From 7de321e3ad9ac00d00810358a6bf0d9c7187604e Mon Sep 17 00:00:00 2001 From: Mohan Boddu Date: Fri, 9 Aug 2019 07:02:15 -0400 Subject: [PATCH] Revert "mokutil fails to build from source: https://bugzilla.redhat.com/show_bug.cgi?id=1675403" Unretiring it as its breaking rawhide composes This reverts commit 31da8a1b372daedf397909f6808ae871d5ea1728. --- .gitignore | 5 + 0001-Fix-the-potential-buffer-overflow.patch | 36 ++++++ ...-Fix-the-32bit-signedness-comparison.patch | 34 ++++++ ...t-wchar-so-toggle-passwords-work-rig.patch | 42 +++++++ ...low-sha1-on-the-mokutil-command-line.patch | 32 +++++ 0005-Make-all-efi_guid_t-const.patch | 87 ++++++++++++++ ...plicit-about-file-modes-in-all-cases.patch | 37 ++++++ 0007-Add-bash-completion-file.patch | 98 ++++++++++++++++ dead.package | 1 - mokutil.spec | 109 ++++++++++++++++++ sources | 1 + 11 files changed, 481 insertions(+), 1 deletion(-) create mode 100644 .gitignore create mode 100644 0001-Fix-the-potential-buffer-overflow.patch create mode 100644 0002-Fix-the-32bit-signedness-comparison.patch create mode 100644 0003-Build-with-fshort-wchar-so-toggle-passwords-work-rig.patch create mode 100644 0004-Don-t-allow-sha1-on-the-mokutil-command-line.patch create mode 100644 0005-Make-all-efi_guid_t-const.patch create mode 100644 0006-mokutil-be-explicit-about-file-modes-in-all-cases.patch create mode 100644 0007-Add-bash-completion-file.patch delete mode 100644 dead.package create mode 100644 mokutil.spec create mode 100644 sources diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..8fa6b56 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +*.tar.* +clog +*.rpm +.build*.log +mokutil-*/ diff --git a/0001-Fix-the-potential-buffer-overflow.patch b/0001-Fix-the-potential-buffer-overflow.patch new file mode 100644 index 0000000..ef8518f --- /dev/null +++ b/0001-Fix-the-potential-buffer-overflow.patch @@ -0,0 +1,36 @@ +From 1313fa02a5b2bfe61ee6702696600fc148ec2d6e Mon Sep 17 00:00:00 2001 +From: Gary Ching-Pang Lin +Date: Tue, 4 Nov 2014 15:50:03 +0800 +Subject: [PATCH 1/7] Fix the potential buffer overflow + +Signed-off-by: Gary Ching-Pang Lin +--- + src/mokutil.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index 5b34f22..93fb6fa 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -1743,7 +1743,7 @@ set_toggle (const char * VarName, uint32_t state) + MokToggleVar tvar; + char *password = NULL; + unsigned int pw_len; +- efi_char16_t efichar_pass[SB_PASSWORD_MAX]; ++ efi_char16_t efichar_pass[SB_PASSWORD_MAX+1]; + int ret = -1; + + printf ("password length: %d~%d\n", SB_PASSWORD_MIN, SB_PASSWORD_MAX); +@@ -1757,8 +1757,7 @@ set_toggle (const char * VarName, uint32_t state) + efichar_from_char (efichar_pass, password, + SB_PASSWORD_MAX * sizeof(efi_char16_t)); + +- memcpy(tvar.password, efichar_pass, +- SB_PASSWORD_MAX * sizeof(efi_char16_t)); ++ memcpy(tvar.password, efichar_pass, sizeof(tvar.password)); + + tvar.mok_toggle_state = state; + +-- +2.7.4 + diff --git a/0002-Fix-the-32bit-signedness-comparison.patch b/0002-Fix-the-32bit-signedness-comparison.patch new file mode 100644 index 0000000..de24b1c --- /dev/null +++ b/0002-Fix-the-32bit-signedness-comparison.patch @@ -0,0 +1,34 @@ +From cdb4b6f3bfd6ada6558ddfb889e27150f0841b28 Mon Sep 17 00:00:00 2001 +From: Gary Ching-Pang Lin +Date: Mon, 24 Nov 2014 11:38:54 +0800 +Subject: [PATCH 2/7] Fix the 32bit signedness comparison + +--- + src/mokutil.