forked from rpms/shim-unsigned-aarch64
50 lines
1.5 KiB
Diff
50 lines
1.5 KiB
Diff
|
From 4b27ae034ba9885960e72f77b3f687a9b7fea824 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Gary Lin <glin@suse.com>
|
||
|
|
Date: Wed, 21 Nov 2018 12:47:43 +0800
|
||
|
|
Subject: [PATCH 2/3] mok: fix the mirroring of RT variables
|
||
|
|
|
||
|
|
When there is no key in MokList, import_mok_state() just skipped MokList
|
||
|
|
even though it should always mirror the vendor cert. Besides, the faulty
|
||
|
|
check of 'present' and 'addend' invalidates the mirroring of MokListXRT,
|
||
|
|
MokSBStateRT, and MokIgnoreDB.
|
||
|
|
|
||
|
|
https://github.com/rhboot/shim/issues/154
|
||
|
|
|
||
|
|
Signed-off-by: Gary Lin <glin@suse.com>
|
||
|
|
---
|
||
|
|
mok.c | 11 ++++-------
|
||
|
|
1 file changed, 4 insertions(+), 7 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/mok.c b/mok.c
|
||
|
|
index 00dd1ad3034..41925abbb49 100644
|
||
|
|
--- a/mok.c
|
||
|
|
+++ b/mok.c
|
||
|
|
@@ -231,12 +231,8 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
|
||
|
|
&v->data, &v->data_size,
|
||
|
|
*v->guid, &attrs);
|
||
|
|
if (efi_status == EFI_NOT_FOUND) {
|
||
|
|
- if (v->rtname && addend) {
|
||
|
|
- efi_status = mirror_one_mok_variable(v);
|
||
|
|
- if (EFI_ERROR(efi_status) &&
|
||
|
|
- ret != EFI_SECURITY_VIOLATION)
|
||
|
|
- ret = efi_status;
|
||
|
|
- }
|
||
|
|
+ if (addend)
|
||
|
|
+ goto mirror_addend;
|
||
|
|
/*
|
||
|
|
* after possibly adding, we can continue, no
|
||
|
|
* further checks to be done.
|
||
|
|
@@ -316,7 +312,8 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (v->rtname && present && addend) {
|
||
|
|
+mirror_addend:
|
||
|
|
+ if (v->rtname && (present || addend)) {
|
||
|
|
if (v->flags & MOK_MIRROR_DELETE_FIRST)
|
||
|
|
LibDeleteVariable(v->rtname, v->guid);
|
||
|
|
|
||
|
|
--
|
||
|
|
2.20.1
|
||
|
|
|