Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revocation management #588

Closed
wants to merge 5 commits into from
Closed

Revocation management #588

wants to merge 5 commits into from

Commits on Jul 18, 2023

  1. Allow SbatLevel data from external binary 

    Ingest SBAT Levels from revocations binary thereby allowing level
requirements to be updated independently from shipping a new shim.
Do not automatically apply any revocations from a stock shim at
this point.

Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
    @jsetje
    jsetje committed Jul 18, 2023
    Configuration menu
    Copy the full SHA
    301e6a4 View commit details
    Browse the repository at this point in the history

  2. Always clear SbatLevel when Secure Boot is disabled 

    Unless an explict sbat policy is specified, always delete SbatLevel
when secure boot is disabled.

Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
    @jsetje
    jsetje committed Jul 18, 2023
    Configuration menu
    Copy the full SHA
    1bfc37e View commit details
    Browse the repository at this point in the history

  3. BS Varaibles for bootmgr revocations 

    This adds support for applying SkuSiPolicy UEFI BS variables. These
varaibles are needed for non-dbx based Windows revocations and are
described here:

https://support.microsoft.com/en-us/topic/kb5027455-guidance-for-blocking-vulnerable-windows-boot-managers-522bb851-0a61-44ad-aa94-ad11119c5e91

Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
    @jsetje
    jsetje committed Jul 18, 2023
    Configuration menu
    Copy the full SHA
    31b9920 View commit details
    Browse the repository at this point in the history

  4. shim should not self revoke 

    Before applying an updated SbatLevel shim should re-run
introspection and never apply a revocation level that would
prevent the currently running shim from booting. The proper
way forward is to update shim first.

Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
    @jsetje
    jsetje committed Jul 18, 2023
    Configuration menu
    Copy the full SHA
    93d9ccd View commit details
    Browse the repository at this point in the history

  5. Print message when refusing to apply SbatLevel 

    If shim detects a self revocation in a new proposed SbatLevel
and refuses to apply this new set of revocations a message should
be printed even in non-verbose modes.

Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
    @jsetje
    jsetje committed Jul 18, 2023
    Configuration menu
    Copy the full SHA
    450155e View commit details
    Browse the repository at this point in the history