Tags: savvamitrofanov/shim
Tags
shim 15.7 What's Changed * Make SBAT variable payload introspectable by @chrisccoulson in rhboot#483 * Reference MokListRT instead of MokList by @esnowberg in rhboot#488 * Add a link to the test plan in the readme. by @vathpela in rhboot#494 * [V3] Enable TDX measurement to RTMR register by @kenplusplus in rhboot#485 * Discard load-options that start with a NUL by @frozencemetery in rhboot#505 * load_cert_file bugs by @esnowberg in rhboot#523 * Add -malign-double to IA32 compiler flags by @nicholasbishop in rhboot#516 * pe: Fix image section entry-point validation by @iokomin in rhboot#518 * make-archive: Build reproducible tarball by @julian-klode in rhboot#527 * mok: remove MokListTrusted from PCR 7 by @baloo in rhboot#519 * Shim 15.7 version update by @vathpela in rhboot#528 New Contributors * @kenplusplus made their first contribution in rhboot#485 * @iokomin made their first contribution in rhboot#518 * @baloo made their first contribution in rhboot#519 **Full Changelog**: rhboot/shim@15.6...15.7
shim-15.6 - What's Changed * MokManager: removed Locate graphic output protocol fail error message by @joeyli in rhboot#441 * shim: implement SBAT verification for the shim_lock protocol by @chrisccoulson in rhboot#456 * post-process-pe: Fix a missing return code check by @vathpela in rhboot#462 * Update github actions matrix to be more useful by @frozencemetery in rhboot#469 * Add f36 and centos9 CI builds by @vathpela in rhboot#470 * post-process-pe: Fix format string warnings on 32-bit platforms by @steve-mcintyre in rhboot#464 * tests: also look for system headers in multi-arch directories by @steve-mcintyre in rhboot#466 * tests: fix gcc warnings by @akodanev in rhboot#463 * Allow MokListTrusted to be enabled by default by @esnowberg in rhboot#455 * Add code of conduct by @frozencemetery in rhboot#427 * Re-add ARM AArch64 support by @vathpela in rhboot#468 * Use ASCII as fallback if Unicode Box Drawing characters fail by @vathpela in rhboot#428 * make: don't treat cert.S specially by @vathpela in rhboot#475 * shim: use SHIM_DEVEL_VERBOSE when built in devel mode by @vathpela in rhboot#474 * Break out of the inner sbat loop if we find the entry. by @vathpela in rhboot#476 * Support loading additional certificates by @esnowberg in rhboot#446 * Add support for NX (W^X) mitigations. by @vathpela in rhboot#459 * Misc fixups from scan-build. by @vathpela in rhboot#477 * Fix preserve_sbat_uefi_variable() logic by @jsetje in rhboot#478 * SBAT Policy latest should be a one-shot by @jsetje in rhboot#481 * pe: Fix a buffer overflow when SizeOfRawData > VirtualSize by @chriscoulson * pe: Perform image verification earlier when loading grub by @chriscoulson * Update advertised sbat generation number for shim by @jsetje * Update SBAT generation requirements for 05/24/22 by @jsetje * Also avoid CVE-2022-28737 in verify_image() by @vathpela - New Contributors * @joeyli made their first contribution in rhboot#441 * @akodanev made their first contribution in rhboot#463 * @esnowberg made their first contribution in rhboot#455 - Full Changelog**: rhboot/shim@15.5...15.6
shim-15.6~rc1 - What's Changed * MokManager: removed Locate graphic output protocol fail error message by @joeyli in rhboot#441 * shim: implement SBAT verification for the shim_lock protocol by @chrisccoulson in rhboot#456 * post-process-pe: Fix a missing return code check by @vathpela in rhboot#462 * Update github actions matrix to be more useful by @frozencemetery in rhboot#469 * Add f36 and centos9 CI builds by @vathpela in rhboot#470 * post-process-pe: Fix format string warnings on 32-bit platforms by @steve-mcintyre in rhboot#464 * tests: also look for system headers in multi-arch directories by @steve-mcintyre in rhboot#466 * tests: fix gcc warnings by @akodanev in rhboot#463 * Allow MokListTrusted to be enabled by default by @esnowberg in rhboot#455 * Add code of conduct by @frozencemetery in rhboot#427 * Re-add ARM AArch64 support by @vathpela in rhboot#468 * Use ASCII as fallback if Unicode Box Drawing characters fail by @vathpela in rhboot#428 * make: don't treat