Skip to content

Commit 0457d57

Browse files
pbatardpbatard
committed
Default to append for DBX, DB and KEK variables
* Because of the whole signed authenticate variable process, and the moronic decision of the UEFI Forum to treat appending both as a special case as well as make the attribute part of the signature payload, we have to pay very close attention to what we use for our attributes else, on pedantic firmwares like HP ProDesk 600 ones, installing the official signed DBXs from Microsoft fails, because they are always declared as append (even if we are obviously not appending when we write to the DBX the first time). * To avoid introduce very complex logic to detect and re-sign variables, and since most firmwares that follow the EDK2 implementation *should* treat append on a non-existing variable as "create and report success", we now always set the DBX, DB and KEK with the append attribute. * This addresses part of #17. * Also make sure some more variables are properly zeroed and fix some parameter names.
1 parent 3fb07ca commit 0457d57

File tree

5 files changed

+47
-38
lines changed

5 files changed

+47
-38
lines changed

‎src/data.c‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/* Autogenerated file - DO NOT EDIT */
22
/*
33
* MSSB (More Secure Secure Boot -- "Mosby") embedded data
4-
* Copyright © 2024-2025 Pete Batard <pete@akeo.ie>
4+
* Copyright © 2024-2026 Pete Batard <pete@akeo.ie>
55
*
66
* This program is free software: you can redistribute it and/or modify
77
* it under the terms of the GNU General Public License as published by
@@ -7427,7 +7427,7 @@ EFI_STATUS InitializeList(
74277427
ZeroMem(List, sizeof(MOSBY_LIST));
74287428
List->Entry[List->Size].Type = KEK;
74297429
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
7430-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7430+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74317431
List->Entry[List->Size].Path = L"kek_2011_ms.cer";
74327432
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?LinkId=321185";
74337433
List->Entry[List->Size].Description = "Microsoft Corporation KEK CA 2011";
@@ -7436,7 +7436,7 @@ EFI_STATUS InitializeList(
74367436
List->Size++;
74377437
List->Entry[List->Size].Type = KEK;
74387438
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
7439-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7439+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74407440
List->Entry[List->Size].Path = L"kek_2023_ms.cer";
74417441
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2239775";
74427442
List->Entry[List->Size].Description = "Microsoft Corporation KEK 2K CA 2023";
@@ -7446,7 +7446,7 @@ EFI_STATUS InitializeList(
74467446
List->Entry[List->Size].Type = DB;
74477447
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74487448
List->Entry[List->Size].Set = MOSBY_SET1;
7449-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7449+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74507450
List->Entry[List->Size].Path = L"db_2011_win_ms.cer";
74517451
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=321192";
74527452
List->Entry[List->Size].Description = "Microsoft Windows Production PCA 2011";
@@ -7455,7 +7455,7 @@ EFI_STATUS InitializeList(
74557455
List->Size++;
74567456
List->Entry[List->Size].Type = DB;
74577457
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
7458-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7458+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74597459
List->Entry[List->Size].Path = L"db_2011_3rd_ms.cer";
74607460
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=321194";
74617461
List->Entry[List->Size].Description = "Microsoft Corporation UEFI CA 2011";
@@ -7464,7 +7464,7 @@ EFI_STATUS InitializeList(
74647464
List->Size++;
74657465
List->Entry[List->Size].Type = DB;
74667466
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
7467-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7467+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74687468
List->Entry[List->Size].Path = L"db_2023_win_ms.cer";
74697469
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2239776";
74707470
List->Entry[List->Size].Description = "Windows UEFI CA 2023";
@@ -7473,7 +7473,7 @@ EFI_STATUS InitializeList(
74737473
List->Size++;
74747474
List->Entry[List->Size].Type = DB;
74757475
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
7476-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7476+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74777477
List->Entry[List->Size].Path = L"db_2023_3rd_ms.cer";
74787478
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2239872";
74797479
List->Entry[List->Size].Description = "Microsoft UEFI CA 2023";
@@ -7482,7 +7482,7 @@ EFI_STATUS InitializeList(
74827482
List->Size++;
74837483
List->Entry[List->Size].Type = DB;
74847484
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
7485-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7485+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74867486
List->Entry[List->Size].Path = L"db_2023_opt_ms.cer";
74877487
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2284009";
74887488
List->Entry[List->Size].Description = "Microsoft Option ROM UEFI CA 2023";
@@ -7492,7 +7492,7 @@ EFI_STATUS InitializeList(
74927492
#if defined(_M_X64) || defined(__x86_64__)
74937493
List->Entry[List->Size].Type = DBX;
74947494
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7495-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7495+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
74967496
List->Entry[List->Size].Path = L"dbx_x64.bin";
74977497
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/DBX/amd64/DBXUpdate.bin";
74987498
List->Entry[List->Size].Description = "DBX for x86 (64 bit) [2025.10.16]";
@@ -7503,7 +7503,7 @@ EFI_STATUS InitializeList(
75037503
#if defined(_M_IX86) || defined(__i386__)
75047504
List->Entry[List->Size].Type = DBX;
75057505
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7506-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7506+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75077507
