summaryrefslogtreecommitdiffstats
path: root/efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch
diff options
context:
space:
mode:
authorJosh Boyer <jwboyer@fedoraproject.org>2014-08-20 13:22:24 -0400
committerJosh Boyer <jwboyer@fedoraproject.org>2014-08-20 13:22:24 -0400
commit6a91557e4cd508858eca5aba5406a9109861d4de (patch)
treec57990ccc4a28a9933db2aebba1006f46c619f44 /efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch
parenta99be7d4cf2fae68a0562a7687d89ee61c6b9f98 (diff)
downloadkernel-6a91557e4cd508858eca5aba5406a9109861d4de.tar.gz
kernel-6a91557e4cd508858eca5aba5406a9109861d4de.tar.xz
kernel-6a91557e4cd508858eca5aba5406a9109861d4de.zip
Patch file cleanup
Do a couple things here: - Split the mega-patches into individual patches. Should help with rebasing. - Make all patches 'git am' acceptable. There should be no functional or actual code differences from before
Diffstat (limited to 'efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch')
-rw-r--r--efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch58
1 files changed, 58 insertions, 0 deletions
diff --git a/efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch b/efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch
new file mode 100644
index 000000000..5c0186088
--- /dev/null
+++ b/efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch
@@ -0,0 +1,58 @@
+From 3d2fbfb0264c8286432026e152d7561975506ffc Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@fedoraproject.org>
+Date: Tue, 5 Feb 2013 19:25:05 -0500
+Subject: [PATCH] efi: Disable secure boot if shim is in insecure mode
+
+A user can manually tell the shim boot loader to disable validation of
+images it loads. When a user does this, it creates a UEFI variable called
+MokSBState that does not have the runtime attribute set. Given that the
+user explicitly disabled validation, we can honor that and not enable
+secure boot mode if that variable is set.
+
+Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+---
+ arch/x86/boot/compressed/eboot.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 88edd48f03e9..3b18ef2b534c 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -806,8 +806,9 @@ out:
+
+ static int get_secure_boot(void)
+ {
+- u8 sb, setup;
++ u8 sb, setup, moksbstate;
+ unsigned long datasize = sizeof(sb);
++ u32 attr;
+ efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID;
+ efi_status_t status;
+
+@@ -831,6 +832,23 @@ static int get_secure_boot(void)
+ if (setup == 1)
+ return 0;
+
++ /* See if a user has put shim into insecure_mode. If so, and the variable
++ * doesn't have the runtime attribute set, we might as well honor that.
++ */
++ var_guid = EFI_SHIM_LOCK_GUID;
++ status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
++ L"MokSBState", &var_guid, &attr, &datasize,
++ &moksbstate);
++
++ /* If it fails, we don't care why. Default to secure */
++ if (status != EFI_SUCCESS)
++ return 1;
++
++ if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS)) {
++ if (moksbstate == 1)
++ return 0;
++ }
++
+ return 1;
+ }
+
+--
+1.9.3
+