From: Josh Boyer Date: Wed, 6 Feb 2013 00:25:05 +0000 (-0500) Subject: UBUNTU: SAUCE: (noup) efi: Disable secure boot if shim is in insecure mode X-Git-Tag: Ubuntu-snapdragon-4.4.0-1050.54~4207 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=be77004bd69297b38fd3a7225174e59ef5c1ec39;p=mirror_ubuntu-artful-kernel.git UBUNTU: SAUCE: (noup) efi: Disable secure boot if shim is in insecure mode BugLink: http://bugs.launchpad.net/bugs/1571691 git://pkgs.fedoraproject.org/rpms/kernel.git A user can manually tell the shim boot loader to disable validation of images it loads. When a user does this, it creates a UEFI variable called MokSBState that does not have the runtime attribute set. Given that the user explicitly disabled validation, we can honor that and not enable secure boot mode if that variable is set. Signed-off-by: Josh Boyer Signed-off-by: Tim Gardner Signed-off-by: Andy Whitcroft Signed-off-by: Kamal Mostafa --- diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c index ca120ac1d783..665b202a274e 100644 --- a/arch/x86/boot/compressed/eboot.c +++ b/arch/x86/boot/compressed/eboot.c @@ -850,8 +850,9 @@ out: static int get_secure_boot(void) { - u8 sb, setup; + u8 sb, setup, moksbstate; unsigned long datasize = sizeof(sb); + u32 attr; efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID; efi_status_t status; @@ -875,6 +876,23 @@ static int get_secure_boot(void) if (setup == 1) return 0; + /* See if a user has put shim into insecure_mode. If so, and the variable + * doesn't have the runtime attribute set, we might as well honor that. + */ + var_guid = EFI_SHIM_LOCK_GUID; + status = efi_early->call((unsigned long)sys_table->runtime->get_variable, + L"MokSBState", &var_guid, &attr, &datasize, + &moksbstate); + + /* If it fails, we don't care why. Default to secure */ + if (status != EFI_SUCCESS) + return 1; + + if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS)) { + if (moksbstate == 1) + return 0; + } + return 1; }