rpms/mokutil
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add ability to change fallback verbose mode

Browse Source 
Resolves: #2069296
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
This commit is contained in:
Robbie Harwood 2022-03-28 20:16:39 +00:00
parent e13acbe8fb
commit c106c71a13
11 changed files with 327 additions and 111 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
0001-Avoid-taking-pointer-to-packed-struct.patch
View File

@ -1,4 +1,4 @@
From 19e8c9071b3d9306ca7b7329b313b31f86c2936d Mon Sep 17 00:00:00 2001 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Harry Youd <harry@harryyoud.co.uk> From: Harry Youd <harry@harryyoud.co.uk>
Date: Wed, 31 Jul 2019 19:44:53 +0100 Date: Wed, 31 Jul 2019 19:44:53 +0100
Subject: [PATCH] Avoid taking pointer to packed struct Subject: [PATCH] Avoid taking pointer to packed struct
@ -112,6 +112,3 @@ index e2d567d..8892613 100644
continue; continue;
/* Dump X509 certificate to files */ /* Dump X509 certificate to files */
--
2.21.0

9
0002-Fix-a-integer-comparison-sign-issue.patch
View File

@ -1,4 +1,4 @@
From 9292352eb29a4fca41909448799efc524ee3c255 Mon Sep 17 00:00:00 2001 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com> From: Peter Jones <pjones@redhat.com>
Date: Wed, 25 Jul 2018 10:27:34 -0400 Date: Wed, 25 Jul 2018 10:27:34 -0400
Subject: [PATCH] Fix a integer comparison sign issue. Subject: [PATCH] Fix a integer comparison sign issue.
@ -16,10 +16,10 @@ Signed-off-by: Peter Jones <pjones@redhat.com>
1 file changed, 1 insertion(+), 1 deletion(-) 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/mokutil.c b/src/mokutil.c diff --git a/src/mokutil.c b/src/mokutil.c
index d03127abf54..068df0d109c 100644 index 8892613..b66c1b8 100644
--- a/src/mokutil.c --- a/src/mokutil.c
+++ b/src/mokutil.c +++ b/src/mokutil.c
@@ -1938,7 +1938,7 @@ generate_pw_hash (const char *input_pw) @@ -2011,7 +2011,7 @@ generate_pw_hash (const char *input_pw)
char *password = NULL; char *password = NULL;
char *crypt_string; char *crypt_string;
const char *prefix; const char *prefix;
@ -28,6 +28,3 @@ index d03127abf54..068df0d109c 100644
unsigned int pw_len, salt_size; unsigned int pw_len, salt_size;
if (input_pw) { if (input_pw) {
--
2.23.0

41
0005-mokutil-remove-simple-hash.patch → 0003-mokutil-remove-simple-hash.patch
View File