cert.S specially by @vathpela in rhboot#475 * shim: use SHIM_DEVEL_VERBOSE when built in devel mode by @vathpela in rhboot#474 * Break out of the inner sbat loop if we find the entry. by @vathpela in rhboot#476 * Support loading additional certificates by @esnowberg in rhboot#446 * Add support for NX (W^X) mitigations. by @vathpela in rhboot#459 * Misc fixups from scan-build. by @vathpela in rhboot#477 * Fix preserve_sbat_uefi_variable() logic by @jsetje in rhboot#478 - New Contributors * @joeyli made their first contribution in rhboot#441 * @akodanev made their first contribution in rhboot#463 * @esnowberg made their first contribution in rhboot#455 - Full Changelog**: rhboot/shim@15.5...15.6-rc1
shim 15.5 Much thanks to those who tested this release. Changes from -rc2: - Make Mok config table be runtime services memory - Remove post-process-pe on 'make clean' - pe: missing perror argument **Incremental changelog**: rhboot/shim@15.5-rc2...15.5 From 15.4, the following people contributed code: - Peter Jones (46) - Heinrich Schuchardt (7) - Gary Lin (6) - Renaud Métrich (4) - Julian Andres Klode (4) - Serge Hallyn (2) - Robbie Harwood (2) - Nicholas Bishop (2) - João Paulo Rechi Vita (2) - Seth Forshee (1) - Jonathan Yong (1) - Jonas Witschel (1) - Javier Martinez Canillas (1) - Jan Setje-Eilers (1) - Esther Shimanovich (1) - Eric Snowberg (1) - Dimitri John Ledkov (1) - Daniel Axtens (1) - Chris Coulson (1) - Adam Williamson (1) **Full changelog**: rhboot/shim@15.4...15.5
shim 15.5 release candidate 2 What's Changed * docs: update SBAT UEFI variable name by @nicholasbishop in rhboot#421 * Don't parse load options if invoked from removable media path by @julian-klode in rhboot#399 * fallback: fix fallback not passing arguments of the first boot option by @martinezjavier in rhboot#433 * shim: Don't stop forever at "Secure Boot not enabled" notification by @rmetrich in rhboot#438 * Shim 15.5 coverity by @vathpela in rhboot#439 New Contributors * @hallyn made their first contribution in rhboot#389 * @jyong2 made their first contribution in rhboot#365 * @sforshee made their first contribution in rhboot#378 * @frozencemetery made their first contribution in rhboot#403 * @xypron made their first contribution in rhboot#406 * @eshiman made their first contribution in rhboot#398 * @daxtens made their first contribution in rhboot#413 * @rmetrich made their first contribution in rhboot#414 * @julian-klode made their first contribution in rhboot#393 **Full Changelog**: rhboot/shim@15.5-rc1...15.5-rc2
shim 15.5 release candidate 1 What's Changed * Broken ia32 relocs and an unimportant submodule change. by @vathpela in rhboot#357 * mok: allocate MOK config table as BootServicesData by @lcp in rhboot#361 * Don't call QueryVariableInfo() on EFI 1.10 machines by @vathpela in rhboot#364 * Relax the check for import_mok_state() by @lcp in rhboot#372 * SBAT.md: trivial changes by @hallyn in rhboot#389 * shim: another attempt to fix load options handling by @chrisccoulson in rhboot#379 * Add tests for our load options parsing. by @vathpela in rhboot#390 * arm/aa64: fix the size of .rela* sections by @lcp in rhboot#383 * mok: fix potential buffer overrun in import_mok_state by @jyong2 in rhboot#365 * mok: relax the maximum variable size check by @lcp in rhboot#369 * Don't unhook ExitBootServices when EBS protection is disabled by @sforshee in rhboot#378 * fallback: find_boot_option() needs to return the index for the boot entry in optnum by @jsetje in rhboot#396 * httpboot: Ignore case when checking HTTP headers by @frozencemetery in rhboot#403 * Fallback allocation errors by @vathpela in rhboot#402 * shim: avoid BOOTx64.EFI in message on other architectures by @xypron in rhboot#406 * str: remove duplicate parameter check by @xypron in rhboot#408 * fallback: add compile option FALLBACK_NONINTERACTIVE by @xnox in rhboot#359 * Test mok mirror by @vathpela in rhboot#394 * Modify sbat.md to help with readability. by @eshiman in rhboot#398 * csv: detect end of csv file correctly by @xypron in rhboot#404 * Specify that the .sbat section is ASCII not UTF-8 by @daxtens in rhboot#413 * tests: add "include-fixed" GCC directory to include directories by @diabonas in rhboot#415 * pe: simplify generate_hash() by @xypron in rhboot#411 * Don't make shim abort when TPM log event fails (RHBZ #2002265) by @rmetrich in rhboot#414 * Fallback to default loader if parsed one does not exist by @julian-klode in rhboot#393 * fallback: Fix for BootOrder crash when index returned by find_boot_option() is not in current BootOrder list by @rmetrich in rhboot#422 * Better console checks by @vathpela in rhboot#416 * docs: update SBAT UEFI variable name by @nicholasbishop in rhboot#421 New Contributors * @hallyn made their first contribution in rhboot#389 * @jyong2 made their first contribution in rhboot#365 * @sforshee made their first contribution in rhboot#378 * @frozencemetery made their first contribution in rhboot#403 * @xypron made their first contribution in rhboot#406 * @eshiman made their first contribution in rhboot#398 * @daxtens made their first contribution in rhboot#413 * @rmetrich made their first contribution in rhboot#414 **Full Changelog**: rhboot/shim@15.4...15.5-rc1
shim 15.4
This is a critical bugfix release. Don't use 15.3, as the SBAT self-check is
broken.
Many thanks to all who helped out, including but not limited to these
contributions:
Chris Co (1):
Makefile: sort vendor sbats to remove duplicates
Jan Setje-Eilers (3):
Move the check for the SBAT variable properties to its own function.
Fix SBAT variable content validation.
Change SBAT variable name to SbatLevel
Peter Jones (13):
CI: don't use 'make -s'; it's more trouble than help.
arm/aa64: Swizzle some sections to make old sbsign happier.
Make building outside of the top directory work.
make: make 'make install-as-data' install BOOT*.CSV
make: Fix search paths for vendor sbat.*.csv files
test_parse_sbat_section_too_many_elem(): free section entries
parse_sbat_var_data()/cleanup_sbat_var(): fix free logic
test_verify_sbat_null_sbat_section(): call cleanup_sbat_var()
Fix openssl's 'make clean'
sbat: add more dprint()
arm/aa64 targets: put .rel* and .dyn* in .rodata
Fix an off-by-one on the sbat self-check.
Update version to 15.4
shim 15.3
Some highlights:
- Support for revocations via the ".sbat" section and SBAT EFI variable
- A new unit test framework and a bunch of unit tests
- No external gnu-efi dependency
- Better CI (with more yet needed)
Many thanks to all who helped out, including but not limited to these
contributions:
Alex Burmashev (4):
strndupa: allocate len + 1, so that \0 is not lost
add list_empty to linked list primitives
pe.c: parse SBAT variable and perform basic verification
Fix compilation for older gcc
Chris Co (2):
sbat: add minor fixes to parse_sbat
Add initial sbat unit testing code
Chris Coulson (8):
Fix sbsign command usage
Rename check_{white,black}list to check_{allow,deny}list
build: Pass the correct paths to sbsign
Include missing .text sections in PE/COFF binary
sbat: Don't assume VirtualSize == SizeOfRawData
Ensure that MOK variable mirroring creates well formed ESLs
Avoid creating unnecessary mirrored MOK variables
Fix boot failures due to variable size constraints
Colin Walters (1):
Convert README -> README.md
Dimitri John Ledkov (2):
Add testsuite to the github pull request workflow.
Drop comments, and make push workflow use same matrix as
pullrequest.
Gary Lin (9):
src/netboot.c: remove the execute bit
lib: move print_crypto_errors() out of console.c
console: Move the countdown function to console.c
fallback: show a countdown menu before reset
sbat: fix the gcc warnings
sbat: fix the residual "resource section" for SBAT
Restore loaded image of shim at Exit()
Set the section flags for .sbat
arm and aarch64: include the aligned part in SizeOfRawData of sbat
Hai Huang (1):
Fix EV_EFI_VARIABLE_AUTHORITY event in eventlog
Jan Setje-Eilers (8):
Add Secure Boot Advanced Targeting (SBAT) specification document
Add --set-section-alignment '.sbat=512' to objcopy command line
Drop --set-section-alignment from Makefile since linker ALIGN(4096)
already enforces the alignment, clarify that objcopy only needs to
do the alignment in the SBAT spec.