List->Entry[List->Size].Path = L"dbx_ia32.bin";
75087508
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/DBX/x86/DBXUpdate.bin";
75097509
List->Entry[List->Size].Description = "DBX for x86 (32 bit) [2025.10.16]";
@@ -7514,7 +7514,7 @@ EFI_STATUS InitializeList(
75147514
#if defined (_M_ARM64) || defined(__aarch64__)
75157515
List->Entry[List->Size].Type = DBX;
75167516
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7517-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7517+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75187518
List->Entry[List->Size].Path = L"dbx_aa64.bin";
75197519
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/DBX/arm64/DBXUpdate.bin";
75207520
List->Entry[List->Size].Description = "DBX for ARM (64 bit) [2025.02.24]";
@@ -7525,7 +7525,7 @@ EFI_STATUS InitializeList(
75257525
#if defined (_M_ARM) || defined(__arm__)
75267526
List->Entry[List->Size].Type = DBX;
75277527
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7528-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7528+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75297529
List->Entry[List->Size].Path = L"dbx_arm.bin";
75307530
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/DBX/arm/DBXUpdate.bin";
75317531
List->Entry[List->Size].Description = "DBX for ARM (32 bit) [2025.02.24]";
@@ -7537,7 +7537,7 @@ EFI_STATUS InitializeList(
75377537
List->Entry[List->Size].Type = DBX;
75387538
List->Entry[List->Size].Flags = ALLOW_UPDATE;
75397539
List->Entry[List->Size].Set = MOSBY_SET2;
7540-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7540+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75417541
List->Entry[List->Size].Path = L"dbx_update_2024_x64.bin";
75427542
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/amd64/DBXUpdate2024.bin";
75437543
List->Entry[List->Size].Description = "Revocation of 'Microsoft Windows Production PCA 2011'";
@@ -7548,7 +7548,7 @@ EFI_STATUS InitializeList(
75487548
#if defined(_M_X64) || defined(__x86_64__)
75497549
List->Entry[List->Size].Type = DBX;
75507550
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7551-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7551+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75527552
List->Entry[List->Size].Path = L"dbx_update_svn_x64.bin";
75537553
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/amd64/DBXUpdateSVN.bin";
75547554
List->Entry[List->Size].Description = "Windows Bootmgr SVN 7.0 DBX update [2025-06-06]";
@@ -7560,7 +7560,7 @@ EFI_STATUS InitializeList(
75607560
List->Entry[List->Size].Type = DBX;
75617561
List->Entry[List->Size].Flags = ALLOW_UPDATE;
75627562
List->Entry[List->Size].Set = MOSBY_SET2;
7563-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7563+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75647564
List->Entry[List->Size].Path = L"dbx_update_2024_ia32.bin";
75657565
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/x86/DBXUpdate2024.bin";
75667566
List->Entry[List->Size].Description = "Revocation of 'Microsoft Windows Production PCA 2011'";
@@ -7571,7 +7571,7 @@ EFI_STATUS InitializeList(
75717571
#if defined(_M_IX86) || defined(__i386__)
75727572
List->Entry[List->Size].Type = DBX;
75737573
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7574-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7574+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75757575
List->Entry[List->Size].Path = L"dbx_update_svn_ia32.bin";
75767576
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/x86/DBXUpdateSVN.bin";
75777577
List->Entry[List->Size].Description = "Windows Bootmgr SVN 7.0 DBX update [2025-06-06]";
@@ -7583,7 +7583,7 @@ EFI_STATUS InitializeList(
75837583
List->Entry[List->Size].Type = DBX;
75847584
List->Entry[List->Size].Flags = ALLOW_UPDATE;
75857585
List->Entry[List->Size].Set = MOSBY_SET2;
7586-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7586+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75877587
List->Entry[List->Size].Path = L"dbx_update_2024_aa64.bin";
75887588
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/arm64/DBXUpdate2024.bin";
75897589
List->Entry[List->Size].Description = "Revocation of 'Microsoft Windows Production PCA 2011'";
@@ -7594,7 +7594,7 @@ EFI_STATUS InitializeList(
75947594
#if defined (_M_ARM64) || defined(__aarch64__)
75957595
List->Entry[List->Size].Type = DBX;
75967596
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7597-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7597+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
75987598
List->Entry[List->Size].Path = L"dbx_update_svn_aa64.bin";
75997599
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/arm64/DBXUpdateSVN.bin";
76007600
List->Entry[List->Size].Description = "Windows Bootmgr SVN 7.0 DBX update [2025-06-06]";
@@ -7606,7 +7606,7 @@ EFI_STATUS InitializeList(
76067606
List->Entry[List->Size].Type = DBX;
76077607
List->Entry[List->Size].Flags = ALLOW_UPDATE;
76087608
List->Entry[List->Size].Set = MOSBY_SET2;
7609-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7609+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
76107610
List->Entry[List->Size].Path = L"dbx_update_2024_arm.bin";
76117611
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/arm/DBXUpdate2024.bin";
76127612
List->Entry[List->Size].Description = "Revocation of 'Microsoft Windows Production PCA 2011'";
@@ -7617,7 +7617,7 @@ EFI_STATUS InitializeList(
76177617
#if defined (_M_ARM) || defined(__arm__)
76187618
List->Entry[List->Size].Type = DBX;
76197619
List->Entry[List->Size].Flags = ALLOW_UPDATE;
7620-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;
7620+
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
76217621
List->Entry[List->Size].Path = L"dbx_update_svn_arm.bin";
76227622
List->Entry[List->Size].Url = "https://github.com/microsoft/secureboot_objects/raw/main/PostSignedObjects/Optional/DBX/arm/DBXUpdateSVN.bin";
76237623
List->Entry[List->Size].Description = "Windows Bootmgr SVN 7.0 DBX update [2025-06-06]";