@ -1,4 +1,4 @@
From b7a6c0a7ee8e66c5daa377d2e6f59461ed34f3bf Mon Sep 17 00:00:00 2001 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Gary Lin <glin@suse.com> From: Gary Lin <glin@suse.com>
Date: Tue, 25 May 2021 12:46:03 +0200 Date: Tue, 25 May 2021 12:46:03 +0200
Subject: [PATCH] mokutil: remove "--simple-hash" Subject: [PATCH] mokutil: remove "--simple-hash"
@ -9,11 +9,11 @@ Remove the code to reduce the code size.
Signed-off-by: Gary Lin <glin@suse.com> Signed-off-by: Gary Lin <glin@suse.com>
--- ---
src/mokutil.c | 87 +++++---------------------------------------------- src/mokutil.c | 87 +++++------------------------------------------------------
1 file changed, 7 insertions(+), 80 deletions(-) 1 file changed, 7 insertions(+), 80 deletions(-)
diff --git a/src/mokutil.c b/src/mokutil.c diff --git a/src/mokutil.c b/src/mokutil.c
index 252dc7a327f..563e585979b 100644 index b66c1b8..e811266 100644
--- a/src/mokutil.c --- a/src/mokutil.c
+++ b/src/mokutil.c +++ b/src/mokutil.c
@@ -76,7 +76,6 @@ @@ -76,7 +76,6 @@
@ -24,7 +24,7 @@ index 252dc7a327f..563e585979b 100644
#define IGNORE_DB (1 << 18) #define IGNORE_DB (1 << 18)
#define USE_DB (1 << 19) #define USE_DB (1 << 19)
#define MOKX (1 << 20) #define MOKX (1 << 20)
@@ -95,8 +94,6 @@ typedef unsigned long efi_status_t; @@ -94,8 +93,6 @@ typedef unsigned long efi_status_t;
typedef uint8_t efi_bool_t; typedef uint8_t efi_bool_t;
typedef wchar_t efi_char16_t; /* UNICODE character */ typedef wchar_t efi_char16_t; /* UNICODE character */
@ -33,7 +33,7 @@ index 252dc7a327f..563e585979b 100644
typedef enum { typedef enum {
DELETE_MOK = 0, DELETE_MOK = 0,
ENROLL_MOK, ENROLL_MOK,
@@ -182,7 +179,6 @@ print_help () @@ -180,7 +177,6 @@ print_help ()
printf ("Supplimentary Options:\n"); printf ("Supplimentary Options:\n");
printf (" --hash-file <hash file>\t\tUse the specific password hash\n"); printf (" --hash-file <hash file>\t\tUse the specific password hash\n");
printf (" --root-pw\t\t\t\tUse the root password\n"); printf (" --root-pw\t\t\t\tUse the root password\n");
@ -41,7 +41,7 @@ index 252dc7a327f..563e585979b 100644
printf (" --mokx\t\t\t\tManipulate the MOK blacklist\n"); printf (" --mokx\t\t\t\tManipulate the MOK blacklist\n");
} }
@@ -814,32 +810,6 @@ error: @@ -736,32 +732,6 @@ error:
return ret; return ret;
} }
@ -74,7 +74,7 @@ index 252dc7a327f..563e585979b 100644
static void static void
generate_salt (char salt[], unsigned int salt_size) generate_salt (char salt[], unsigned int salt_size)
{ {
@@ -979,7 +949,6 @@ update_request (void *new_list, int list_len, MokRequest req, @@ -901,7 +871,6 @@ update_request (void *new_list, int list_len, MokRequest req,
size_t data_size; size_t data_size;
const char *req_name, *auth_name; const char *req_name, *auth_name;
pw_crypt_t pw_crypt; pw_crypt_t pw_crypt;
@ -82,7 +82,7 @@ index 252dc7a327f..563e585979b 100644
char *password = NULL; char *password = NULL;
unsigned int pw_len; unsigned int pw_len;
int auth_ret; int auth_ret;
@@ -1028,12 +997,7 @@ update_request (void *new_list, int list_len, MokRequest req, @@ -950,12 +919,7 @@ update_request (void *new_list, int list_len, MokRequest req,
goto error; goto error;
} }
@ -96,7 +96,7 @@ index 252dc7a327f..563e585979b 100644
if (auth_ret < 0) { if (auth_ret < 0) {
fprintf (stderr, "Couldn't generate hash\n"); fprintf (stderr, "Couldn't generate hash\n");
goto error; goto error;
@@ -1069,13 +1033,8 @@ update_request (void *new_list, int list_len, MokRequest req, @@ -991,13 +955,8 @@ update_request (void *new_list, int list_len, MokRequest req,
} }
/* Write MokAuth, MokDelAuth, MokXAuth, or MokXDelAuth */ /* Write MokAuth, MokDelAuth, MokXAuth, or MokXDelAuth */
@ -112,7 +112,7 @@ index 252dc7a327f..563e585979b 100644
if (efi_set_variable (efi_guid_shim, auth_name, data, data_size, if (efi_set_variable (efi_guid_shim, auth_name, data, data_size,
attributes, S_IRUSR | S_IWUSR) < 0) { attributes, S_IRUSR | S_IWUSR) < 0) {
@@ -1904,26 +1863,16 @@ set_password (const char *hash_file, const int root_pw, const int clear) @@ -1750,26 +1709,16 @@ set_password (const char *hash_file, const int root_pw, const int clear)
goto error; goto error;
} }
@ -143,7 +143,7 @@ index 252dc7a327f..563e585979b 100644
uint32_t attributes = EFI_VARIABLE_NON_VOLATILE uint32_t attributes = EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS; | EFI_VARIABLE_RUNTIME_ACCESS;
@@ -2301,8 +2250,6 @@ main (int argc, char *argv[]) @@ -2147,8 +2096,6 @@ main (int argc, char *argv[])
DBName db_name = MOK_LIST_RT; DBName db_name = MOK_LIST_RT;
int ret = -1; int ret = -1;
@ -152,7 +152,7 @@ index 252dc7a327f..563e585979b 100644
if (!efi_variables_supported ()) { if (!efi_variables_supported ()) {
fprintf (stderr, "EFI variables are not supported on this system\n"); fprintf (stderr, "EFI variables are not supported on this system\n");
exit (1); exit (1);
@@ -2329,7 +2276,6 @@ main (int argc, char *argv[]) @@ -2175,7 +2122,6 @@ main (int argc, char *argv[])
{"hash-file", required_argument, 0, 'f'}, {"hash-file", required_argument, 0, 'f'},
{"generate-hash", optional_argument, 0, 'g'}, {"generate-hash", optional_argument, 0, 'g'},
{"root-pw", no_argument, 0, 'P'}, {"root-pw", no_argument, 0, 'P'},
@ -160,7 +160,7 @@ index 252dc7a327f..563e585979b 100644
{"ignore-db", no_argument, 0, 0 }, {"ignore-db", no_argument, 0, 0 },
{"use-db", no_argument, 0, 0 }, {"use-db", no_argument, 0, 0 },
{"mok", no_argument, 0, 'm'}, {"mok", no_argument, 0, 'm'},
@@ -2531,10 +2477,6 @@ main (int argc, char *argv[]) @@ -2374,10 +2320,6 @@ main (int argc, char *argv[])
case 'x': case 'x':
command |= EXPORT; command |= EXPORT;
break; break;
@ -171,7 +171,7 @@ index 252dc7a327f..563e585979b 100644
case 'm': case 'm':
db_name = MOK_LIST_RT; db_name = MOK_LIST_RT;
break; break;
@@ -2555,9 +2497,6 @@ main (int argc, char *argv[]) @@ -2398,9 +2340,6 @@ main (int argc, char *argv[])
} }
} }
@ -181,7 +181,7 @@ index 252dc7a327f..563e585979b 100644
if (hash_file && use_root_pw) if (hash_file && use_root_pw)
command |= HELP; command |= HELP;
@@ -2593,22 +2532,18 @@ main (int argc, char *argv[]) @@ -2436,22 +2375,18 @@ main (int argc, char *argv[])
ret = list_keys_in_var ("MokDel", efi_guid_shim); ret = list_keys_in_var ("MokDel", efi_guid_shim);
break; break;
case IMPORT: case IMPORT:
@ -204,7 +204,7 @@ index 252dc7a327f..563e585979b 100644
ret = issue_hash_request (hash_str, DELETE_MOK, ret = issue_hash_request (hash_str, DELETE_MOK,
hash_file, use_root_pw); hash_file, use_root_pw);
break; break;
@@ -2623,11 +2558,9 @@ main (int argc, char *argv[]) @@ -2466,11 +2401,9 @@ main (int argc, char *argv[])
ret = export_db_keys (db_name); ret = export_db_keys (db_name);
break; break;
case PASSWORD: case PASSWORD:
@ -216,7 +216,7 @@ index 252dc7a327f..563e585979b 100644
ret = set_password (NULL, 0, 1); ret = set_password (NULL, 0, 1);
break; break;
case DISABLE_VALIDATION: case DISABLE_VALIDATION:
@@ -2643,7 +2576,6 @@ main (int argc, char *argv[]) @@ -2486,7 +2419,6 @@ main (int argc, char *argv[])
ret = test_key (ENROLL_MOK, key_file); ret = test_key (ENROLL_MOK, key_file);
break; break;
case RESET: case RESET:
@ -224,7 +224,7 @@ index 252dc7a327f..563e585979b 100644
ret = reset_moks (ENROLL_MOK, hash_file, use_root_pw); ret = reset_moks (ENROLL_MOK, hash_file, use_root_pw);
break; break;
case GENERATE_PW_HASH: case GENERATE_PW_HASH:
@@ -2662,22 +2594,18 @@ main (int argc, char *argv[]) @@ -2505,22 +2437,18 @@ main (int argc, char *argv[])
ret = list_keys_in_var ("MokXDel", efi_guid_shim); ret = list_keys_in_var ("MokXDel", efi_guid_shim);
break; break;
case IMPORT | MOKX: case IMPORT | MOKX:
@ -247,7 +247,7 @@ index 252dc7a327f..563e585979b 100644
ret = issue_hash_request (hash_str, DELETE_BLACKLIST, ret = issue_hash_request (hash_str, DELETE_BLACKLIST,
hash_file, use_root_pw); hash_file, use_root_pw);
break; break;
@@ -2688,7 +2616,6 @@ main (int argc, char *argv[]) @@ -2531,7 +2459,6 @@ main (int argc, char *argv[])
ret = revoke_request (DELETE_BLACKLIST); ret = revoke_request (DELETE_BLACKLIST);
break; break;
case RESET | MOKX: case RESET | MOKX:
@ -255,6 +255,3 @@ index 252dc7a327f..563e585979b 100644
ret = reset_moks (ENROLL_BLACKLIST, hash_file, use_root_pw); ret = reset_moks (ENROLL_BLACKLIST, hash_file, use_root_pw);
break; break;
case TEST_KEY | MOKX: case TEST_KEY | MOKX:
--
2.31.1

