|
 |
9de34f |
From 092c2b2bbed950727e41cf450b61c794881c33e7 Mon Sep 17 00:00:00 2001
|
|
|
9de34f |
From: Eric Snowberg <eric.snowberg@oracle.com>
|
|
|
9de34f |
Date: Fri, 17 Jun 2022 12:37:28 -0400
|
|
|
9de34f |
Subject: [PATCH 02/13] Reference MokListRT instead of MokList
|
|
|
9de34f |
|
|
|
9de34f |
When calling back into shim from grub, the MokListRT may contain additional
|
|
|
9de34f |
entries not available in the original MokList, an example being the certs
|
|
|
9de34f |
included via user_cert. Use the MokListRT instead when calling check_db_cert
|
|
|
9de34f |
and check_db_hash.
|
|
|
9de34f |
|
|
|
9de34f |
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
|
|
|
9de34f |
---
|
|
|
9de34f |
shim.c | 8 ++++----
|
|
|
9de34f |
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
9de34f |
|
|
|
9de34f |
diff --git a/shim.c b/shim.c
|
|
|
9de34f |
index fdd205ef995..27b74ce06c3 100644
|
|
|
9de34f |
--- a/shim.c
|
|
|
9de34f |
+++ b/shim.c
|
|
|
9de34f |
@@ -397,22 +397,22 @@ static EFI_STATUS check_allowlist (WIN_CERTIFICATE_EFI_PKCS *cert,
|
|
|
9de34f |
}
|
|
|
9de34f |
#endif
|
|
|
9de34f |
|
|
|
9de34f |
- if (check_db_hash(L"MokList", SHIM_LOCK_GUID, sha256hash,
|
|
|
9de34f |
+ if (check_db_hash(L"MokListRT", SHIM_LOCK_GUID, sha256hash,
|
|
|
9de34f |
SHA256_DIGEST_SIZE, EFI_CERT_SHA256_GUID)
|
|
|
9de34f |
== DATA_FOUND) {
|
|
|
9de34f |
verification_method = VERIFIED_BY_HASH;
|
|
|
9de34f |
update_verification_method(VERIFIED_BY_HASH);
|
|
|
9de34f |
return EFI_SUCCESS;
|
|
|
9de34f |
} else {
|
|
|
9de34f |
- LogError(L"check_db_hash(MokList, sha256hash) != DATA_FOUND\n");
|
|
|
9de34f |
+ LogError(L"check_db_hash(MokListRT, sha256hash) != DATA_FOUND\n");
|
|
|
9de34f |
}
|
|
|
9de34f |
- if (cert && check_db_cert(L"MokList", SHIM_LOCK_GUID, cert, sha256hash)
|
|
|
9de34f |
+ if (cert && check_db_cert(L"MokListRT", SHIM_LOCK_GUID, cert, sha256hash)
|
|
|
9de34f |
== DATA_FOUND) {
|
|
|
9de34f |
verification_method = VERIFIED_BY_CERT;
|
|
|
9de34f |
update_verification_method(VERIFIED_BY_CERT);
|
|
|
9de34f |
return EFI_SUCCESS;
|
|
|
9de34f |
} else if (cert) {
|
|
|
9de34f |
- LogError(L"check_db_cert(MokList, sha256hash) != DATA_FOUND\n");
|
|
|
9de34f |
+ LogError(L"check_db_cert(MokListRT, sha256hash) != DATA_FOUND\n");
|
|
|
9de34f |
}
|
|
|
9de34f |
|
|
|
9de34f |
update_verification_method(VERIFIED_BY_NOTHING);
|
|
|
9de34f |
--
|
|
|
9de34f |
2.37.1
|
|
|
9de34f |
|