Skip to content

Commit e4e625f

Browse files
pbatardpbatard
committed
Use either Microsoft or Mosby's UEFI VendorGUID when adding certificates
* Mosby derived the ESL GUID from the certificate fingerprint, which means that each of the Microsoft certificates added to the KEK or DB were referenced under their own unique GUID, which had nothing to do with the originator of the certificate (Microsoft). * Outside of not trying to go with UEFI best practices, this is also problematic with tools like fwupdmgr, that try to resolve the VendorGuid to known vendors when reporting back to the user. * So we now make sure that we don't derive the GUID from the data, but instead use a proper VendorGUID when none is defined, which will be Microsoft's for the DB and KEK certs, and our own for the PK and additional DB cert. * Closes #15.
1 parent ae4472d commit e4e625f

File tree

7 files changed

+36
-25
lines changed

7 files changed

+36
-25
lines changed

‎src/data.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7426,6 +7426,7 @@ EFI_STATUS InitializeList(
74267426
return EFI_INVALID_PARAMETER;
74277427
ZeroMem(List, sizeof(MOSBY_LIST));
74287428
List->Entry[List->Size].Type = KEK;
7429+
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74297430
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_TIMEAUTH;
74307431
List->Entry[List->Size].Path = L"kek_2011_ms.cer";
74317432
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?LinkId=321185";
@@ -7434,6 +7435,7 @@ EFI_STATUS InitializeList(
74347435
List->Entry[List->Size].Buffer.Size = kek_2011_ms_cer_len;
74357436
List->Size++;
74367437
List->Entry[List->Size].Type = KEK;
7438+
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74377439
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_TIMEAUTH;
74387440
List->Entry[List->Size].Path = L"kek_2023_ms.cer";
74397441
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2239775";
@@ -7442,6 +7444,7 @@ EFI_STATUS InitializeList(
74427444
List->Entry[List->Size].Buffer.Size = kek_2023_ms_cer_len;
74437445
List->Size++;
74447446
List->Entry[List->Size].Type = DB;
7447+
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74457448
List->Entry[List->Size].Set = MOSBY_SET1;
74467449
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_TIMEAUTH;
74477450
List->Entry[List->Size].Path = L"db_2011_win_ms.cer";
@@ -7451,6 +7454,7 @@ EFI_STATUS InitializeList(
74517454
List->Entry[List->Size].Buffer.Size = db_2011_win_ms_cer_len;
74527455
List->Size++;
74537456
List->Entry[List->Size].Type = DB;
7457+
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74547458
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_TIMEAUTH;
74557459
List->Entry[List->Size].Path = L"db_2011_3rd_ms.cer";
74567460
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=321194";
@@ -7459,6 +7463,7 @@ EFI_STATUS InitializeList(
74597463
List->Entry[List->Size].Buffer.Size = db_2011_3rd_ms_cer_len;
74607464
List->Size++;
74617465
List->Entry[List->Size].Type = DB;
7466+
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74627467
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_TIMEAUTH;
74637468
List->Entry[List->Size].Path = L"db_2023_win_ms.cer";
74647469
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2239776";
@@ -7467,6 +7472,7 @@ EFI_STATUS InitializeList(
74677472
List->Entry[List->Size].Buffer.Size = db_2023_win_ms_cer_len;
74687473
List->Size++;
74697474
List->Entry[List->Size].Type = DB;
7475+
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74707476
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_TIMEAUTH;
74717477
List->Entry[List->Size].Path = L"db_2023_3rd_ms.cer";
74727478
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2239872";
@@ -7475,6 +7481,7 @@ EFI_STATUS InitializeList(
74757481
List->Entry[List->Size].Buffer.Size = db_2023_3rd_ms_cer_len;
74767482
List->Size++;
74777483
List->Entry[List->Size].Type = DB;
7484+
List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;
74787485
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS_RT_TIMEAUTH;
74797486
List->Entry[List->Size].Path = L"db_2023_opt_ms.cer";
74807487
List->Entry[List->Size].Url = "https://go.microsoft.com/fwlink/?linkid=2284009";