11
0006-man-remove-simple-hash.patch → 0004-man-remove-simple-hash.patch
View File

@ -1,7 +1,7 @@
From d944337820debcaa5e275ec6a3523702ee2d9dd7 Mon Sep 17 00:00:00 2001 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Gary Lin <glin@suse.com> From: Gary Lin <glin@suse.com>
Date: Thu, 27 Aug 2020 14:48:08 +0800 Date: Thu, 27 Aug 2020 14:48:08 +0800
Subject: [PATCH 2/2] man: remove "--simple-hash" Subject: [PATCH] man: remove "--simple-hash"
Remove "--simple-hash" from the man page. Remove "--simple-hash" from the man page.
@ -11,7 +11,7 @@ Signed-off-by: Gary Lin <glin@suse.com>
1 file changed, 6 insertions(+), 13 deletions(-) 1 file changed, 6 insertions(+), 13 deletions(-)
diff --git a/man/mokutil.1 b/man/mokutil.1 diff --git a/man/mokutil.1 b/man/mokutil.1
index 446298763ad..1f82ff1abed 100644 index 25fe8b4..7cee5da 100644
--- a/man/mokutil.1 --- a/man/mokutil.1
+++ b/man/mokutil.1 +++ b/man/mokutil.1
@@ -15,11 +15,11 @@ mokutil \- utility to manipulate machine owner keys @@ -15,11 +15,11 @@ mokutil \- utility to manipulate machine owner keys
@ -64,7 +64,7 @@ index 446298763ad..1f82ff1abed 100644
.br .br
\fBmokutil\fR [--set-verbosity (\fItrue\fR | \fIfalse\fR)] \fBmokutil\fR [--set-verbosity (\fItrue\fR | \fIfalse\fR)]
.br .br
@@ -138,11 +136,6 @@ Use the password hash from a specific file @@ -136,11 +134,6 @@ Use the password hash from a specific file
\fB-P, --root-pw\fR \fB-P, --root-pw\fR
Use the root password hash from /etc/shadow Use the root password hash from /etc/shadow
.TP .TP
@ -76,6 +76,3 @@ index 446298763ad..1f82ff1abed 100644
\fB--ignore-db\fR \fB--ignore-db\fR
Tell shim to not use the keys in db to verify EFI images Tell shim to not use the keys in db to verify EFI images
.TP .TP
--
2.31.1

