-
Notifications
You must be signed in to change notification settings - Fork 291
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Matthew Garrett
committed
Jul 28, 2012
1 parent
590b344
commit 3df9e29
Showing
1 changed file
with
16 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
shim is a trivial EFI application that, when run, attempts to open and | ||
execute another application. It will initially attempt to do this via the | ||
standard EFI LoadImage() and StartImage() calls. If these fail (because secure | ||
boot is enabled and the binary is not signed with an appropriate key, for | ||
instance) it will then validate the binary against a built-in certificate. If | ||
this succeeds and if the binary or signing key are not blacklisted then shim | ||
will relocate and execute the binary. | ||
|
||
shim will also install a protocol which permits the second-stage bootloader | ||
to perform similar binary validation. This protocol has a GUID as described | ||
in the shim.h header file and provides a single entry point. On 64-bit systems | ||
this entry point expects to be called with SysV ABI rather than MSABI, and | ||
so calls to it should not be wrapped. | ||
|
||
To use shim, simply place a hex dump of the public certificate in cert.h | ||
and build it with make. |