Cert needs to be modified inside the Index loop, not outside it. This is unlikely to ever trigger since there will typically only be one X509 certificate per EFI_SIGNATURE_LIST, but fix it anyway.
We could potentially find a valid signature and then fail to validate it due to not breaking out of the outer while loop.
load_image() didn't allocate PathName, don't have it free it.
Type-checking the UEFI calls picked up a couple of problems. Fix them up.
Brief overview of the function and format of the various variables used by Shim and MokManager.
The size of vendor dbx must be 0 if there is no vendor dbx provided or the functions of db check will crash.
Permit clearing of the password, and avoid a case where choosing not to set a password would result in an error message on exit. Fix the same problem with MokSB.
The logic used in checking the signature validation password was a bit ugly. Improve that so it behaves rather more as expected.
read_header would fail if the binary was unsigned, even if we weren't then going to verify the signature. Move that check to the verify function instead.
Fixes for some small bugs noticed during review
Another case where we were drawing text over existing text.
This was hardcoded, rather than being based on the actual password length, resulting in incorrect hashes being generated.
Update this to match the new mokutil behaviour
A cut and paste error meant that attempts to delete MokList were instead appending a zero-length addition.
Add a helper function and tidy up the calls for getting into MokManager
The pointer to the certificate needs to be incremented by the size of the entire certificate, not just the certificate data.
In some rare corner cases, it's useful to add a blacklist of things that were allowed by a copy of shim that was never signed by the UEFI signing service. In these cases it's okay for them to go into a local dbx, rather than taking up precious flash. Signed-off-by: Peter Jones <firstname.lastname@example.org>
We were drawing prompts on top of existing text, which was less than ideal.
There's no point in printing the SHA1 of a SHA256...
Reduce menu redrawing by only redrawing the invalidated section of the menu during the timeout countdown.
Add support for setting an MOK password. The OS passes down a password hash. MokManager then presents an option for setting a password. Selecting it prompts the user for the same password again. If they match, the hash is enrolled into a boot services variable and MokManager will prompt for the password whenever it's started.
If a callback returns any kind of failure, wait for a keypress in order to give the user an opportunity to read any failure messages.
If we're configured to run untrusted code, print a message and skip the validation checks.
Provide a mechanism for a physically present end user to disable signature verification. This is handled by the OS passing down a variable that contains a UINT32 and a SHA256 hash. If this variable is present, MokManager prompts the user to choose whether to enable or disable signature validation (depending on the value of the UINT32). They are then asked to type the passphrase that matches the hash. This then saves a boot services variable which is checked by shim, and if set will skip verification of signatures.
Provide a little more contextual information when people are in shim menus.
The size of the DevPath string array was not sufficient to append the volume label. This patch extends the size for the label and re-enables the menu freeing.
Some systems will show an error dialog if LoadImage() returned EFI_ACCESS_DENIED, which then requires physical user interaction to skip. Let's just remove the LoadImage/StartImage code, since the built-in code is theoretically equivalent.
Using the same format as the UEFI key databases makes it easier for the kernel to parse and extract keys from MOK, and also permits MOK to contain multiple key or hash types. Additionally, add support for enrolling hashes.
We want to be able to generate hashes, so split out the hash generation function from the verification function
In theory vendors could blacklist binaries with SHA1, so make sure we calculate and check that hash as well.