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index 93fb6fa..a7e83f7 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -1284,7 +1284,7 @@ issue_mok_request (char **files, uint32_t total, MokRequest req, + + /* Mok */ + read_size = read (fd, ptr, sizes[i]); +- if (read_size < 0 || read_size != sizes[i]) { ++ if (read_size < 0 || read_size != (int64_t)sizes[i]) { + fprintf (stderr, "Failed to read %s\n", files[i]); + goto error; + } +@@ -1645,7 +1645,7 @@ export_moks () + goto error; + } + +- while (offset < list[i].mok_size) { ++ while (offset < (int64_t)list[i].mok_size) { + write_size = write (fd, list[i].mok + offset, + list[i].mok_size - offset); + if (write_size < 0) { +-- +2.7.4 + diff --git a/0003-Build-with-fshort-wchar-so-toggle-passwords-work-rig.patch b/0003-Build-with-fshort-wchar-so-toggle-passwords-work-rig.patch new file mode 100644 index 0000000..80a677a --- /dev/null +++ b/0003-Build-with-fshort-wchar-so-toggle-passwords-work-rig.patch @@ -0,0 +1,42 @@ +From 9eb111a7f7b897ba4ae19a68708e010a5c384260 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 19 Jun 2015 16:53:36 -0400 +Subject: [PATCH 3/7] Build with -fshort-wchar so toggle passwords work right. + +This source tree uses: + +typedef wchar_t efi_char16_t; + +to define UEFI's UCS-2 character type. On many platforms, wchar_t is +32-bits by default. As a result, efichar_from_char winds up writing +4-byte characters instead of 2-byte characters. In the case where we +hash the password in mokutil, this works fine, because the same datatype +is used, and the values are the same. But for our feature toggles, +where we store the raw data and shim is interpretting the character +array, every other character winds up being L'\0', and verification +fails. + +So always build with -fshort-wchar to ensure we get 2-byte character +storage. + +Signed-off-by: Peter Jones +--- + configure.ac | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/configure.ac b/configure.ac +index fe28fb9..69d412a 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -37,7 +37,7 @@ else + default_strict=no + fi + +-WARNINGFLAGS_C="$WARNINGFLAGS_C -std=gnu11" ++WARNINGFLAGS_C="$WARNINGFLAGS_C -std=gnu11 -fshort-wchar" + + AC_ARG_ENABLE(strict, AS_HELP_STRING([--enable-strict],[Enable strict compilation options]), enable_strict=$enableval, + enable_strict=$default_strict) +-- +2.7.4 + diff --git a/0004-Don-t-allow-sha1-on-the-mokutil-command-line.patch b/0004-Don-t-allow-sha1-on-the-mokutil-command-line.patch new file mode 100644 index 0000000..3e75fda --- /dev/null +++ b/0004-Don-t-allow-sha1-on-the-mokutil-command-line.patch @@ -0,0 +1,32 @@ +From ecc8fb0d92f0f453414a98172df22e23fb5893f5 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 16 Jun 2015 17:06:30 -0400 +Subject: [PATCH 4/7] Don't allow sha1 on the mokutil command line. + +Related: rhbz#1115843 + +Signed-off-by: Peter Jones +--- + src/mokutil.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/mokutil.c b/src/mokutil.c +index a7e83f7..1fb34f9 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -1351,10 +1351,12 @@ identify_hash_type (const char *hash_str, efi_guid_t *type) + } + + switch (len) { ++#if 0 + case SHA_DIGEST_LENGTH*2: + *type = efi_guid_sha1; + hash_size = SHA_DIGEST_LENGTH; + break; ++#endif + case SHA224_DIGEST_LENGTH*2: + *type = efi_guid_sha224; + hash_size = SHA224_DIGEST_LENGTH; +-- +2.7.4 + diff --git a/0005-Make-all-efi_guid_t-const.patch b/0005-Make-all-efi_guid_t-const.patch new file mode 100644 index 0000000..0e12a37 --- /dev/null +++ b/0005-Make-all-efi_guid_t-const.patch @@ -0,0 +1,87 @@ +From eba569a8e6c33f07042758cbfa1706d7339464e1 Mon Sep 17 00:00:00 2001 +From: Gary Lin +Date: Wed, 13 Jan 2016 16:05:21 +0800 +Subject: [PATCH 5/7] Make all efi_guid_t const + +All UEFI GUIDs defined in efivar are const. Declare all of them const +to make gcc happy. + +Signed-off-by: Gary Lin +--- + src/mokutil.