If the SBAT UEFI variable is not set, initialize it as a
bootservices variable.
Javier Martinez Canillas (10):
Add a .sbat section to EFI binaries
Add a function to parse the SBAT metadata from the .sbat section
sbat: remove unused buffer parameter in parse_sbat() function
sbat: use correct type for parse_sbat_var() return value
Don't re-parse the SBAT EFI variable for each binary we load.
sbat: include NULL terminator when calculating buffer end in
parse_sbat()
shim: initialize OpenSSL after parsing SBAT data
sbat: make shim to parse it's own .sbat section on init
shim: Fix a NULL pointer dereference caused by start not being set
shim: Use the default loader if an EFI_LOAD_OPTION can't be parsed
Jia Zhang (1):
Ignore *.hash
João Paulo Rechi Vita (8):
fallback: Store label size instead of calculating on every use
fallback: Consider all Boot* vars when checking for duplicates
fallback: Only use VerbosePrint for debug messages
fallback: Be silent by default
fallback: Print original BootOrder value in verbose mode
fallback: Wait before chainloading in verbose mode
fallback: Make verbose mode's wait time configurable
fallback: Allow defining FALLBACK_VERBOSE at build time
Lisa White (1):
Fix typo in a comment
Luca Boccassi (1):
Makefile: use fixed build host if SOURCE_DATE_EPOCH is defined
Mathieu Trudel-Lapierre (1):
Add mm/fb hashing to TODO, put that and related things under
'Reproducible builds'
Matthew Garrett (1):
build: Import gnu-efi as a submodule and build against it
Nicholas Bishop (1):
BUILDING: Fix a typo
Paul Menzel (1):
README: Remove superfluous *and*
Paul Moore (7):
shim: compile time option to bypass the ExitBootServices() check
build: add some basic $EFI_PATH checking
SBAT: fix some typos in the SBAT docs
SBAT: update the raw Markdown to look less terrible
openssl: fix various build errors and warnings
shim: attempt to improve the argument handling
build: load local build configuration from Make.local if present
Peter Jones (119):
Use github actions for CI builds
Split up push and PR CI/CD and build all patches in series on PRs
Try to kick the github PR workflow...
Add a .clang-format file.
Always use lower case for our local include file names.
Work around some clang-format oddnesses
Renaming PeImage.h to pe.h wasn't actually a good idea.
Fix pe.h -> peimage.h in /both/ places.
github workflows: Unify the x86 pull request build rules steps
github workflows: add the sbat branch to one PR builds run for
efi bins: add an easy way for vendors to add .sbat data
Remove my .syntastic_c_config, it doesn't belong in the repo.
includes: add strchra() and strchrnula() impls
Move a bunch of PE-related stuff out of shim.c
Refactor some PE handling code
Add some more PE helpers we need for SBAT
Add the beginning of .sbat parsing stuff
SBAT: parse a copy of the table that's got a NUL at the end
Add an example SBAT workflow document
Add some linked list primitives.
get_variable: always allocate a NUL character at the end.
add an ascii strndup() implementation.
sbat: make the includes work like everything else.
We're not using travis-build.sh any more.
Try to make coverity.mk work without cov-build installed.
Try to make scan-build.mk work without scan-build installed.
Add some more TODOs for shim 16
Add another unfortunate TODO entry.
Add some *more* TODO tasks.
Add fallback boot loop detection to TODO
Also ignore .sw?
Add screen logs to .gitignore
Add .cer/.crt/.esl to .gitignore
BUILDING: fix missing DISABLE_EBS_PROTECTION section
Re-alphabetize .gitignore.
.gitignore: add build dirs and shim_cert.h
.gitignore: ignore .gdbinit
Fix up a bunch of our license statements and add SPDX most places
SPDX: Clarify the attribution for crypt_blowfish
SPDX: Clarify the attribution for James's lib/ code
Make sure MIN() and MAX() are always defined.
console: Fix a typo in the EFI warning list in gnu-efi
Fix a bunch of trivial trailing whitespace issues.
Make httpboot.c always get built.
Make the variable name and pointer const in all of our efi vars
functions
Add ENABLE_SHIM_DEVEL config to change what our debug variable
name is
Use gcc -Os instead of -O0.
sbat: clang-format the whole thing.
SBAT: make the variable be CSV in our spec.