38
0005-mokutil-adjust-the-command-bits.patch Normal file
View File

@ -0,0 +1,38 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Gary Lin <glin@suse.com>
Date: Thu, 27 Aug 2020 16:10:50 +0800
Subject: [PATCH] mokutil: adjust the command bits
Adjust the bits after removing SIMPLE_HASH.
Signed-off-by: Gary Lin <glin@suse.com>
(cherry picked from commit 25191c38156b90004b783d0265d967dbe8e76a38)
---
src/mokutil.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/src/mokutil.c b/src/mokutil.c
index e811266..a9d97f4 100644
--- a/src/mokutil.c
+++ b/src/mokutil.c
@@ -76,13 +76,13 @@
#define TEST_KEY (1 << 14)
#define RESET (1 << 15)
#define GENERATE_PW_HASH (1 << 16)
-#define IGNORE_DB (1 << 18)
-#define USE_DB (1 << 19)
-#define MOKX (1 << 20)
-#define IMPORT_HASH (1 << 21)
-#define DELETE_HASH (1 << 22)
-#define VERBOSITY (1 << 23)
-#define TIMEOUT (1 << 24)
+#define IGNORE_DB (1 << 17)
+#define USE_DB (1 << 18)
+#define MOKX (1 << 19)
+#define IMPORT_HASH (1 << 20)
+#define DELETE_HASH (1 << 21)
+#define VERBOSITY (1 << 22)
+#define TIMEOUT (1 << 23)
#define DEFAULT_CRYPT_METHOD SHA512_BASED
#define DEFAULT_SALT_SIZE SHA512_SALT_MAX

69
0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch → 0006-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch
View File

@ -1,4 +1,4 @@
From 698994102afcbbe16e65930a09e0df5248c4d200 Mon Sep 17 00:00:00 2001 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm@redhat.com> From: Javier Martinez Canillas <javierm@redhat.com>
Date: Wed, 17 Mar 2021 14:38:57 +0100 Date: Wed, 17 Mar 2021 14:38:57 +0100
Subject: [PATCH] mokutil: Add option to print the UEFI SBAT variable content Subject: [PATCH] mokutil: Add option to print the UEFI SBAT variable content
@ -16,43 +16,23 @@ previous processing.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
--- ---
man/mokutil.1 | 5 +++++
src/mokutil.c | 33 +++++++++++++++++++++++++++++++++ src/mokutil.c | 33 +++++++++++++++++++++++++++++++++
man/mokutil.1 | 5 +++++
2 files changed, 38 insertions(+) 2 files changed, 38 insertions(+)
diff --git a/man/mokutil.1 b/man/mokutil.1
index 25fe8b433da..446298763ad 100644
--- a/man/mokutil.1
+++ b/man/mokutil.1
@@ -73,6 +73,8 @@ mokutil \- utility to manipulate machine owner keys
.br
\fBmokutil\fR [--dbx]
.br
+\fBmokutil\fR [--sbat]
+.br
.SH DESCRIPTION
\fBmokutil\fR is a tool to import or delete the machines owner keys
@@ -173,3 +175,6 @@ List the keys in the secure boot signature store (db)
\fB--dbx\fR
List the keys in the secure boot blacklist signature store (dbx)
.TP
+\fB--sbat\fR
+List the entries in the Secure Boot Advanced Targeting store (SBAT)
+.TP
diff --git a/src/mokutil.c b/src/mokutil.c diff --git a/src/mokutil.c b/src/mokutil.c
index b66c1b8b5a7..0c25ae5033d 100644 index a9d97f4..dba77c9 100644
--- a/src/mokutil.c --- a/src/mokutil.c
+++ b/src/mokutil.c +++ b/src/mokutil.c
@@ -84,6 +84,7 @@ @@ -83,6 +83,7 @@
#define DELETE_HASH (1 << 22) #define DELETE_HASH (1 << 21)
#define VERBOSITY (1 << 23) #define VERBOSITY (1 << 22)
#define TIMEOUT (1 << 24) #define TIMEOUT (1 << 23)
+#define LIST_SBAT (1 << 25) +#define LIST_SBAT (1 << 24)
#define DEFAULT_CRYPT_METHOD SHA512_BASED #define DEFAULT_CRYPT_METHOD SHA512_BASED
#define DEFAULT_SALT_SIZE SHA512_SALT_MAX #define DEFAULT_SALT_SIZE SHA512_SALT_MAX
@@ -176,6 +177,7 @@ print_help () @@ -173,6 +174,7 @@ print_help ()
printf (" --db\t\t\t\t\tList the keys in db\n"); printf (" --db\t\t\t\t\tList the keys in db\n");
printf (" --dbx\t\t\t\t\tList the keys in dbx\n"); printf (" --dbx\t\t\t\t\tList the keys in dbx\n");
printf (" --timeout <-1,0..0x7fff>\t\tSet the timeout for MOK prompt\n"); printf (" --timeout <-1,0..0x7fff>\t\tSet the timeout for MOK prompt\n");
@ -60,7 +40,7 @@ index b66c1b8b5a7..0c25ae5033d 100644
printf ("\n"); printf ("\n");
printf ("Supplimentary Options:\n"); printf ("Supplimentary Options:\n");
printf (" --hash-file <hash file>\t\tUse the specific password hash\n"); printf (" --hash-file <hash file>\t\tUse the specific password hash\n");
@@ -1598,6 +1600,31 @@ error: @@ -1557,6 +1559,31 @@ error:
return ret; return ret;
} }
@ -92,7 +72,7 @@ index b66c1b8b5a7..0c25ae5033d 100644
static int static int
revoke_request (MokRequest req) revoke_request (MokRequest req)
{ {
@@ -2187,6 +2214,7 @@ main (int argc, char *argv[]) @@ -2133,6 +2160,7 @@ main (int argc, char *argv[])
{"kek", no_argument, 0, 0 }, {"kek", no_argument, 0, 0 },
{"db", no_argument, 0, 0 }, {"db", no_argument, 0, 0 },
{"dbx", no_argument, 0, 0 }, {"dbx", no_argument, 0, 0 },
@ -100,7 +80,7 @@ index b66c1b8b5a7..0c25ae5033d 100644
{"timeout", required_argument, 0, 0 }, {"timeout", required_argument, 0, 0 },
{0, 0, 0, 0} {0, 0, 0, 0}
}; };
@@ -2271,6 +2299,8 @@ main (int argc, char *argv[]) @@ -2217,6 +2245,8 @@ main (int argc, char *argv[])
} else { } else {
db_name = DBX; db_name = DBX;
} }
@ -109,7 +89,7 @@ index b66c1b8b5a7..0c25ae5033d 100644
} else if (strcmp (option, "timeout") == 0) { } else if (strcmp (option, "timeout") == 0) {
command |= TIMEOUT; command |= TIMEOUT;
timeout = strdup (optarg); timeout = strdup (optarg);
@@ -2543,6 +2573,9 @@ main (int argc, char *argv[]) @@ -2470,6 +2500,9 @@ main (int argc, char *argv[])
case TIMEOUT: case TIMEOUT:
ret = set_timeout (timeout); ret = set_timeout (timeout);
break; break;
@ -119,6 +99,23 @@ index b66c1b8b5a7..0c25ae5033d 100644
default: default:
print_help (); print_help ();
break; break;
-- diff --git a/man/mokutil.1 b/man/mokutil.1
2.29.2 index 7cee5da..1f82ff1 100644
--- a/man/mokutil.1
+++ b/man/mokutil.1
@@ -71,6 +71,8 @@ mokutil \- utility to manipulate machine owner keys
.br
\fBmokutil\fR [--dbx]
.br
+\fBmokutil\fR [--sbat]
+.br
.SH DESCRIPTION
\fBmokutil\fR is a tool to import or delete the machines owner keys
@@ -166,3 +168,6 @@ List the keys in the secure boot signature store (db)
\fB--dbx\fR
List the keys in the secure boot blacklist signature store (dbx)
.TP
+\fB--sbat\fR
+List the entries in the Secure Boot Advanced Targeting store (SBAT)
+.TP