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index 1fb34f9..d2c52b4 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -200,7 +200,7 @@ efichar_from_char (efi_char16_t *dest, const char *src, size_t dest_len) + } + + static uint32_t +-efi_hash_size (efi_guid_t *hash_type) ++efi_hash_size (const efi_guid_t *hash_type) + { + if (efi_guid_cmp (hash_type, &efi_guid_sha1) == 0) { + return SHA_DIGEST_LENGTH; +@@ -218,7 +218,7 @@ efi_hash_size (efi_guid_t *hash_type) + } + + static uint32_t +-signature_size (efi_guid_t *hash_type) ++signature_size (const efi_guid_t *hash_type) + { + uint32_t hash_size; + +@@ -439,7 +439,7 @@ list_keys (uint8_t *data, size_t data_size) + + /* match the hash in the hash array and return the index if matched */ + static int +-match_hash_array (efi_guid_t *hash_type, const void *hash, ++match_hash_array (const efi_guid_t *hash_type, const void *hash, + const void *hash_array, const uint32_t array_size) + { + uint32_t hash_size, hash_count; +@@ -469,8 +469,8 @@ match_hash_array (efi_guid_t *hash_type, const void *hash, + } + + static int +-delete_data_from_list (efi_guid_t *var_guid, const char *var_name, +- efi_guid_t *type, void *data, uint32_t data_size) ++delete_data_from_list (const efi_guid_t *var_guid, const char *var_name, ++ const efi_guid_t *type, void *data, uint32_t data_size) + { + uint8_t *var_data = NULL; + size_t var_data_size = 0; +@@ -1006,8 +1006,8 @@ is_valid_cert (void *cert, uint32_t cert_size) + } + + static int +-is_duplicate (efi_guid_t *type, const void *data, const uint32_t data_size, +- efi_guid_t *vendor, const char *db_name) ++is_duplicate (const efi_guid_t *type, const void *data, const uint32_t data_size, ++ const efi_guid_t *vendor, const char *db_name) + { + uint8_t *var_data; + size_t var_data_size; +@@ -1059,7 +1059,7 @@ done: + } + + static int +-is_valid_request (efi_guid_t *type, void *mok, uint32_t mok_size, ++is_valid_request (const efi_guid_t *type, void *mok, uint32_t mok_size, + MokRequest req) + { + switch (req) { +@@ -1096,7 +1096,7 @@ is_valid_request (efi_guid_t *type, void *mok, uint32_t mok_size, + } + + static int +-in_pending_request (efi_guid_t *type, void *data, uint32_t data_size, ++in_pending_request (const efi_guid_t *type, void *data, uint32_t data_size, + MokRequest req) + { + uint8_t *authvar_data; +-- +2.7.4 + diff --git a/0006-mokutil-be-explicit-about-file-modes-in-all-cases.patch b/0006-mokutil-be-explicit-about-file-modes-in-all-cases.patch new file mode 100644 index 0000000..a0d87f3 --- /dev/null +++ b/0006-mokutil-be-explicit-about-file-modes-in-all-cases.patch @@ -0,0 +1,37 @@ +From b68dca2d4de779387c4b5306bb9cfc9a3bab2572 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jun 2016 10:19:43 -0400 +Subject: [PATCH 6/7] mokutil: be explicit about file modes in all cases. + +Signed-off-by: Peter Jones +--- + src/mokutil.