Revert debuginfo changes for stable rebases

1 files changed, 48 insertions, 46 deletions

diff --git a/MODSIGN-Support-not-importing-certs-from-db.patch b/MODSIGN-Support-not-importing-certs-from-db.patch
index d7087b5e7..13fecd2f2 100644
--- a/MODSIGN-Support-not-importing-certs-from-db.patch
+++ b/MODSIGN-Support-not-importing-certs-from-db.patch
@@ -1,62 +1,62 @@
-From 9d2e5c61d5adcf7911f67ed44a1b0ff881f175bb Mon Sep 17 00:00:00 2001
+From 9f1958a0cc911e1f79b2733ee5029dbd819ff328 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Thu, 3 Oct 2013 10:14:23 -0400
-Subject: [PATCH 19/20] MODSIGN: Support not importing certs from db
+Date: Fri, 5 May 2017 08:21:59 +0100
+Subject: [PATCH 4/4] MODSIGN: Allow the "db" UEFI variable to be suppressed
 
 If a user tells shim to not use the certs/hashes in the UEFI db variable
-for verification purposes, shim will set a UEFI variable called MokIgnoreDB.
-Have the uefi import code look for this and not import things from the db
-variable.
+for verification purposes, shim will set a UEFI variable called
+MokIgnoreDB.  Have the uefi import code look for this and ignore the db
+variable if it is found.
 
 Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- kernel/modsign_uefi.c | 40 +++++++++++++++++++++++++++++++---------
- 1 file changed, 31 insertions(+), 9 deletions(-)
+ certs/load_uefi.c | 44 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 10 deletions(-)
 
-diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
-index fe4a6f2bf10a..a41da14b1ffd 100644
---- a/kernel/modsign_uefi.c
-+++ b/kernel/modsign_uefi.c
-@@ -8,6 +8,23 @@
- #include <keys/system_keyring.h>
- #include "module-internal.h"
- 
-+static __init int check_ignore_db(void)
+diff --git a/certs/load_uefi.c b/certs/load_uefi.c
+index b44e464..3d88459 100644
+--- a/certs/load_uefi.c
++++ b/certs/load_uefi.c
+@@ -13,6 +13,26 @@ static __initdata efi_guid_t efi_cert_x509_sha256_guid = EFI_CERT_X509_SHA256_GU
+ static __initdata efi_guid_t efi_cert_sha256_guid = EFI_CERT_SHA256_GUID;
+
+ /*
++ * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
++ * it does.
++ *
++ * This UEFI variable is set by the shim if a user tells the shim to not use
++ * the certs/hashes in the UEFI db variable for verification purposes.  If it
++ * is set, we should ignore the db variable also and the true return indicates
++ * this.
++ */
++static __init bool uefi_check_ignore_db(void)
 +{
 +	efi_status_t status;
 +	unsigned int db = 0;
 +	unsigned long size = sizeof(db);
 +	efi_guid_t guid = EFI_SHIM_LOCK_GUID;
 +
-+	/* Check and see if the MokIgnoreDB variable exists.  If that fails
-+	 * then we don't ignore DB.  If it succeeds, we do.
-+	 */
 +	status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db);
-+	if (status != EFI_SUCCESS)
-+		return 0;
-+
-+	return 1;
++	return status == EFI_SUCCESS;
 +}
 +
- static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, unsigned long *size)
++/*
+  * Get a certificate list blob from the named EFI variable.
+  */
+ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
+@@ -113,7 +133,9 @@ static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_ty
+ }
+
+ /*
+- * Load the certs contained in the UEFI databases
++ * Load the certs contained in the UEFI databases into the secondary trusted
++ * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist
++ * keyring.
+  */
+ static int __init load_uefi_certs(void)
  {
- 	efi_status_t status;
-@@ -47,7 +64,7 @@ static int __init load_uefi_certs(void)
- 	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
- 	void *db = NULL, *dbx = NULL, *mok = NULL;
- 	unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
--	int rc = 0;
-+	int ignore_db, rc = 0;
- 	struct key *keyring = NULL;
- 
- 	/* Check if SB is enabled and just return if not */
-@@ -60,17 +77,22 @@ static int __init load_uefi_certs(void)
- 		return -EINVAL;
- 	}
- 
-+	/* See if the user has setup Ignore DB mode */
-+	ignore_db = check_ignore_db();
-+
+@@ -129,15 +151,17 @@ static int __init load_uefi_certs(void)
  	/* Get db, MokListRT, and dbx.  They might not exist, so it isn't
  	 * an error if we can't get them.
  	 */
@@ -64,22 +64,24 @@ index fe4a6f2bf10a..a41da14b1ffd 100644
 -	if (!db) {
 -		pr_err("MODSIGN: Couldn't get UEFI db list\n");
 -	} else {
--		rc = parse_efi_signature_list(db, dbsize, keyring);
+-		rc = parse_efi_signature_list("UEFI:db",
+-					      db, dbsize, get_handler_for_db);
 -		if (rc)
 -			pr_err("Couldn't parse db signatures: %d\n", rc);
 -		kfree(db);
-+	if (!ignore_db) {
++	if (!uefi_check_ignore_db()) {
 +		db = get_cert_list(L"db", &secure_var, &dbsize);
 +		if (!db) {
 +			pr_err("MODSIGN: Couldn't get UEFI db list\n");
 +		} else {
-+			rc = parse_efi_signature_list(db, dbsize, keyring);
++			rc = parse_efi_signature_list("UEFI:db",
++						      db, dbsize, get_handler_for_db);
 +			if (rc)
 +				pr_err("Couldn't parse db signatures: %d\n", rc);
 +			kfree(db);
 +		}
  	}
- 
+
  	mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
 -- 
 2.9.3