‎src/gen_data.sh‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ cat << EOF
108108
/* Autogenerated file - DO NOT EDIT */
109109
/*
110110
* MSSB (More Secure Secure Boot -- "Mosby") embedded data
111-
* Copyright © 2024-2025 Pete Batard <pete@akeo.ie>
111+
* Copyright © 2024-2026 Pete Batard <pete@akeo.ie>
112112
*
113113
* This program is free software: you can redistribute it and/or modify
114114
* it under the terms of the GNU General Public License as published by
@@ -210,7 +210,16 @@ for file in "${order[@]}"; do
210210
if [[ "$type" == "SBAT" || "$type" == "MOK" || "$type" == "SSPU" || "$type" == "SSPV" ]]; then
211211
echo " List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS;"
212212
else
213-
echo " List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT;"
213+
# The whole "append" business of the UEFI spec's SetVariable() is bullshit.
214+
# The specs do not define what should happen is someone tries to append to a non-existing
215+
# variable, so, technically, a pedantic UEFI firmware may refuse all the Microsoft-signed
216+
# DBX updates, because they are all set for append whereas the first one we install should
217+
# NOT have it set. And of course, in their great wisdom, the UEFI Forum made the append
218+
# attribute part of the payload that is hashed for signature (meaning you can't remove the
219+
# attribute without BREAKING the signature, which pedantic firmwares very much do check!).
220+
# Long story short, because EDK2 treats append on non-existing variable as "create variable
221+
# and return SUCCESS", we just set append everywhere and hope for the best...
222+
echo " List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;"
214223
fi
215224
echo " List->Entry[List->Size].Path = L\"${file}\";"
216225
echo " List->Entry[List->Size].Url = \"${url}\";"

