't check image table in legacy if mok failsJames Bottomley1-2/+1
If the MoK test fails, no need to check the image table as well. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-20security_policy: Consult the image table to find dbx forbidden keysJames Bottomley4-3/+220
Since the basis of the ease of matching on Mok is hashes only, we can't tell when we're executing an efi utility that is signed with a revoked key. We can fix this by looking at the entries in the image execution information table and seeing why the image execution was failed. There's a complication in this in that very few manufacturers seem to have implemented the image execution information table to spec (most miss out the required application name), so we have to parse it heuristically and try to check for errors. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-20console: fix bug where ESC isn't properly propagatedJames Bottomley1-0/+3
In a long selector, if you scroll down, ESC isn't reported correctly. Fix By making sure -1 is returned instead of adding it to the offset. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-16Version 1.3.3v1.3.3James Bottomley1-1/+1
2013-01-16console: no return from console_reset()James Bottomley2-2/+2
2013-01-09KeyTool: TianoCore still allows unathenticated updates in user modeJames Bottomley2-4/+6
Fix by preventing
2013-01-09HashTool: Don't display keytool prompt if no executableJames Bottomley1-1/+1
2013-01-09KeyTool: Better errors on save keysJames Bottomley2-7/+8
some platforms (tianocore) are giving invalid parameter occasionally to the request to save keys in the root->Open function. Still no idea why, but make sure diagnosis is easier. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-09console, PreLoader: add console resetJames Bottomley3-0/+15
The console may be ill defined, add a reset to mode 0 (which is required to be present) to fix this. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-09security_policy: fix a problem with the UEFI confusion over security failureJames Bottomley1-4/+17
The UEFI spec is confused (and has changed with later revisions) over whether EFI_ACCESS_DENIED or EFI_SECURITY_VIOLATION should be returned for a signature verification failure and subsequent refusal to execute. Originally security_policy returned EFI_SECURITY_VIOLATION as required by the latest Errata C. However this isn't correct on some platforms, so cache the security failure return and return the cached value in the event that the MOK checks fail. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-07Version: 1.3.2v1.3.2James Bottomley1-1/+1
2013-01-07security_policy: don't allow internal hash to override dbxJames Bottomley1-1/+1
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-07KeyTool: Fix key deletionJames Bottomley1-29/+38
It works by deleting full signature lists. Make it work if the key is in the middle of a signature list. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-02console: fix problem with ESC and no selectionJames Bottomley3-5/+8
Must use a high positive number to initialise unselected variables, so make it NOSEL and put it in console.h Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-01KeyTool: Permit saving of individual keys in their entiretyJames Bottomley1-55/+119
2013-01-01Error handling for sha256 hash failuresJames Bottomley3-4/+24
We can only hash valid EFI binaries, so print error if hash fails. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2013-01-01KeyTool: Add MokList to list of saved variablesJames Bottomley1-2/+3
2013-01-01hash-to-efi-sig-list: Allow creation of multiple hashesJames Bottomley1-25/+33
Within the same signature list for testing purposes. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-31KeyTool: should still be able to delete MOK entries in user modeJames Bottomley1-1/+1
2012-12-31KeyTool: Fix hang when saving all keysJames Bottomley1-0/+1
2012-12-31KeyTool: Implement adding certificates from DER format .cer filesJames Bottomley3-51/+47
2012-12-31sig-list-to-certs: use new traversal mechanismJames Bottomley1-57/+63
2012-12-30Keytool/Variables: Improve signature list traversal.James Bottomley3-38/+36
Move efi signature list traversal into a macro to make sure it goes correctly every time. Also fix a bug traversing multiple signatures in the same signature list. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-30UpdateVars: Allow updating with an esl fileJames Bottomley1-32/+17
Also tidy up some dangling functions now in variables.c
2012-12-30variables.c: Don't do an ESL update to PK in user modeJames Bottomley1-5/+14
MS request, plus tidy up functions a bit
2012-12-30Hashtool: eliminate option to move programmatically to setup modeJames Bottomley1-7/+9
2012-12-20Version: 1.3.1v1.3.1James Bottomley1-1/+1
2012-12-20console.c: fix oversize lines in printingJames Bottomley1-11/+10
2012-12-20Version 1.3v1.3James Bottomley1-1/+1
2012-12-20Update with changes required by MicrosoftJames Bottomley3-10/+24
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-12Merge branch 'v1.2'James Bottomley1-6/+7
Pull in generate_path() fix
2012-12-12execute: fix some of the quirks in DevPathToStr()James Bottomley1-6/+7
Apparently it can use a forward slash '/' anywhere in the path name to indicate the split between the device the file is on and the rest of the name. Turn it back to a backslash '\' and make sure we don't have multiple ones at the end. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-12security_policy: put the return in the right place!James Bottomley1-2/+2
2012-12-12gitignore: test binary and a few other filesJames Bottomley2-0/+7
2012-12-12enumerator: pull out lots of unused codeJames Bottomley2-296/+0
2012-12-12identification: work in both EFI and non-EFI environmentsJames Bottomley2-3/+6
All ASN1 strings are ASCII like encodings. To display this in the EFI SPrint() and equivalents you have to use %a. However for normal printf this has to be %s, so abstract this difference Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-12asn1: eliminate more unused code from identification.cJames Bottomley2-103/+4
2012-12-12Keytool: Display rudimentary asn1 information about the keysJames Bottomley7-15/+75
Use the asn1 parser to print subject and issuer Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-12asn1: complete definitions and strip copied filesJames Bottomley15-1968/+88
2012-12-12asn1: more updates to pare the parser downJames Bottomley4-37/+38
2012-12-12asn1: complete parser with more pieces from strongswanJames Bottomley11-0/+2511
2012-12-12asn1: Add parser files straight from strongswan-5.0.1James Bottomley8-0/+2689
2012-12-12Merge tag 'v1.2.3'James Bottomley6-4/+17
version: 1.2.3 Merge fixes from 1.2.3 into main trunk
2012-12-11version: 1.2.3v1.2.3James Bottomley1-1/+1
2012-12-11SetNull: simple program to prevent *NULL from being 0James Bottomley2-1/+12
2012-12-11version: 1.2.2v1.2.2James Bottomley1-1/+1
2012-12-11simple_file: fix missing files problemJames Bottomley4-3/+5
If the filter is NULL, simple file dereferences *NULL. It just so happens on a lot of systems this is zero and everything works, but on sime it isn't and thus no files appear. Fix this by explicitly checking for NULL and replacing it with a pointer to the empty string. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-11KeyTool: Add ability to enrol hashJames Bottomley6-63/+168
Split out hash enrollment functionality from HashTool into library functions and add it to KeyTool. Also add showing of hash when examining keys. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-11console: make selected option sticky and use in KeyTool and HashToolJames Bottomley4-11/+27
2012-12-08KeyTool: Improve key saving dialogue (add volume selector)James Bottomley1-1/+35
2012-12-08PreLoader: add error box for security policy uninstallJames Bottomley1-1/+3
Platform will basically become unusable (it will crash on the next Binary due to the dangling security policy pointer) so say so.