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index d2c52b4..d554f6c 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -574,7 +574,8 @@ delete_data_from_list (const efi_guid_t *var_guid, const char *var_name, + | EFI_VARIABLE_BOOTSERVICE_ACCESS + | EFI_VARIABLE_RUNTIME_ACCESS; + ret = efi_set_variable (*var_guid, var_name, +- var_data, total, attributes); ++ var_data, total, attributes, ++ S_IRUSR | S_IWUSR); + if (ret < 0) { + fprintf (stderr, "Failed to write variable \"%s\": %m\n", + var_name); +@@ -938,7 +939,8 @@ update_request (void *new_list, int list_len, MokRequest req, + data_size = list_len; + + if (efi_set_variable (efi_guid_shim, req_name, +- data, data_size, attributes) < 0) { ++ data, data_size, attributes, ++ S_IRUSR | S_IWUSR) < 0) { + switch (req) { + case ENROLL_MOK: + fprintf (stderr, "Failed to enroll new keys\n"); +-- +2.7.4 + diff --git a/0007-Add-bash-completion-file.patch b/0007-Add-bash-completion-file.patch new file mode 100644 index 0000000..725ad66 --- /dev/null +++ b/0007-Add-bash-completion-file.patch @@ -0,0 +1,98 @@ +From d16c76d139f9a9a56b49c0dd51cd9056f626031e Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jun 2016 10:20:14 -0400 +Subject: [PATCH 7/7] Add bash completion file. + +Signed-off-by: Peter Jones +--- + Makefile.am | 5 +++++ + configure.ac | 17 +++++++++++++++++ + data/mokutil | 37 +++++++++++++++++++++++++++++++++++++ + 3 files changed, 59 insertions(+) + create mode 100755 data/mokutil + +diff --git a/Makefile.am b/Makefile.am +index 9f0d419..c17cc4a 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1 +1,6 @@ + SUBDIRS = src man ++ ++if ENABLE_BASH_COMPLETION ++ bashcompletiondir = $(BASH_COMPLETION_DIR) ++ dist_bashcompletion_DATA = data/mokutil ++endif +diff --git a/configure.ac b/configure.ac +index 69d412a..7b52a06 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -86,6 +86,23 @@ AC_CHECK_FUNCS([memset]) + PKG_CHECK_MODULES(OPENSSL, [openssl >= 0.9.8]) + PKG_CHECK_MODULES(EFIVAR, [efivar >= 0.12]) + ++AC_ARG_WITH([bash-completion-dir], ++ AS_HELP_STRING([--with-bash-completion-dir[=PATH]], ++ [Install the bash auto-completion script in this directory. @<:@default=yes@:>@]), ++ [], ++ [with_bash_completion_dir=yes]) ++ ++if test "x$with_bash_completion_dir" = "xyes"; then ++ PKG_CHECK_MODULES([BASH_COMPLETION], [bash-completion >= 2.0], ++ [BASH_COMPLETION_DIR="`pkg-config --variable=completionsdir bash-completion`"], ++ [BASH_COMPLETION_DIR="$datadir/bash-completion/completions"]) ++else ++ BASH_COMPLETION_DIR="$with_bash_completion_dir" ++fi ++ ++AC_SUBST([BASH_COMPLETION_DIR]) ++AM_CONDITIONAL([ENABLE_BASH_COMPLETION],[test "x$with_bash_completion_dir" != "xno"]) ++ + AC_CONFIG_FILES([Makefile + src/Makefile + man/Makefile]) +diff --git a/data/mokutil b/data/mokutil +new file mode 100755 +index 0000000..800b039 +--- /dev/null ++++ b/data/mokutil +@@ -0,0 +1,37 @@ ++#!/bin/bash ++ ++_mokutil() ++{ ++ local cur=${COMP_WORDS[COMP_CWORD]} ++ ++ if [[ "$cur" == -* ]]; then ++ #COMPREPLY=( $( compgen -W "--help --list-enrolled --list-new --list-delete --import --delete --revoke-import --revoke-delete --export --password --clear-password --disable-validation --enable-validation --sb-state --test-key --reset --generate-hash --hash-file --root-pw --simple-hash" -- $cur ) ) ++ COMPREPLY=( $( compgen -W '$( _parse_help "$1" --long-help ) -h -l -N -D -i -d -x -p -c -t -f -g -P -s -X' -- "$cur" ) ) ++ [[ $COMPREPLY == *= ]] && compopt -o nospace ++ return 0 ++ fi ++ ++ case "${COMP_WORDS[COMP_CWORD-1]}" in ++ --import|-i|--delete|-d|--test-key|-t|--hash-file|-f) ++ _filedir ++ return 0 ++ ;; ++ --import-hash|--delete-hash) ++ COMPREPLY=( $( compgen -W "" ) ) ++ return 0 ++ ;; ++ --set-verbosity) ++ COMPREPLY=( $( compgen -W "true false") ) ++ return 0 ++ ;; ++ --generate-hash|-g) ++ COMPREPLY=( $( compgen -o nospace -P= -W "") ) ++ return 0 ++ ;; ++ *) ++ return 0 ++ ;; ++ esac ++} ++ ++complete -F _mokutil mokutil +-- +2.7.4 + diff --git a/dead.package b/dead.package deleted file mode 100644 index 4caac65..0000000 --- a/dead.package +++ /dev/null @@ -1 +0,0 @@ -mokutil fails to build from source: https://bugzilla.redhat.com/show_bug.cgi?id=1675403 diff --git a/mokutil.spec b/mokutil.spec new file mode 100644 index 0000000..7b2c384 --- /dev/null +++ b/mokutil.spec @@ -0,0 +1,109 @@ +Name: mokutil +Version: 0.3.0 +Release: 13%{?dist} +Epoch: 1 +Summary: Tool to manage UEFI Secure Boot MoK Keys +License: GPLv3+ +URL: https://github.com/lcp/mokutil +ExclusiveArch: %{ix86} x86_64 aarch64 +BuildRequires: gcc +BuildRequires: autoconf automake gnu-efi git openssl-devel openssl +BuildRequires: efivar-devel >= 31-1 +Source0: https://github.com/lcp/mokutil/archive/%{version}.tar.gz +Conflicts: shim < 0.8-1%{?dist} +Obsoletes: mokutil < 0.2.0 + +Patch0001: 0001-Fix-the-potential-buffer-overflow.patch +Patch0002: 0002-Fix-the-32bit-signedness-comparison.patch +Patch0003: 0003-Build-with-fshort-wchar-so-toggle-passwords-work-rig.patch +Patch0004: 0004-Don-t-allow-sha1-on-the-mokutil-command-line.patch +Patch0005: 0005-Make-all-efi_guid_t-const.patch +Patch0006: 0006-mokutil-be-explicit-about-file-modes-in-all-cases.patch +Patch0007: 0007-Add-bash-completion-file.patch + +%description +mokutil provides a tool to manage keys for Secure Boot through the MoK +("Machine's Own Keys") mechanism. + +%prep +%setup -q -n %{name}-%{version} +git init +git config user.email "%{name}-owner@fedoraproject.org" +git config user.name "Fedora Ninjas" +git add . +git commit -a -q -m "%{version} baseline." +git am %{patches} - 1:0.3.0-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri Feb 01 2019 Fedora Release Engineering - 1:0.3.0-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 1:0.3.0-11 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Fri Jul 13 2018 Fedora Release Engineering - 1:0.3.0-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Feb 08 2018 Fedora Release Engineering - 1:0.3.0-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sat Jan 20 2018 Björn Esser - 1:0.3.0-8 +- Rebuilt for switch to libxcrypt + +* Thu Aug 03 2017 Fedora Release Engineering - 1:0.3.0-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 1:0.3.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sat Jul 08 2017 Peter Jones - 0.3.0-5 +- Rebuild for efivar-31-1.fc26 + Related: rhbz#1468841 + +* Fri Feb 10 2017 Fedora Release Engineering - 1:0.3.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Wed Aug 17 2016 Peter Jones - 0.3.0-3 +- Rebuild for newer efivar again. + +* Wed Aug 10 2016 Peter Jones - 0.3.0-2 +- Update for newer efivar. + +* Tue Jun 14 2016 Peter Jones - 0.3.0-1 +- Update to 0.3.0 release. + Resolves: rhbz#1334628 + +* Thu Feb 04 2016 Fedora Release Engineering - 1:0.2.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Jun 17 2015 Fedora Release Engineering - 1:0.2.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Sat Feb 21 2015 Till Maas - 1:0.2.0-2 +- Rebuilt for Fedora 23 Change + https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code + +* Mon Oct 06 2014 Peter Jones - 0.2.0-1 +- First independent package. diff --git a/sources b/sources new file mode 100644 index 0000000..969b0b4 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +5b102eed26eaef5f622f3f5478351c12 0.3.0.tar.gz