‎src/mosby.c‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* MSSB (More Secure Secure Boot -- "Mosby")
3-
* Copyright © 2024-2025 Pete Batard <pete@akeo.ie>
3+
* Copyright © 2024-2026 Pete Batard <pete@akeo.ie>
44
*
55
* This program is free software: you can redistribute it and/or modify
66
* it under the terms of the GNU General Public License as published by
@@ -221,16 +221,16 @@ EFI_STATUS EFIAPI efi_main(
221221
)
222222
{
223223
BOOLEAN TestMode = FALSE, GenDBCred = FALSE, UpdateMode = FALSE;
224-
BOOLEAN Append = FALSE, Reboot = FALSE, LogToFile = TRUE;
224+
BOOLEAN Reboot = FALSE, LogToFile = TRUE;
225225
EFI_STATUS Status;
226-
EFI_TIME Time;
226+
EFI_TIME Time = { 0 };
227227
UINT8 Set = MOSBY_SET1;
228228
UINTN i, Size;
229229
UINT16* SystemSSPV = NULL;
230-
UINT32 SystemSBatVer, InstallSBatVer;
230+
UINT32 SystemSBatVer = 0, InstallSBatVer = 0;
231231
INTN Argc, Type, Sel, LastEntry;
232-
MOSBY_CRED Cred;
233-
CHAR8 DbSubject[80], PkSubject[80], *SBat, *SBatLine;
232+
MOSBY_CRED Cred = { 0 };
233+
CHAR8 DbSubject[80], PkSubject[80], *SBat = NULL, *SBatLine = NULL;
234234
CHAR16 **Argv = NULL, **ArgvCopy, MosbyKeyPath[MAX_PATH];
235235
MOSBY_LIST List;
236236

@@ -506,7 +506,7 @@ EFI_STATUS EFIAPI efi_main(
506506
FreeCredentials(&Cred);
507507
goto exit;
508508
}
509-
List.Entry[i].Attrs = UEFI_VAR_NV_BS_RT_AT;
509+
List.Entry[i].Attrs = UEFI_VAR_NV_BS_RT_AT_AP;
510510
Status = SaveCredentials(WIDEN(MOSBY_CRED_NAME), &Cred);
511511
if (EFI_ERROR(Status))
512512
goto exit;
@@ -619,7 +619,6 @@ EFI_STATUS EFIAPI efi_main(
619619
/* Install the variables, making sure that we finish with the PK. */
620620
Status = EFI_NOT_FOUND;
621621
for (Type = MAX_TYPES - 1; Type >= 0; Type--) {
622-
Append = (UpdateMode && Type == DBX);
623622
for (i = 0; i < List.Size; i++) {
624623
if (List.Entry[i].Type != Type || List.Entry[i].Flags & NO_INSTALL)
625624
continue;
@@ -631,13 +630,11 @@ EFI_STATUS EFIAPI efi_main(
631630
RecallPrint(L"Installing %a '%a'\n", KeyInfo[Type].DisplayName, List.Entry[i].Description);
632631
else
633632
RecallPrint(L"Installing %a From '%s'\n", KeyInfo[Type].DisplayName, List.Entry[i].Path);
634-
Status = gRT->SetVariable(KeyInfo[Type].VariableName, KeyInfo[Type].VariableGuid,
635-
List.Entry[i].Attrs | (Append ? EFI_VARIABLE_APPEND_WRITE : 0),
633+
Status = gRT->SetVariable(KeyInfo[Type].VariableName, KeyInfo[Type].VariableGuid, List.Entry[i].Attrs,
636634
(List.Entry[i].Flags & USE_BUFFER) ? List.Entry[i].Buffer.Size : List.Entry[i].Variable.Size,
637635
(List.Entry[i].Flags & USE_BUFFER) ? (VOID*)List.Entry[i].Buffer.Data : (VOID*)List.Entry[i].Variable.Data);
638636
if (EFI_ERROR(Status))
639637
ReportErrorAndExit(L"Failed to set Secure Boot variable: %r\n", Status);
640-
Append = TRUE;
641638
}
642639
}
643640

