|
 |
5b2885 |
From 9ab0d796bdc9cefdaa3b0df7434845d26c43d894 Mon Sep 17 00:00:00 2001
|
|
|
5b2885 |
From: Patrick Uiterwijk <patrick@puiterwijk.org>
|
|
|
5b2885 |
Date: Mon, 5 Nov 2018 14:51:16 +0100
|
|
|
5b2885 |
Subject: [PATCH 1/3] Make sure that MOK variables always get mirrored
|
|
|
5b2885 |
|
|
|
5b2885 |
Without this, if a Mok variable doesn't exist in Boot Services, it will also
|
|
|
5b2885 |
not be copied to Runtime, even if we have data to be added to it (vendor cert).
|
|
|
5b2885 |
This patch makes sure that if we have extra data to append, we still mirror
|
|
|
5b2885 |
the variable.
|
|
|
5b2885 |
|
|
|
5b2885 |
Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
|
|
|
5b2885 |
---
|
|
|
5b2885 |
mok.c | 20 ++++++++++++++++----
|
|
|
5b2885 |
1 file changed, 16 insertions(+), 4 deletions(-)
|
|
|
5b2885 |
|
|
|
5b2885 |
diff --git a/mok.c b/mok.c
|
|
|
5b2885 |
index 38675211e0e..00dd1ad3034 100644
|
|
|
5b2885 |
--- a/mok.c
|
|
|
5b2885 |
+++ b/mok.c
|
|
|
5b2885 |
@@ -223,11 +223,26 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
|
|
|
5b2885 |
UINT32 attrs = 0;
|
|
|
5b2885 |
BOOLEAN delete = FALSE, present, addend;
|
|
|
5b2885 |
|
|
|
5b2885 |
+ addend = (v->addend_source && v->addend_size &&
|
|
|
5b2885 |
+ *v->addend_source && *v->addend_size)
|
|
|
5b2885 |
+ ? TRUE : FALSE;
|
|
|
5b2885 |
+
|
|
|
5b2885 |
efi_status = get_variable_attr(v->name,
|
|
|
5b2885 |
&v->data, &v->data_size,
|
|
|
5b2885 |
*v->guid, &attrs);
|
|
|
5b2885 |
- if (efi_status == EFI_NOT_FOUND)
|
|
|
5b2885 |
+ if (efi_status == EFI_NOT_FOUND) {
|
|
|
5b2885 |
+ if (v->rtname && addend) {
|
|
|
5b2885 |
+ efi_status = mirror_one_mok_variable(v);
|
|
|
5b2885 |
+ if (EFI_ERROR(efi_status) &&
|
|
|
5b2885 |
+ ret != EFI_SECURITY_VIOLATION)
|
|
|
5b2885 |
+ ret = efi_status;
|
|
|
5b2885 |
+ }
|
|
|
5b2885 |
+ /*
|
|
|
5b2885 |
+ * after possibly adding, we can continue, no
|
|
|
5b2885 |
+ * further checks to be done.
|
|
|
5b2885 |
+ */
|
|
|
5b2885 |
continue;
|
|
|
5b2885 |
+ }
|
|
|
5b2885 |
if (EFI_ERROR(efi_status)) {
|
|
|
5b2885 |
perror(L"Could not verify %s: %r\n", v->name,
|
|
|
5b2885 |
efi_status);
|
|
|
5b2885 |
@@ -272,9 +287,6 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
|
|
|
5b2885 |
}
|
|
|
5b2885 |
|
|
|
5b2885 |
present = (v->data && v->data_size) ? TRUE : FALSE;
|
|
|
5b2885 |
- addend = (v->addend_source && v->addend_size &&
|
|
|
5b2885 |
- *v->addend_source && *v->addend_size)
|
|
|
5b2885 |
- ? TRUE : FALSE;
|
|
|
5b2885 |
|
|
|
5b2885 |
if (v->flags & MOK_VARIABLE_MEASURE && present) {
|
|
|
5b2885 |
/*
|
|
|
5b2885 |
--
|
|
|
5b2885 |
2.20.1
|
|
|
5b2885 |
|