|
 |
4210fa |
From eb4cb6a50981f9ef4698b3847bd32e70081ab71d Mon Sep 17 00:00:00 2001
|
|
|
4210fa |
From: Peter Jones <pjones@redhat.com>
|
|
|
4210fa |
Date: Wed, 25 Jun 2014 10:55:56 -0400
|
|
|
4210fa |
Subject: [PATCH 41/74] Make sure we default to assuming we're locked down.
|
|
|
4210fa |
|
|
|
4210fa |
If "SecureBoot" exists but "SetupMode" does not, assume "SetupMode" says
|
|
|
4210fa |
we're not in Setup Mode.
|
|
|
4210fa |
|
|
|
4210fa |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
4210fa |
---
|
|
|
4210fa |
include/variables.h | 2 +-
|
|
|
4210fa |
lib/variables.c | 8 ++++----
|
|
|
4210fa |
shim.c | 8 +++++++-
|
|
|
4210fa |
3 files changed, 12 insertions(+), 6 deletions(-)
|
|
|
4210fa |
|
|
|
4210fa |
diff --git a/include/variables.h b/include/variables.h
|
|
|
4210fa |
index b207dbf..deed269 100644
|
|
|
4210fa |
--- a/include/variables.h
|
|
|
4210fa |
+++ b/include/variables.h
|
|
|
4210fa |
@@ -50,7 +50,7 @@ SETOSIndicationsAndReboot(UINT64 indications);
|
|
|
4210fa |
int
|
|
|
4210fa |
variable_is_secureboot(void);
|
|
|
4210fa |
int
|
|
|
4210fa |
-variable_is_setupmode(void);
|
|
|
4210fa |
+variable_is_setupmode(int default_return);
|
|
|
4210fa |
EFI_STATUS
|
|
|
4210fa |
variable_enroll_hash(CHAR16 *var, EFI_GUID owner,
|
|
|
4210fa |
UINT8 hash[SHA256_DIGEST_SIZE]);
|
|
|
4210fa |
diff --git a/lib/variables.c b/lib/variables.c
|
|
|
4210fa |
index 4c64d7e..59d7d05 100644
|
|
|
4210fa |
--- a/lib/variables.c
|
|
|
4210fa |
+++ b/lib/variables.c
|
|
|
4210fa |
@@ -139,7 +139,7 @@ SetSecureVariable(CHAR16 *var, UINT8 *Data, UINTN len, EFI_GUID owner,
|
|
|
4210fa |
/* Microsoft request: Bugs in some UEFI platforms mean that PK or any
|
|
|
4210fa |
* other secure variable can be updated or deleted programmatically,
|
|
|
4210fa |
* so prevent */
|
|
|
4210fa |
- if (!variable_is_setupmode())
|
|
|
4210fa |
+ if (!variable_is_setupmode(1))
|
|
|
4210fa |
return EFI_SECURITY_VIOLATION;
|
|
|
4210fa |
|
|
|
4210fa |
if (createtimebased) {
|
|
|
4210fa |
@@ -279,17 +279,17 @@ find_in_variable_esl(CHAR16* var, EFI_GUID owner, UINT8 *key, UINTN keylen)
|
|
|
4210fa |
}
|
|
|
4210fa |
|
|
|
4210fa |
int
|
|
|
4210fa |
-variable_is_setupmode(void)
|
|
|
4210fa |
+variable_is_setupmode(int default_return)
|
|
|
4210fa |
{
|
|
|
4210fa |
/* set to 1 because we return true if SetupMode doesn't exist */
|
|
|
4210fa |
- UINT8 SetupMode = 1;
|
|
|
4210fa |
+ UINT8 SetupMode = default_return;
|
|
|
4210fa |
UINTN DataSize = sizeof(SetupMode);
|
|
|
4210fa |
EFI_STATUS status;
|
|
|
4210fa |
|
|
|
4210fa |
status = uefi_call_wrapper(RT->GetVariable, 5, L"SetupMode", &GV_GUID, NULL,
|
|
|
4210fa |
&DataSize, &SetupMode);
|
|
|
4210fa |
if (EFI_ERROR(status))
|
|
|
4210fa |
- return 1;
|
|
|
4210fa |
+ return default_return;
|
|
|
4210fa |
|
|
|
4210fa |
return SetupMode;
|
|
|
4210fa |
}
|
|
|
4210fa |
diff --git a/shim.c b/shim.c
|
|
|
4210fa |
index 14fb601..fe73ec1 100644
|
|
|
4210fa |
--- a/shim.c
|
|
|
4210fa |
+++ b/shim.c
|
|
|
4210fa |
@@ -484,7 +484,13 @@ static BOOLEAN secure_mode (void)
|
|
|
4210fa |
return FALSE;
|
|
|
4210fa |
}
|
|
|
4210fa |
|
|
|
4210fa |
- if (variable_is_setupmode() == 1) {
|
|
|
4210fa |
+ /* If we /do/ have "SecureBoot", but /don't/ have "SetupMode",
|
|
|
4210fa |
+ * then the implementation is bad, but we assume that secure boot is
|
|
|
4210fa |
+ * enabled according to the status of "SecureBoot". If we have both
|
|
|
4210fa |
+ * of them, then "SetupMode" may tell us additional data, and we need
|
|
|
4210fa |
+ * to consider it.
|
|
|
4210fa |
+ */
|
|
|
4210fa |
+ if (variable_is_setupmode(0) == 1) {
|
|
|
4210fa |
if (verbose && !in_protocol)
|
|
|
4210fa |
console_notify(L"Platform is in setup mode");
|
|
|
4210fa |
return FALSE;
|
|
|
4210fa |
--
|
|
|
4210fa |
1.9.3
|
|
|
4210fa |
|