|
 |
4210fa |
From 11495d4019d44dce1487939f91f7d751ffbb9730 Mon Sep 17 00:00:00 2001
|
|
|
4210fa |
From: Andrew Boie <andrew.p.boie@intel.com>
|
|
|
4210fa |
Date: Mon, 15 Apr 2013 14:11:17 -0700
|
|
|
4210fa |
Subject: [PATCH 01/74] fix verify_mok()
|
|
|
4210fa |
|
|
|
4210fa |
() Fix the return value semantics. If the MokList doesn't
|
|
|
4210fa |
exist, we are OK. If the MokList was compromised but we
|
|
|
4210fa |
were able to erase it, that is OK too. Only if the list
|
|
|
4210fa |
can't be nuked do we return an error.
|
|
|
4210fa |
|
|
|
4210fa |
() Fix use of potentially uninitialized attribute variable
|
|
|
4210fa |
|
|
|
4210fa |
() Actually use the return value when called from verify_buffer.
|
|
|
4210fa |
|
|
|
4210fa |
Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e
|
|
|
4210fa |
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
|
|
|
4210fa |
---
|
|
|
4210fa |
shim.c | 9 +++++----
|
|
|
4210fa |
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
4210fa |
|
|
|
4210fa |
diff --git a/shim.c b/shim.c
|
|
|
4210fa |
index 23dd0ee..dcb36d0 100644
|
|
|
4210fa |
--- a/shim.c
|
|
|
4210fa |
+++ b/shim.c
|
|
|
4210fa |
@@ -670,13 +670,12 @@ static EFI_STATUS verify_mok (void) {
|
|
|
4210fa |
status = get_variable_attr(L"MokList", &MokListData, &MokListDataSize,
|
|
|
4210fa |
shim_lock_guid, &attributes);
|
|
|
4210fa |
|
|
|
4210fa |
- if (attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
|
|
|
4210fa |
+ if (!EFI_ERROR(status) && attributes & EFI_VARIABLE_RUNTIME_ACCESS) {
|
|
|
4210fa |
Print(L"MokList is compromised!\nErase all keys in MokList!\n");
|
|
|
4210fa |
if (LibDeleteVariable(L"MokList", &shim_lock_guid) != EFI_SUCCESS) {
|
|
|
4210fa |
Print(L"Failed to erase MokList\n");
|
|
|
4210fa |
+ return EFI_ACCESS_DENIED;
|
|
|
4210fa |
}
|
|
|
4210fa |
- status = EFI_ACCESS_DENIED;
|
|
|
4210fa |
- return status;
|
|
|
4210fa |
}
|
|
|
4210fa |
|
|
|
4210fa |
if (MokListData)
|
|
|
4210fa |
@@ -722,7 +721,9 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
|
|
|
4210fa |
/*
|
|
|
4210fa |
* Check that the MOK database hasn't been modified
|
|
|
4210fa |
*/
|
|
|
4210fa |
- verify_mok();
|
|
|
4210fa |
+ status = verify_mok();
|
|
|
4210fa |
+ if (status != EFI_SUCCESS)
|
|
|
4210fa |
+ return status;
|
|
|
4210fa |
|
|
|
4210fa |
/*
|
|
|
4210fa |
* Ensure that the binary isn't blacklisted
|
|
|
4210fa |
--
|
|
|
4210fa |
1.9.3
|
|
|
4210fa |
|