4 commits

Author	SHA1	Message	Date
Matthew Garrett	76fb8e4341	Fix race in EFI validation ... The Secure Boot code currently reads the kernel from disk, validates the signature and then reads it from disk again. A sufficiently exciting storage device could modify the kernel between these two events and trigger the execution of an untrusted kernel. Avoid re-reading it in order to ensure this isn't a problem, and in the process speed up boot by not reading the kernel twice.	2016-01-05 14:14:54 -08:00
Matthew Garrett	e5ee3e8fa5	Add verity hash passthrough ... Read the verity hash from the kernel binary and pass it to the running system via the kernel command line	2015-06-23 13:15:53 -07:00
Matthew Garrett	9b669efb38	Fail validation if we can't find shim and Secure Boot is enabled ... If grub is signed with a key that's in the trusted EFI keyring, an attacker can point a boot entry at grub rather than at shim and grub will fail to locate the shim verification protocol. This would then allow booting an arbitrary kernel image. Fail validation if Secure Boot is enabled and we can't find the shim protocol in order to prevent this.	2015-04-22 12:47:49 -07:00
Matthew Garrett	0de7775230	Add support for linuxefi	2014-11-05 20:40:53 -08:00