]>
git.proxmox.com Git - efi-boot-shim.git/log
summary |
shortlog | log |
commit |
commitdiff |
tree
first ⋅ prev ⋅ next
Matthew Garrett [Sat, 6 Oct 2012 21:30:46 +0000 (17:30 -0400)]
Fix menu items
Only show the MOK manipulation menu item if MokNew existed
Matthew Garrett [Sat, 6 Oct 2012 21:22:33 +0000 (17:22 -0400)]
Always show the MokManager UI
If someone explicitly starts MokManager then we want to show the UI
Matthew Garrett [Sat, 6 Oct 2012 21:20:30 +0000 (17:20 -0400)]
Fall back to MokManager if grub failed to validate
If we can't verify grub, fall back to MokManager. This permits shipping a
copy of shim and MokManager without distributing a key, letting
distributions provide their own for user installation.
Matthew Garrett [Fri, 5 Oct 2012 23:04:57 +0000 (19:04 -0400)]
Add filesystem browsing and enrollment
Add a basic menu system and file explorer. This makes it possible for the
user to enrol keys from media from within shim rather than having to boot
an OS first. This would permit vendors to distribute a signed shim without
having to install their own keys first - the keys could be stored on the
install media instead.
Gary Ching-Pang Lin [Thu, 4 Oct 2012 09:39:59 +0000 (17:39 +0800)]
Don't show the invalid key number
Gary Ching-Pang Lin [Thu, 4 Oct 2012 09:39:54 +0000 (17:39 +0800)]
Use the same function to get commands and password
Gary Ching-Pang Lin [Thu, 4 Oct 2012 08:28:52 +0000 (16:28 +0800)]
Print the key number for the non-existent key also
Gary Ching-Pang Lin [Tue, 2 Oct 2012 10:17:29 +0000 (18:17 +0800)]
Don't print Backspace as we print nothing
Gary Ching-Pang Lin [Tue, 2 Oct 2012 06:51:42 +0000 (14:51 +0800)]
Calculate SHA1 fingerprint
openssl shows sha1 fingerprint by default.
Gary Ching-Pang Lin [Tue, 2 Oct 2012 04:58:32 +0000 (12:58 +0800)]
Replace functions with the ones in gnu-efi
Gary Ching-Pang Lin [Tue, 2 Oct 2012 03:55:44 +0000 (11:55 +0800)]
Use LibDeleteVariable in gnu-efi
Gary Ching-Pang Lin [Thu, 27 Sep 2012 08:54:38 +0000 (16:54 +0800)]
More tips for the MOK password
Gary Ching-Pang Lin [Wed, 26 Sep 2012 09:19:27 +0000 (17:19 +0800)]
Filter out newline from the password array
Gary Ching-Pang Lin [Wed, 26 Sep 2012 08:36:53 +0000 (16:36 +0800)]
correct wording
Gary Ching-Pang Lin [Wed, 26 Sep 2012 07:46:42 +0000 (15:46 +0800)]
Build debug image for all efi files
Gary Ching-Pang Lin [Mon, 24 Sep 2012 09:27:52 +0000 (17:27 +0800)]
Define the max length of password
Gary Ching-Pang Lin [Mon, 24 Sep 2012 07:48:01 +0000 (15:48 +0800)]
Request a password to verify the key list
The password must contain 8 characters at least and 16 characters
at most and will be hashed with the key list altogether. The keys
in MokNew won't be allowed to be enrolled unless the user provides
the correct password.
Gary Ching-Pang Lin [Fri, 21 Sep 2012 08:45:02 +0000 (16:45 +0800)]
Erase stored keys when there is no key in the new key list
Gary Ching-Pang Lin [Fri, 21 Sep 2012 08:44:56 +0000 (16:44 +0800)]
Make sure the variables are not broken
Gary Ching-Pang Lin [Fri, 21 Sep 2012 07:36:57 +0000 (15:36 +0800)]
Allow the new keys to be listed again
Gary Ching-Pang Lin [Fri, 21 Sep 2012 07:10:31 +0000 (15:10 +0800)]
Reject the binary when there is no key in MokList
Gary Ching-Pang Lin [Thu, 20 Sep 2012 10:15:50 +0000 (18:15 +0800)]
Make the key list interactive
Gary Ching-Pang Lin [Thu, 20 Sep 2012 07:54:57 +0000 (15:54 +0800)]
Make sure the time string is set
Gary Ching-Pang Lin [Thu, 20 Sep 2012 07:22:53 +0000 (15:22 +0800)]
Improve the layout of the key info
Gary Ching-Pang Lin [Thu, 20 Sep 2012 02:35:43 +0000 (10:35 +0800)]
Remove the unused debug message
Gary Ching-Pang Lin [Thu, 20 Sep 2012 02:28:00 +0000 (10:28 +0800)]
Check the MOK list correctly
Gary Ching-Pang Lin [Wed, 19 Sep 2012 09:12:30 +0000 (17:12 +0800)]
Simplify the key management
Move the key list building and management to mokutil to keep
MokManager as simple as possible.