27
0004-mokutil-add-mok-variables-parsing-support.patch → 0007-mokutil-add-mok-variables-parsing-support.patch
View File

@ -1,4 +1,4 @@
From 256639accc910e60496fffef96128dc1afd0fa3a Mon Sep 17 00:00:00 2001 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com> From: Peter Jones <pjones@redhat.com>
Date: Wed, 17 Mar 2021 14:49:21 +0100 Date: Wed, 17 Mar 2021 14:49:21 +0100
Subject: [PATCH] mokutil: add mok-variables parsing support Subject: [PATCH] mokutil: add mok-variables parsing support
@ -10,14 +10,14 @@ variables.
Signed-off-by: Peter Jones <pjones@redhat.com> Signed-off-by: Peter Jones <pjones@redhat.com>
--- ---
src/mokutil.c | 175 +++++++++++++++++++++++++++++++++++++++++++------- src/mokutil.c | 175 ++++++++++++++++++++++++++++++++++++++++++++++++++--------
1 file changed, 151 insertions(+), 24 deletions(-) 1 file changed, 151 insertions(+), 24 deletions(-)
diff --git a/src/mokutil.c b/src/mokutil.c diff --git a/src/mokutil.c b/src/mokutil.c
index 0c25ae5033d..252dc7a327f 100644 index dba77c9..9153b10 100644
--- a/src/mokutil.c --- a/src/mokutil.c
+++ b/src/mokutil.c +++ b/src/mokutil.c
@@ -251,6 +251,63 @@ signature_size (const efi_guid_t *hash_type) @@ -247,6 +247,63 @@ signature_size (const efi_guid_t *hash_type)
return 0; return 0;
} }
@ -81,7 +81,7 @@ index 0c25ae5033d..252dc7a327f 100644
static MokListNode* static MokListNode*
build_mok_list (void *data, unsigned long data_size, uint32_t *mok_num) build_mok_list (void *data, unsigned long data_size, uint32_t *mok_num)
{ {
@@ -622,25 +679,44 @@ static int @@ -618,25 +675,44 @@ static int
list_keys_in_var (const char *var_name, const efi_guid_t guid) list_keys_in_var (const char *var_name, const efi_guid_t guid)
{ {
uint8_t *data = NULL; uint8_t *data = NULL;
@ -112,14 +112,11 @@ index 0c25ae5033d..252dc7a327f 100644
- fprintf (stderr, "Failed to read %s: %m\n", var_name); - fprintf (stderr, "Failed to read %s: %m\n", var_name);
- return -1; - return -1;
- }
+ ret = efi_get_variable (guid, varname, &data, &data_sz, + ret = efi_get_variable (guid, varname, &data, &data_sz,
+ &attributes); + &attributes);
+ if (ret < 0) + if (ret < 0)
+ return 0; + return 0;
+
- ret = list_keys (data, data_size);
- free (data);
+ ret = list_keys (data, data_sz); + ret = list_keys (data, data_sz);
+ free(data); + free(data);
+ /* + /*
@ -131,14 +128,17 @@ index 0c25ae5033d..252dc7a327f 100644
+ return 0; + return 0;
+ if (ret > 0) + if (ret > 0)
+ return ret; + return ret;
+ } }
- ret = list_keys (data, data_size);
- free (data);
-
- return ret; - return ret;
+ return 0; + return 0;
} }
static int static int
@@ -1039,22 +1115,15 @@ is_valid_cert (void *cert, uint32_t cert_size) @@ -998,22 +1074,15 @@ is_valid_cert (void *cert, uint32_t cert_size)
} }
static int static int
@ -165,7 +165,7 @@ index 0c25ae5033d..252dc7a327f 100644
return 0; return 0;
list = build_mok_list (var_data, var_data_size, &node_num); list = build_mok_list (var_data, var_data_size, &node_num);
@@ -1087,11 +1156,69 @@ is_duplicate (const efi_guid_t *type, const void *data, const uint32_t data_size @@ -1046,11 +1115,69 @@ is_duplicate (const efi_guid_t *type, const void *data, const uint32_t data_size
done: done:
if (list) if (list)
free (list); free (list);
@ -236,6 +236,3 @@ index 0c25ae5033d..252dc7a327f 100644
static int static int
is_valid_request (const efi_guid_t *type, void *mok, uint32_t mok_size, is_valid_request (const efi_guid_t *type, void *mok, uint32_t mok_size,
MokRequest req) MokRequest req)
--
2.29.2

