Attachment 693597 Details for Bug 907406 – Patch to not enable secure boot mode if MokSBState is set

Patch to not enable secure boot mode if MokSBState is set

0001-efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch (text/plain), 1.76 KB, created by Josh Boyer on 2013-02-06 00:32:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Josh Boyer

Created: 2013-02-06 00:32:27 UTC

Size: 1.76 KB

patch

obsolete

>From 04a46ceeb9eb2dca0364ce836614de722e988c81 Mon Sep 17 00:00:00 2001
>From: Josh Boyer <jwboyer@redhat.com>
>Date: Tue, 5 Feb 2013 19:25:05 -0500
>Subject: [PATCH] efi: Disable secure boot if shim is in insecure mode
>
>A user can manually tell the shim boot loader to disable validation of
>images it loads.  When a user does this, it creates a UEFI variable called
>MokSBState that does not have the runtime attribute set.  Given that the
>user explicitly disabled validation, we can honor that and not enable
>secure boot mode if that variable is set.
>
>Signed-off-by: Josh Boyer <jwboyer@redhat.com>
>---
> arch/x86/boot/compressed/eboot.c | 20 +++++++++++++++++++-
> 1 file changed, 19 insertions(+), 1 deletion(-)
>
>diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
>index 96bd86b..6e1331c 100644
>--- a/arch/x86/boot/compressed/eboot.c
>+++ b/arch/x86/boot/compressed/eboot.c
>@@ -851,8 +851,9 @@ fail:
> 
> static int get_secure_boot(efi_system_table_t *_table)
> {
>-	u8 sb, setup;
>+	u8 sb, setup, moksbstate;
> 	unsigned long datasize = sizeof(sb);
>+	u32 attr;
> 	efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID;
> 	efi_status_t status;
> 
>@@ -876,6 +877,23 @@ static int get_secure_boot(efi_system_table_t *_table)
> 	if (setup == 1)
> 		return 0;
> 
>+	/* See if a user has put shim into insecure_mode.  If so, and the variable
>+	 * doesn't have the runtime attribute set, we might as well honor that.
>+	 */
>+	var_guid = EFI_SHIM_LOCK_GUID;
>+	status = efi_call_phys5(sys_table->runtime->get_variable,
>+				L"MokSBState", &var_guid, &attr, &datasize,
>+				&moksbstate);
>+
>+	/* If it fails, we don't care why.  Default to secure */
>+	if (status != EFI_SUCCESS)
>+		return 1;
>+
>+	if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS)) {
>+		if (moksbstate == 1)
>+			return 0;
>+	}
>+
> 	return 1;
> }
> 
>-- 
>1.8.1
>

Actions: View

Attachments on bug 907406: 693597