Gary Ching-Pang Lin [Wed, 19 Sep 2012 06:54:35 +0000 (14:54 +0800)]
Abandon the variable, MokMgmt
Gary Ching-Pang Lin [Tue, 11 Sep 2012 09:43:44 +0000 (17:43 +0800)]
Copy the MOK list to a RT variable
The RT variable, MokListRT, is a copy of MokList so that the
runtime applications can synchronize the key list without touching
the BS variable.
Gary Ching-Pang Lin [Tue, 11 Sep 2012 08:39:12 +0000 (16:39 +0800)]
Use the machine owner keys to verify images
Gary Ching-Pang Lin [Tue, 11 Sep 2012 08:38:29 +0000 (16:38 +0800)]
Add a separate efi application to manage MOKs
Gary Ching-Pang Lin [Tue, 11 Sep 2012 08:37:02 +0000 (16:37 +0800)]
Always try StartImage first
Gary Ching-Pang Lin [Tue, 11 Sep 2012 08:34:25 +0000 (16:34 +0800)]
Only launch MokManager when necessary
Gary Ching-Pang Lin [Tue, 11 Sep 2012 08:31:05 +0000 (16:31 +0800)]
Retrieve attributes of variables
We have to make sure the machine owner key is stored in a BS
variable.
Gary Ching-Pang Lin [Fri, 7 Sep 2012 10:22:34 +0000 (18:22 +0800)]
Merge branch 'master' into mok-prototype3
Conflicts:
shim.c
Gary Ching-Pang Lin [Fri, 7 Sep 2012 10:11:45 +0000 (18:11 +0800)]
Load MokManager for MOK management
Gary Ching-Pang Lin [Fri, 7 Sep 2012 09:43:21 +0000 (17:43 +0800)]
Make the image loading process more generic
Peter Jones [Thu, 6 Sep 2012 20:43:30 +0000 (16:43 -0400)]
Fix data alignment on vendor_cert so we don't wind up with padding.
Peter Jones [Thu, 6 Sep 2012 16:38:30 +0000 (12:38 -0400)]
Add some convenience make targets.
Adds targets for "test-archive" and "archive"
Peter Jones [Thu, 6 Sep 2012 16:13:44 +0000 (12:13 -0400)]
Break out of our db checking loop at the appropriate time.
The break in check_db_cert is at the wrong level due to a typo in
indentation, and as a result only the last cert in the list can
correctly match. Rectify that.
Signed-off-by: Peter Jones <pjones@redhat.com>
Matthew Garrett [Thu, 6 Sep 2012 16:13:44 +0000 (12:13 -0400)]
Use the file size, not the image size field, for verification.
Peter Jones [Thu, 6 Sep 2012 16:13:44 +0000 (12:13 -0400)]
Allow specification of vendor_cert through a build command line option.
This allows you to specify the vendor_cert as a file on the command line
during build.
Peter Jones [Thu, 6 Sep 2012 16:01:43 +0000 (12:01 -0400)]
dos2unix PeImage.h
Matthew Garrett [Sat, 28 Jul 2012 04:42:43 +0000 (00:42 -0400)]
Add basic documentation
Matthew Garrett [Fri, 13 Jul 2012 04:30:22 +0000 (00:30 -0400)]
Handle slightly stranger device paths
Matthew Garrett [Wed, 11 Jul 2012 14:58:15 +0000 (10:58 -0400)]
Make path generation more sensible
Matthew Garrett [Wed, 11 Jul 2012 14:57:46 +0000 (10:57 -0400)]
Make sure ImageBase is set appropriately in the loaded_image protocol
Matthew Garrett [Mon, 9 Jul 2012 15:03:12 +0000 (11:03 -0400)]
Add copyright file
Matthew Garrett [Mon, 9 Jul 2012 14:39:14 +0000 (10:39 -0400)]
Update TODO
Matthew Garrett [Mon, 9 Jul 2012 14:38:30 +0000 (10:38 -0400)]
Remove temp file checked in by accident
Matthew Garrett [Mon, 9 Jul 2012 14:38:19 +0000 (10:38 -0400)]
Improve makefile
Matthew Garrett [Mon, 9 Jul 2012 14:17:19 +0000 (10:17 -0400)]
Make it easier to update Cryptlib
Matthew Garrett [Mon, 9 Jul 2012 14:17:13 +0000 (10:17 -0400)]
Cryptlib update
Matthew Garrett [Thu, 5 Jul 2012 20:39:25 +0000 (16:39 -0400)]
Re-add whitelisting - needed for protocol validation
Matthew Garrett [Thu, 5 Jul 2012 16:52:42 +0000 (12:52 -0400)]
We're not MSABI, so don't advertise this as such
Matthew Garrett [Thu, 5 Jul 2012 16:51:12 +0000 (12:51 -0400)]
Check whether secure boot is enabled before performing verify call
Matthew Garrett [Mon, 2 Jul 2012 18:43:18 +0000 (14:43 -0400)]
Fix up blacklist checking
This was not quite as bugfree as would be hoped for.
