|
 |
e97c83 |
From 868b3721159ee615a1b774645d610a13b5827e5e Mon Sep 17 00:00:00 2001
|
|
|
e97c83 |
From: Gary Ching-Pang Lin <glin@suse.com>
|
|
|
e97c83 |
Date: Thu, 31 Oct 2013 16:08:32 +0800
|
|
|
e97c83 |
Subject: [PATCH 40/74] Check the secure variables with the lib functions
|
|
|
e97c83 |
|
|
|
e97c83 |
There are functions defined in lib to check the secure variables.
|
|
|
e97c83 |
Use the functions to shun the duplicate code.
|
|
|
e97c83 |
|
|
|
e97c83 |
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
|
|
|
e97c83 |
|
|
|
e97c83 |
Conflicts:
|
|
|
e97c83 |
shim.c
|
|
|
e97c83 |
---
|
|
|
e97c83 |
lib/variables.c | 14 ++++++++++----
|
|
|
e97c83 |
shim.c | 32 ++------------------------------
|
|
|
e97c83 |
2 files changed, 12 insertions(+), 34 deletions(-)
|
|
|
e97c83 |
|
|
|
e97c83 |
diff --git a/lib/variables.c b/lib/variables.c
|
|
|
e97c83 |
index 3a9735e..4c64d7e 100644
|
|
|
e97c83 |
--- a/lib/variables.c
|
|
|
e97c83 |
+++ b/lib/variables.c
|
|
|
e97c83 |
@@ -284,9 +284,12 @@ variable_is_setupmode(void)
|
|
|
e97c83 |
/* set to 1 because we return true if SetupMode doesn't exist */
|
|
|
e97c83 |
UINT8 SetupMode = 1;
|
|
|
e97c83 |
UINTN DataSize = sizeof(SetupMode);
|
|
|
e97c83 |
+ EFI_STATUS status;
|
|
|
e97c83 |
|
|
|
e97c83 |
- uefi_call_wrapper(RT->GetVariable, 5, L"SetupMode", &GV_GUID, NULL,
|
|
|
e97c83 |
- &DataSize, &SetupMode);
|
|
|
e97c83 |
+ status = uefi_call_wrapper(RT->GetVariable, 5, L"SetupMode", &GV_GUID, NULL,
|
|
|
e97c83 |
+ &DataSize, &SetupMode);
|
|
|
e97c83 |
+ if (EFI_ERROR(status))
|
|
|
e97c83 |
+ return 1;
|
|
|
e97c83 |
|
|
|
e97c83 |
return SetupMode;
|
|
|
e97c83 |
}
|
|
|
e97c83 |
@@ -297,10 +300,13 @@ variable_is_secureboot(void)
|
|
|
e97c83 |
/* return false if variable doesn't exist */
|
|
|
e97c83 |
UINT8 SecureBoot = 0;
|
|
|
e97c83 |
UINTN DataSize;
|
|
|
e97c83 |
+ EFI_STATUS status;
|
|
|
e97c83 |
|
|
|
e97c83 |
DataSize = sizeof(SecureBoot);
|
|
|
e97c83 |
- uefi_call_wrapper(RT->GetVariable, 5, L"SecureBoot", &GV_GUID, NULL,
|
|
|
e97c83 |
- &DataSize, &SecureBoot);
|
|
|
e97c83 |
+ status = uefi_call_wrapper(RT->GetVariable, 5, L"SecureBoot", &GV_GUID, NULL,
|
|
|
e97c83 |
+ &DataSize, &SecureBoot);
|
|
|
e97c83 |
+ if (EFI_ERROR(status))
|
|
|
e97c83 |
+ return 0;
|
|
|
e97c83 |
|
|
|
e97c83 |
return SecureBoot;
|
|
|
e97c83 |
}
|
|
|
e97c83 |
diff --git a/shim.c b/shim.c
|
|
|
e97c83 |
index 210e778..14fb601 100644
|
|
|
e97c83 |
--- a/shim.c
|
|
|
e97c83 |
+++ b/shim.c
|
|
|
e97c83 |
@@ -475,44 +475,16 @@ static EFI_STATUS check_whitelist (WIN_CERTIFICATE_EFI_PKCS *cert,
|
|
|
e97c83 |
|
|
|
e97c83 |
static BOOLEAN secure_mode (void)
|
|
|
e97c83 |
{
|
|
|
e97c83 |
- EFI_STATUS status;
|
|
|
e97c83 |
- EFI_GUID global_var = EFI_GLOBAL_VARIABLE;
|
|
|
e97c83 |
- UINTN len;
|
|
|
e97c83 |
- UINT8 *Data;
|
|
|
e97c83 |
- UINT8 sb, setupmode;
|
|
|
e97c83 |
-
|
|
|
e97c83 |
if (user_insecure_mode)
|
|
|
e97c83 |
return FALSE;
|
|
|
e97c83 |
|
|
|
e97c83 |
- status = get_variable(L"SecureBoot", &Data, &len, global_var);
|
|
|
e97c83 |
- if (status != EFI_SUCCESS) {
|
|
|
e97c83 |
+ if (variable_is_secureboot() != 1) {
|
|
|
e97c83 |
if (verbose && !in_protocol)
|
|
|
e97c83 |
console_notify(L"Secure boot not enabled");
|
|
|
e97c83 |
return FALSE;
|
|
|
e97c83 |
}
|
|
|
e97c83 |
- sb = *Data;
|
|
|
e97c83 |
- FreePool(Data);
|
|
|
e97c83 |
-
|
|
|
e97c83 |
- if (sb != 1) {
|
|
|
e97c83 |
- if (verbose && !in_protocol)
|
|
|
e97c83 |
- console_notify(L"Secure boot not enabled");
|
|
|
e97c83 |
- return FALSE;
|
|
|
e97c83 |
- }
|
|
|
e97c83 |
-
|
|
|
e97c83 |
- /* If we /do/ have "SecureBoot", but /don't/ have "SetupMode",
|
|
|
e97c83 |
- * then the implementation is bad, but we assume that secure boot is
|
|
|
e97c83 |
- * enabled according to the status of "SecureBoot". If we have both
|
|
|
e97c83 |
- * of them, then "SetupMode" may tell us additional data, and we need
|
|
|
e97c83 |
- * to consider it.
|
|
|
e97c83 |
- */
|
|
|
e97c83 |
- status = get_variable(L"SetupMode", &Data, &len, global_var);
|
|
|
e97c83 |
- if (status != EFI_SUCCESS)
|
|
|
e97c83 |
- return TRUE;
|
|
|
e97c83 |
-
|
|
|
e97c83 |
- setupmode = *Data;
|
|
|
e97c83 |
- FreePool(Data);
|
|
|
e97c83 |
|
|
|
e97c83 |
- if (setupmode == 1) {
|
|
|
e97c83 |
+ if (variable_is_setupmode() == 1) {
|
|
|
e97c83 |
if (verbose && !in_protocol)
|
|
|
e97c83 |
console_notify(L"Platform is in setup mode");
|
|
|
e97c83 |
return FALSE;
|
|
|
e97c83 |
--
|
|
|
e97c83 |
1.9.3
|
|
|
e97c83 |
|