‎src/mosby.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* MSSB (More Secure Secure Boot -- "Mosby")
3-
* Copyright © 2024-2025 Pete Batard <pete@akeo.ie>
3+
* Copyright © 2024-2026 Pete Batard <pete@akeo.ie>
44
*
55
* This program is free software: you can redistribute it and/or modify
66
* it under the terms of the GNU General Public License as published by
@@ -76,8 +76,10 @@
7676

7777
/* Variable attributes */
7878
#define UEFI_VAR_NV_BS (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS)
79+
#define UEFI_VAR_NV_BS_AP (UEFI_VAR_NV_BS | EFI_VARIABLE_APPEND_WRITE)
7980
#define UEFI_VAR_NV_BS_RT (UEFI_VAR_NV_BS | EFI_VARIABLE_RUNTIME_ACCESS)
8081
#define UEFI_VAR_NV_BS_RT_AT (UEFI_VAR_NV_BS_RT | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)
82+
#define UEFI_VAR_NV_BS_RT_AT_AP (UEFI_VAR_NV_BS_RT_AT | EFI_VARIABLE_APPEND_WRITE)
8183

8284
/* Flags */
8385
#define USE_BUFFER 0x01

‎src/pki.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* MSSB (More Secure Secure Boot -- "Mosby") PKI/OpenSSL functions
3-
* Copyright © 2024-2025 Pete Batard <pete@akeo.ie>
3+
* Copyright © 2024-2026 Pete Batard <pete@akeo.ie>
44
*
55
* This program is free software: you can redistribute it and/or modify
66
* it under the terms of the GNU General Public License as published by
@@ -425,7 +425,8 @@ EFI_STATUS PopulateAuthVar(
425425
ReportErrorAndExit(L"'%s' is too small to be a valid certificate or signature list\n", Entry->Path);
426426

427427
// Set default attributes for authenticated variable
428-
Entry->Attrs = Entry->Type == MOK ? UEFI_VAR_NV_BS : UEFI_VAR_NV_BS_RT_AT;
428+
if (Entry->Attrs == 0)
429+
Entry->Attrs = (Entry->Type == MOK) ? UEFI_VAR_NV_BS_AP : UEFI_VAR_NV_BS_RT_AT_AP;
429430

430431
// Check for signed ESL (PKCS#7 only)
431432
SignedEsl = (EFI_VARIABLE_AUTHENTICATION_2*)Entry->Buffer.Data;
@@ -523,7 +524,7 @@ EFI_STATUS PopulateAuthVar(
523524

524525
EFI_STATUS SignToAuthVar(
525526
IN CONST CHAR16 *VariableName,
526-
IN CONST EFI_GUID *VendorGuid,
527+
IN CONST EFI_GUID *VariableGuid,
527528
IN CONST UINT32 Attributes,
528529
IN OUT MOSBY_VARIABLE *Variable,
529530
IN CONST MOSBY_CRED *Credentials
@@ -536,7 +537,7 @@ EFI_STATUS SignToAuthVar(
536537
UINTN Size;
537538
} SignableElement[5] = {
538539
{ (UINT8*)VariableName, StrLen(VariableName) * sizeof(CHAR16) },
539-
{ (UINT8*)VendorGuid, sizeof(EFI_GUID) },
540+
{ (UINT8*)VariableGuid, sizeof(EFI_GUID) },
540541
{ (UINT8*)&Attributes, sizeof(Attributes) },
541542
{ (UINT8*)&Variable->Data->TimeStamp, sizeof(EFI_TIME) },
542543
{ &(((UINT8*)Variable->Data)[OFFSET_OF_AUTHINFO2_CERT_DATA]), Variable->Size - OFFSET_OF_AUTHINFO2_CERT_DATA }

0 commit comments

Comments
 (0)