Matthew Garrett [Mon, 2 Jul 2012 17:49:32 +0000 (13:49 -0400)]
Remove whitelisting - the firmware will handle it via LoadImage/StartImage
Matthew Garrett [Mon, 2 Jul 2012 16:33:42 +0000 (12:33 -0400)]
Update OpenSSL
Matthew Garrett [Mon, 2 Jul 2012 16:29:03 +0000 (12:29 -0400)]
Build a debug image
Matthew Garrett [Mon, 2 Jul 2012 15:54:21 +0000 (11:54 -0400)]
Fix type of buffersize
Matthew Garrett [Mon, 2 Jul 2012 13:40:18 +0000 (09:40 -0400)]
Remove redundant header
Matthew Garrett [Mon, 25 Jun 2012 21:46:11 +0000 (17:46 -0400)]
Fix get_variable
Matthew Garrett [Mon, 25 Jun 2012 14:59:08 +0000 (10:59 -0400)]
Add black/white listing
Matthew Garrett [Tue, 19 Jun 2012 19:25:59 +0000 (15:25 -0400)]
Fix build somewhat
Matthew Garrett [Tue, 19 Jun 2012 19:25:02 +0000 (15:25 -0400)]
Fix cert size
Matthew Garrett [Tue, 19 Jun 2012 19:23:31 +0000 (15:23 -0400)]
Fix error path
Matthew Garrett [Tue, 19 Jun 2012 17:01:54 +0000 (13:01 -0400)]
Remove old files
Matthew Garrett [Mon, 18 Jun 2012 21:49:57 +0000 (17:49 -0400)]
Add crypto libraries
Matthew Garrett [Mon, 18 Jun 2012 21:48:25 +0000 (17:48 -0400)]
Add missing include
Matthew Garrett [Mon, 18 Jun 2012 21:33:46 +0000 (17:33 -0400)]
Merge branch 'master' of github.com:mjg59/shim
mjg59 [Mon, 18 Jun 2012 21:32:19 +0000 (14:32 -0700)]
Merge pull request #1 from vathpela/master
Yo dog this ain't right.
Matthew Garrett [Mon, 18 Jun 2012 21:31:42 +0000 (17:31 -0400)]
Uninstall protocol on exit
Matthew Garrett [Mon, 18 Jun 2012 21:31:42 +0000 (17:31 -0400)]
Check binary against blacklist
Matthew Garrett [Mon, 18 Jun 2012 21:31:42 +0000 (17:31 -0400)]
Attempt to start image using LoadImage/StartImage first
Matthew Garrett [Mon, 18 Jun 2012 21:31:42 +0000 (17:31 -0400)]
Check that platform is in user mode before doing any validation
Peter Jones [Mon, 18 Jun 2012 15:36:57 +0000 (11:36 -0400)]
Fix typos.
Matthew Garrett [Thu, 7 Jun 2012 18:00:48 +0000 (14:00 -0400)]
Minor cleanups
Matthew Garrett [Tue, 5 Jun 2012 14:56:45 +0000 (10:56 -0400)]
Rename variables
Matthew Garrett [Tue, 5 Jun 2012 14:52:30 +0000 (10:52 -0400)]
Install a protocol for sharing code with grub
Matthew Garrett [Thu, 31 May 2012 02:09:01 +0000 (22:09 -0400)]
Add a brief TODO
Matthew Garrett [Thu, 31 May 2012 02:08:09 +0000 (22:08 -0400)]
Some cleanups
Matthew Garrett [Wed, 30 May 2012 22:36:46 +0000 (18:36 -0400)]
Add image verification
Matthew Garrett [Tue, 8 May 2012 07:00:51 +0000 (03:00 -0400)]
Fix path generation
Matthew Garrett [Wed, 11 Apr 2012 21:13:07 +0000 (17:13 -0400)]
Some additional paranoia
Matthew Garrett [Wed, 11 Apr 2012 17:59:55 +0000 (13:59 -0400)]
Initial commit