SBAT: Fix all the docs examples to start with version 1
Fix an off by one in strnlena()
shim: use an enum for efi_main's error messages.
sbat: drop the struct sbat and just use two variables instead
parse_sbat: handle the realloc failure leak and batch allocations.
pe.c: move sbat verification to its own function.
sbat: Fix two NULL derefs found with "gcc -fanalyzer"
tpm: minor cleanup: use EV_IPL not 0xd
Document struct mok_state_variable better.
SBAT: mirror SBAT to SbatRT and extend to PCR7 + log
Move the coverity and scan-build makefiles out of the top directory
Make 'make fanalyzer' targets
compiler.h: fix a typo and add some more function attribute macros
Fix all the places we need UNUSED on arguments.
Tidy up our string primitives...
Add a list_size() primitive
Move is_utf8_bom() to str.h
includes: include all gnu-efi includes at one place.
Fix our debuginfo paths hopefully
Add a stand-alone CSV parser.
SBAT: make our sbat section parser use the csv parser
SBAT: make our SBAT variable parser use the CSV parser
make 'make test' able to run unit test harnesses
Add a tester for our string functions.
Add test cases for our CSV parser.
Fix-up and enable a bunch of .sbat section parsing tests.
Make verify_sbat() more testable
Fix two errant 'shim,0' outdated sbat cases.
Add get_variable_size()/set_variable()del_variable() wrappers.
CI: try to update submodules
CI: show our compilation when it fails
Re-organize a bunch of CFLAGS-related makefile bits
Minor OpenSSL fixes
static analysis: make our build targets work better
More minor makefile cleanups
Switch to using -std=gnu11
Don't use WCHAR even when we're assigning wide string literals
Cryptlib: make some Str*() args const.
Restructure our includes.
Fix Cryptlib's va_* definitions.
Consolidate most of our standard lib functions to lib
Fix stdarg to work the same everywhere.
Add some test cases, and make "make test" actually work.
make: use -Wextra (minus some obnoxious bits)
Test our strncmp vs known failing ones as well
Add more string test cases.
set_sbat_uefi_variable(): avoid comparing unsafe data
shim: simplify sbat self-check logic.
linker scripts: put .sbat after _edata
arm arches: include .sbat in our section headers.
Fix the compiler when invoking scan-build/fanalyzer/etc
openssl: nerf some -W flags for clang.
get_variable_attr(): fix a nit scan-build found.
Fix include order
More va_* work
Don't even try to use builtins, just make sure we have the same
types.
Make ENABLE_SHIM_DEVEL work better.
sbat variable: use UEFI_VAR_NV_BS_RT when we've got
ENABLE_SHIM_DEVEL
set_sbat_uefi_variable(): add a pile of debug prints.
set_sbat_uefi_variable(): align some decisions that are off-by-one.
Fix a plausible NULL dereference.
'make test': try harder to make it build in the right order.
Nerf an unnecessary string test on arm.
arm and aarch64: fix some PE headers.
Make 'make test' work on gcc 4.8.5
Don't set LIBDIR in CI builds any more.
Fix cross-compilation from x86_64->i686
Try multi-arch CI building using cross compilation
Update 'make archive' to include gnu-efi
Bump version to 15.3
Steve McIntyre (5):
Second attempt at SBAT doc tweaks
Fixups after Peter's review
Fix bashisms in Make.coverity
Stop using EFI_PATH, and error out if people try to use it
Fix up build of test code using gcc 8
Thomas Frauendorfer | Miray Software (2):
Fix column size check in SBAT variable parsing.
Sort input file names in lib/Makefile
shim 15.3 release candidate 4
Hopefully the last release candidate. Here's the shortlog since rc3:
Chris Coulson (1):
Fix boot failures due to variable size constraints
Peter Jones (4):
Make 'make test' work on gcc 4.8.5
Don't set LIBDIR in CI builds any more.
Fix cross-compilation from x86_64->i686
Try multi-arch CI building using cross compilation
shim 15.3 release candidate 3
Yet another release candidate. Here's the shortlog since rc2:
Chris Coulson (2):
Ensure that MOK variable mirroring creates well formed ESLs
Avoid creating unnecessary mirrored MOK variables
Gary Lin (1):
arm and aarch64: include the aligned part in SizeOfRawData of sbat
Javier Martinez Canillas (1):
shim: Use the default loader if an EFI_LOAD_OPTION can't be parsed
Paul Moore (1):
build: load local build configuration from Make.local if present
Thomas Frauendorfer | Miray Software (1):
Sort input file names in lib/Makefile
PreviousNext