21
0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch → 0008-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch
View File

@ -1,4 +1,4 @@
From f552d2bb570568673d293fcb2263a2ee8c3333de Mon Sep 17 00:00:00 2001 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm@redhat.com> From: Javier Martinez Canillas <javierm@redhat.com>
Date: Tue, 25 May 2021 15:22:29 +0200 Date: Tue, 25 May 2021 15:22:29 +0200
Subject: [PATCH] mokutil: use EVP_Digest()* functions instead of the Subject: [PATCH] mokutil: use EVP_Digest()* functions instead of the
@ -22,7 +22,7 @@ Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
1 file changed, 36 insertions(+), 8 deletions(-) 1 file changed, 36 insertions(+), 8 deletions(-)
diff --git a/src/mokutil.c b/src/mokutil.c diff --git a/src/mokutil.c b/src/mokutil.c
index 563e585979b..3fdc791af7f 100644 index 9153b10..0fd2dc3 100644
--- a/src/mokutil.c --- a/src/mokutil.c
+++ b/src/mokutil.c +++ b/src/mokutil.c
@@ -405,8 +405,10 @@ print_x509 (char *cert, int cert_size) @@ -405,8 +405,10 @@ print_x509 (char *cert, int cert_size)
@ -44,8 +44,11 @@ index 563e585979b..3fdc791af7f 100644
fprintf (stderr, "Invalid X509 certificate\n"); fprintf (stderr, "Invalid X509 certificate\n");
- return -1; - return -1;
+ goto cleanup_bio; + goto cleanup_bio;
+ } }
+
- SHA1_Init (&ctx);
- SHA1_Update (&ctx, cert, cert_size);
- SHA1_Final (fingerprint, &ctx);
+ md = EVP_get_digestbyname ("SHA1"); + md = EVP_get_digestbyname ("SHA1");
+ if(md == NULL) { + if(md == NULL) {
+ fprintf (stderr, "Failed to get SHA1 digest\n"); + fprintf (stderr, "Failed to get SHA1 digest\n");
@ -56,11 +59,8 @@ index 563e585979b..3fdc791af7f 100644
+ if (ctx == NULL) { + if (ctx == NULL) {
+ fprintf (stderr, "Failed to create digest context\n"); + fprintf (stderr, "Failed to create digest context\n");
+ goto cleanup_bio; + goto cleanup_bio;
} + }
+
- SHA1_Init (&ctx);
- SHA1_Update (&ctx, cert, cert_size);
- SHA1_Final (fingerprint, &ctx);
+ if (!EVP_DigestInit_ex (ctx, md, NULL)) { + if (!EVP_DigestInit_ex (ctx, md, NULL)) {
+ fprintf (stderr, "Failed to initialize digest context\n"); + fprintf (stderr, "Failed to initialize digest context\n");
+ goto cleanup_ctx; + goto cleanup_ctx;
@ -93,6 +93,3 @@ index 563e585979b..3fdc791af7f 100644
BIO_free (cert_bio); BIO_free (cert_bio);
return 0; return 0;
--
2.31.1

191
0009-mokutil-enable-setting-fallback-verbosity-and-norebo.patch Normal file
View File

