vbatts/sbsigntools
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sbkeysync: Don't ignore errors from insert_new_keys()

Browse source 
If insert_new_keys() fails, say due to a full variable store, we currently
still exit(0). This can make it difficult to know something is wrong.
For example, Debian and Ubuntu implement a secureboot-db systemd service
to update the DB and DBX, which calls:

 ExecStart=/usr/bin/sbkeysync --no-default-keystores --keystore /usr/share/secureboot/updates --verbose

But although this seemed to succeed on my system, looking at the logs shows
a different story:

Inserting key update /usr/share/secureboot/updates/dbx/dbxupdate_x64.bin into dbx
Error writing key update: Invalid argument
Error syncing keystore file /usr/share/secureboot/updates/dbx/dbxupdate_x64.bin

Signed-off-by: dann frazier <dann.frazier@canonical.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
This commit is contained in:
dann frazier 2020-08-12 15:27:08 -06:00 committed by James Bottomley
parent d52f7bbb73
commit f12484869c
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/sbkeysync.c
View file

@ -889,10 +889,12 @@ int main(int argc, char **argv)
{ {
bool use_default_keystore_dirs; bool use_default_keystore_dirs;
struct sync_context *ctx; struct sync_context *ctx;
int rc;
use_default_keystore_dirs = true; use_default_keystore_dirs = true;
ctx = talloc_zero(NULL, struct sync_context); ctx = talloc_zero(NULL, struct sync_context);
list_head_init(&ctx->new_keys); list_head_init(&ctx->new_keys);
rc = EXIT_SUCCESS;
for (;;) { for (;;) {
int idx, c; int idx, c;
@ -985,10 +987,10 @@ int main(int argc, char **argv)
if (ctx->verbose) if (ctx->verbose)
print_new_keys(ctx); print_new_keys(ctx);
if (!ctx->dry_run) if (!ctx->dry_run && insert_new_keys(ctx))
insert_new_keys(ctx); rc = EXIT_FAILURE;
talloc_free(ctx); talloc_free(ctx);
return EXIT_SUCCESS; return rc;
} }