2012-12-08security_policy: fix five arg thunk and always install all possible policiesJames Bottomley1-30/+37
Chances are there's some platform that implements security2 but actually has the Authenticode checker in the original security policy. For this case, make sure we install both security policy handlers. Experiment shows that arg5 is at 0x28(%rsp) not 32(%rsp). Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-07version 1.2.1v1.2.1James Bottomley1-1/+1
2012-12-07Fix the file selectors to work properly in a relative directoryJames Bottomley4-77/+45
2012-12-07version: 1.2.0v1.2.0James Bottomley1-1/+1
2012-12-07security_policy: Make it functional on PI 1.2 systemsJames Bottomley5-41/+223
Apparently security2_policy was a PI 1.2.1 addition, so most current UEFI systems only support the prior security_policy. Fix our security policy to check for security2 first and fall back if it's not found Also fix up the thunking between EFI and ELF so it actually works Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-06Bump version to 1.1.0v1.1.0James Bottomley1-1/+1
2012-12-06PreLoader: Add dialogue boxes and make suitable for gummibootJames Bottomley1-14/+40
2012-12-06simple_file: Put .. directory last alwaysJames Bottomley1-11/+25
2012-12-06simple_file: Fix directory traversalJames Bottomley1-10/+12
It was broken when the multiple entries filter was introduced
2012-12-06security_policy: remove debuggingJames Bottomley3-13/+0
2012-12-06gitignore: ignore new hash-to-efi-sig-list and *.hash filesJames Bottomley1-0/+2
2012-12-06Move PreLoader and HashTool to new execution modelJames Bottomley2-17/+22
2012-12-06sha256.h: main dir efi objects aren't built with BUILD_EFIJames Bottomley1-2/+0
2012-12-06execute: add capability to execute via Boot ServicesJames Bottomley5-130/+175
plus split generate_path() out of simple_file
2012-12-06add new security_policyJames Bottomley3-1/+214
This library file has an installable security policy which overrides the default policy in EFI_SECURITY2_ARCH_PROTOCOL with a MOK based one before falling back to the previous policy. The design of this is that the firstboot system can install the new security policy (including static keys carried in its body) and then use the standard UEFI execution mechanisms to spawn the next programs (so no need to load and link the executables). The security policy change remains in force until the first boot loader exits. This is required because the new breed of EFI bootloaders (like gummiboot) use the standard EFI execution calls to start kernels. Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-06guid: add SECURITY2_PROTOCOL_GUIDJames Bottomley2-0/+2
2012-12-06variables: separate find_in_esl() from find_in_variable_esl()James Bottomley2-7/+23
2012-12-04Loader: rename boot loader to linux-loader.efiJames Bottomley1-1/+1
2012-12-04version: add automated version numbersv1.0.0James Bottomley4-18/+11
set at 1.0.0
2012-12-04PreLoader: Add built in whitelist hash tableJames Bottomley5-6/+36
This allows us to pre-authorise some of the other pre-build binaries (currently only HashTool.efi, Loader.efi and KeyTool.efi) Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-04hash-to-efi-sig-list: new binary to create hashes as efi signature listsJames Bottomley6-26/+189
2012-12-04simple_file: fix bug in generate_path on top level filesJames Bottomley1-1/+2
2012-12-03HelloWorld: Add return to shut obs upJames Bottomley1-0/+2
2012-12-03Remove debugging statementsJames Bottomley2-6/+1
2012-12-03mkusb.sh: script to create a bootable USB image with the filesJames Bottomley2-0/+38
2012-12-03HashTool: KeyTool binary needs preceeding backslashJames Bottomley1-1/+1
2012-12-03HelloWorld: Replace with console box based oneJames Bottomley2-9/+11
There's no point having the old helloworld, which prints and exits because UEFI secure boot systems don't have a shell, so replace with one that does a splash screen message and waits for input Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-03Fix problem with efi status returnJames Bottomley2-4/+4
Have to expect either EFI_ACCESS_DENIED or EFI_SECURITY_VIOLATION if there's a signature failure loading a binary Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-12-03Makefile: go back to single signature binariesJames Bottomley2-6/+9
We previously did kek and db signing because a prior version of the UEFI spec allowed it. It's now disallowed, so only sign with db key
2012-12-03PreLoader: Simple preloaderJames Bottomley2-1/+58
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-17 21:52:53 +0000