@ -0,0 +1,191 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Fri, 3 Dec 2021 14:18:31 +0100
Subject: [PATCH] mokutil: enable setting fallback verbosity and noreboot mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Having mokutil handle FALLBACK_VERBOSE and FB_NO_REBOOT variables eases
fallback debugging.
Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
(cherry picked from commit 57bc385827e7c0e0c86f30bbfa2d48ca9505537e)
(cherry picked from commit 99d3990bdbbca0419dc97133f27d6932b3234224)
[rharwood: no sb_check, no util renaming]
---
src/mokutil.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
data/mokutil | 8 +++++++
man/mokutil.1 | 10 +++++++++
3 files changed, 88 insertions(+)
diff --git a/src/mokutil.c b/src/mokutil.c
index 0fd2dc3..f9641a1 100644
--- a/src/mokutil.c
+++ b/src/mokutil.c
@@ -84,6 +84,8 @@
#define VERBOSITY (1 << 22)
#define TIMEOUT (1 << 23)
#define LIST_SBAT (1 << 24)
+#define FB_VERBOSITY (1 << 25)
+#define FB_NOREBOOT (1 << 26)
#define DEFAULT_CRYPT_METHOD SHA512_BASED
#define DEFAULT_SALT_SIZE SHA512_SALT_MAX
@@ -169,6 +171,8 @@ print_help ()
printf (" --import-hash <hash>\t\t\tImport a hash into MOK or MOKX\n");
printf (" --delete-hash <hash>\t\t\tDelete a hash in MOK or MOKX\n");
printf (" --set-verbosity <true/false>\t\tSet the verbosity bit for shim\n");
+ printf (" --set-fallback-verbosity <true/false>\t\tSet the verbosity bit for fallback\n");
+ printf (" --set-fallback-noreboot <true/false>\t\tPrevent fallback from automatically rebooting\n");
printf (" --pk\t\t\t\t\tList the keys in PK\n");
printf (" --kek\t\t\t\t\tList the keys in KEK\n");
printf (" --db\t\t\t\t\tList the keys in db\n");
@@ -2240,6 +2244,46 @@ set_verbosity (uint8_t verbosity)
return 0;
}
+static int
+set_fallback_verbosity (const uint8_t verbosity)
+{
+ if (verbosity) {
+ uint32_t attributes = EFI_VARIABLE_NON_VOLATILE
+ | EFI_VARIABLE_BOOTSERVICE_ACCESS
+ | EFI_VARIABLE_RUNTIME_ACCESS;
+ if (efi_set_variable (efi_guid_shim, "FALLBACK_VERBOSE",
+ (uint8_t *)&verbosity, sizeof (verbosity),
+ attributes, S_IRUSR | S_IWUSR) < 0) {
+ fprintf (stderr, "Failed to set FALLBACK_VERBOSE\n");
+ return -1;
+ }
+ } else {
+ return test_and_delete_var ("FALLBACK_VERBOSE");
+ }
+
+ return 0;
+}
+
+static int
+set_fallback_noreboot (const uint8_t noreboot)
+{
+ if (noreboot) {
+ uint32_t attributes = EFI_VARIABLE_NON_VOLATILE
+ | EFI_VARIABLE_BOOTSERVICE_ACCESS
+ | EFI_VARIABLE_RUNTIME_ACCESS;
+ if (efi_set_variable (efi_guid_shim, "FB_NO_REBOOT",
+ (uint8_t *)&noreboot, sizeof (noreboot),
+ attributes, S_IRUSR | S_IWUSR) < 0) {
+ fprintf (stderr, "Failed to set FB_NO_REBOOT\n");
+ return -1;
+ }
+ } else {
+ return test_and_delete_var ("FB_NO_REBOOT");
+ }
+
+ return 0;
+}
+
static inline int
list_db (DBName db_name)
{
@@ -2275,6 +2319,8 @@ main (int argc, char *argv[])
unsigned int command = 0;
int use_root_pw = 0;
uint8_t verbosity = 0;
+ uint8_t fb_verbosity = 0;
+ uint8_t fb_noreboot = 0;
DBName db_name = MOK_LIST_RT;
int ret = -1;
@@ -2311,6 +2357,8 @@ main (int argc, char *argv[])
{"import-hash", required_argument, 0, 0 },
{"delete-hash", required_argument, 0, 0 },
{"set-verbosity", required_argument, 0, 0 },
+ {"set-fallback-verbosity", required_argument, 0, 0 },
+ {"set-fallback-noreboot", required_argument, 0, 0 },
{"pk", no_argument, 0, 0 },
{"kek", no_argument, 0, 0 },
{"db", no_argument, 0, 0 },
@@ -2376,6 +2424,22 @@ main (int argc, char *argv[])
verbosity = 0;
else
command |= HELP;
+ } else if (strcmp (option, "set-fallback-verbosity") == 0) {
+ command |= FB_VERBOSITY;
+ if (strcmp (optarg, "true") == 0)
+ fb_verbosity = 1;
+ else if (strcmp (optarg, "false") == 0)
+ fb_verbosity = 0;
+ else
+ command |= HELP;
+ } else if (strcmp (option, "set-fallback-noreboot") == 0) {
+ command |= FB_NOREBOOT;
+ if (strcmp (optarg, "true") == 0)
+ fb_noreboot = 1;
+ else if (strcmp (optarg, "false") == 0)
+ fb_noreboot = 0;
+ else
+ command |= HELP;
} else if (strcmp (option, "pk") == 0) {
if (db_name != MOK_LIST_RT) {
command |= HELP;
@@ -2652,6 +2716,12 @@ main (int argc, char *argv[])
case VERBOSITY:
ret = set_verbosity (verbosity);
break;
+ case FB_VERBOSITY:
+ ret = set_fallback_verbosity (fb_verbosity);
+ break;
+ case FB_NOREBOOT:
+ ret = set_fallback_noreboot (fb_noreboot);
+ break;
case TIMEOUT:
ret = set_timeout (timeout);
break;
diff --git a/data/mokutil b/data/mokutil
index 800b039..af6b6ff 100755
--- a/data/mokutil
+++ b/data/mokutil
@@ -24,6 +24,14 @@ _mokutil()
COMPREPLY=( $( compgen -W "true false") )
return 0
;;
+ --set-fallback-verbosity)
+ COMPREPLY=( $( compgen -W "true false") )
+ return 0
+ ;;
+ --set-fallback-noreboot)
+ COMPREPLY=( $( compgen -W "true false") )
+ return 0
+ ;;
--generate-hash|-g)
COMPREPLY=( $( compgen -o nospace -P= -W "") )
return 0
diff --git a/man/mokutil.1 b/man/mokutil.1
index 1f82ff1..a3a73e1 100644
--- a/man/mokutil.1
+++ b/man/mokutil.1
@@ -63,6 +63,10 @@ mokutil \- utility to manipulate machine owner keys
.br
\fBmokutil\fR [--set-verbosity (\fItrue\fR | \fIfalse\fR)]
.br
+\fBmokutil\fR [--set-fallback-verbosity (\fItrue\fR | \fIfalse\fR)]
+.br
+\fBmokutil\fR [--set-fallback-noreboot (\fItrue\fR | \fIfalse\fR)]
+.br
\fBmokutil\fR [--pk]
.br
\fBmokutil\fR [--kek]
@@ -156,6 +160,12 @@ this is not the password hash.
\fB--set-verbosity\fR
Set the SHIM_VERBOSE to make shim more or less verbose
.TP
+\fB--set-fallback-verbosity\fR
+Set the FALLBACK_VERBOSE to make fallback more or less verbose
+.TP
+\fB--set-fallback-noreboot\fR
+Set the FB_NO_REBOOT to prevent fallback from automatically rebooting the system
+.TP
\fB--pk\fR
List the keys in the public Platform Key (PK)
.TP

