|
 |
bf96fb |
From 4b27ae034ba9885960e72f77b3f687a9b7fea824 Mon Sep 17 00:00:00 2001
|
|
|
bf96fb |
From: Gary Lin <glin@suse.com>
|
|
|
bf96fb |
Date: Wed, 21 Nov 2018 12:47:43 +0800
|
|
|
bf96fb |
Subject: [PATCH 2/3] mok: fix the mirroring of RT variables
|
|
|
bf96fb |
|
|
|
bf96fb |
When there is no key in MokList, import_mok_state() just skipped MokList
|
|
|
bf96fb |
even though it should always mirror the vendor cert. Besides, the faulty
|
|
|
bf96fb |
check of 'present' and 'addend' invalidates the mirroring of MokListXRT,
|
|
|
bf96fb |
MokSBStateRT, and MokIgnoreDB.
|
|
|
bf96fb |
|
|
|
bf96fb |
https://github.com/rhboot/shim/issues/154
|
|
|
bf96fb |
|
|
|
bf96fb |
Signed-off-by: Gary Lin <glin@suse.com>
|
|
|
bf96fb |
---
|
|
|
bf96fb |
mok.c | 11 ++++-------
|
|
|
bf96fb |
1 file changed, 4 insertions(+), 7 deletions(-)
|
|
|
bf96fb |
|
|
|
bf96fb |
diff --git a/mok.c b/mok.c
|
|
|
bf96fb |
index 00dd1ad3034..41925abbb49 100644
|
|
|
bf96fb |
--- a/mok.c
|
|
|
bf96fb |
+++ b/mok.c
|
|
|
bf96fb |
@@ -231,12 +231,8 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
|
|
|
bf96fb |
&v->data, &v->data_size,
|
|
|
bf96fb |
*v->guid, &attrs);
|
|
|
bf96fb |
if (efi_status == EFI_NOT_FOUND) {
|
|
|
bf96fb |
- if (v->rtname && addend) {
|
|
|
bf96fb |
- efi_status = mirror_one_mok_variable(v);
|
|
|
bf96fb |
- if (EFI_ERROR(efi_status) &&
|
|
|
bf96fb |
- ret != EFI_SECURITY_VIOLATION)
|
|
|
bf96fb |
- ret = efi_status;
|
|
|
bf96fb |
- }
|
|
|
bf96fb |
+ if (addend)
|
|
|
bf96fb |
+ goto mirror_addend;
|
|
|
bf96fb |
/*
|
|
|
bf96fb |
* after possibly adding, we can continue, no
|
|
|
bf96fb |
* further checks to be done.
|
|
|
bf96fb |
@@ -316,7 +312,8 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
|
|
|
bf96fb |
}
|
|
|
bf96fb |
}
|
|
|
bf96fb |
|
|
|
bf96fb |
- if (v->rtname && present && addend) {
|
|
|
bf96fb |
+mirror_addend:
|
|
|
bf96fb |
+ if (v->rtname && (present || addend)) {
|
|
|
bf96fb |
if (v->flags & MOK_MIRROR_DELETE_FIRST)
|
|
|
bf96fb |
LibDeleteVariable(v->rtname, v->guid);
|
|
|
bf96fb |
|
|
|
bf96fb |
--
|
|
|
bf96fb |
2.20.1
|
|
|
bf96fb |
|