9
mokutil.patches Normal file
View File

@ -0,0 +1,9 @@
Patch0001: 0001-Avoid-taking-pointer-to-packed-struct.patch
Patch0002: 0002-Fix-a-integer-comparison-sign-issue.patch
Patch0003: 0003-mokutil-remove-simple-hash.patch
Patch0004: 0004-man-remove-simple-hash.patch
Patch0005: 0005-mokutil-adjust-the-command-bits.patch
Patch0006: 0006-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch
Patch0007: 0007-mokutil-add-mok-variables-parsing-support.patch
Patch0008: 0008-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch
Patch0009: 0009-mokutil-enable-setting-fallback-verbosity-and-norebo.patch

17
mokutil.spec
View File

@ -1,26 +1,21 @@
Name: mokutil Name: mokutil
Version: 0.4.0 Version: 0.4.0
Release: 8%{?dist} Release: 9%{?dist}
Epoch: 2 Epoch: 2
Summary: Tool to manage UEFI Secure Boot MoK Keys Summary: Tool to manage UEFI Secure Boot MoK Keys
License: GPLv3+ License: GPLv3+
URL: https://github.com/lcp/mokutil URL: https://github.com/lcp/mokutil
ExclusiveArch: %{ix86} x86_64 aarch64 ExclusiveArch: %{ix86} x86_64 aarch64
BuildRequires: make BuildRequires: make
BuildRequires: gcc BuildRequires: gcc
BuildRequires: autoconf automake gnu-efi git openssl-devel openssl BuildRequires: autoconf automake gnu-efi git openssl-devel openssl
BuildRequires: efivar-devel >= 31-1 BuildRequires: efivar-devel >= 31-1
Source0: https://github.com/lcp/mokutil/archive/%{version}.tar.gz Source0: https://github.com/lcp/mokutil/archive/%{version}.tar.gz
Source1: mokutil.patches
Conflicts: shim < 0.8-1%{?dist} Conflicts: shim < 0.8-1%{?dist}
Obsoletes: mokutil < 0.2.0 Obsoletes: mokutil < 0.2.0
Patch0001: 0001-Avoid-taking-pointer-to-packed-struct.patch %include %{SOURCE1}
Patch0002: 0002-Fix-a-integer-comparison-sign-issue.patch
Patch0003: 0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch
Patch0004: 0004-mokutil-add-mok-variables-parsing-support.patch
Patch0005: 0005-mokutil-remove-simple-hash.patch
Patch0006: 0006-man-remove-simple-hash.patch
Patch0007: 0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch
%description %description
mokutil provides a tool to manage keys for Secure Boot through the MoK mokutil provides a tool to manage keys for Secure Boot through the MoK
@ -55,6 +50,10 @@ make PREFIX=%{_prefix} LIBDIR=%{_libdir} DESTDIR=%{buildroot} install
%{_datadir}/bash-completion/completions/mokutil %{_datadir}/bash-completion/completions/mokutil
%changelog %changelog
* Mon Mar 28 2022 Robbie Harwood <rharwood@redhat.com> - 2:0.4.0-9
- Add ability to change fallback verbose mode
- Resolves: #2069296
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2:0.4.0-8 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2:0.4.0-8
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688 Related: rhbz#1991688