‎src/gen_data.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,8 @@ for file in "${order[@]}"; do
201201
echo " List->Entry[List->Size].Flags = USE_BUFFER | ALLOW_UPDATE;"
202202
elif [[ "$type" == "DBX" ]]; then
203203
echo " List->Entry[List->Size].Flags = ALLOW_UPDATE;"
204+
elif [[ "$type" == "DB" || "$type" == "KEK" ]]; then
205+
echo " List->Entry[List->Size].Flags = USE_MICROSOFT_GUID;"
204206
fi
205207
if [[ "${exclusive_set[${file}]}" != "" ]]; then
206208
echo " List->Entry[List->Size].Set = ${exclusive_set[${file}]};"

‎src/mosby.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ STATIC EFI_GUID gEfiShimLockGuid =
3939
{ 0x605DAB50, 0xE046, 0x4300, { 0xAB, 0xB6, 0x3D, 0xD8, 0x10, 0xDD, 0x8B, 0x23 } };
4040

4141
/* Microsoft GUID - Not yet defined in EDK2 */
42-
STATIC EFI_GUID gEfiMicrosoftGuid =
42+
EFI_GUID gEfiMicrosoftGuid =
4343
{ 0x77FA9ABD, 0x0359, 0x4D32, { 0xBD, 0x60, 0x28, 0xF4, 0xE7, 0x8F, 0x78, 0x4B } };
4444

4545
/* Attributes for the "key" types we support */
@@ -501,7 +501,7 @@ EFI_STATUS EFIAPI efi_main(
501501
Status = GenerateCredentials(DbSubject, &Cred);
502502
if (EFI_ERROR(Status))
503503
goto exit;
504-
Status = CertToAuthVar(Cred.Cert, &List.Entry[i].Variable);
504+
Status = CertToAuthVar(Cred.Cert, &List.Entry[i].Variable, FALSE);
505505
if (EFI_ERROR(Status)) {
506506
FreeCredentials(&Cred);
507507
goto exit;
@@ -534,7 +534,7 @@ EFI_STATUS EFIAPI efi_main(
534534
Status = GenerateCredentials(PkSubject, &Cred);
535535
if (EFI_ERROR(Status))
536536
goto exit;
537-
Status = CertToAuthVar(Cred.Cert, &List.Entry[i].Variable);
537+
Status = CertToAuthVar(Cred.Cert, &List.Entry[i].Variable, FALSE);
538538
if (EFI_ERROR(Status)) {
539539
FreeCredentials(&Cred);
540540
goto exit;

‎src/mosby.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@
8383
#define USE_BUFFER 0x01
8484
#define NO_INSTALL 0x02
8585
#define ALLOW_UPDATE 0x04
86+
#define USE_MICROSOFT_GUID 0x08
8687

8788
/* Exclusive sets */
8889
#define MOSBY_SET1 0x01
@@ -91,6 +92,12 @@
9192
/* Global Image Handle for the current executable */
9293
extern EFI_HANDLE gBaseImageHandle;
9394

95+
/* Microsoft's EFI VendorGUID */
96+
extern EFI_GUID gEfiMicrosoftGuid;
97+
98+
/* Mosby's EFI VendorGUID */
99+
extern EFI_GUID gEfiMosbyGuid;
100+
94101
/* Types of Secure Boot variables this application is able to install */
95102
enum {
96103
PK,

‎src/pki.c‎

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -355,16 +355,15 @@ VOID FreeCredentials(
355355

356356
EFI_STATUS CertToAuthVar(
357357
IN CONST VOID *Cert,
358-
OUT MOSBY_VARIABLE *Variable
358+
OUT MOSBY_VARIABLE *Variable,
359+
IN CONST BOOLEAN UseMicrosoftGUID
359360
)
360361
{
361362
EFI_STATUS Status = EFI_INVALID_PARAMETER;
362363
EFI_SIGNATURE_LIST *Esl = NULL;
363364
EFI_SIGNATURE_DATA *Data = NULL;
364365
INTN Size;
365366
UINT8 *Ptr;
366-
EFI_GUID OwnerGuid;
367-
UINT8 Sha1[SHA_DIGEST_LENGTH] = { 0 };
368367

369368
if (Cert == NULL || Variable == NULL)
370369
return EFI_INVALID_PARAMETER;
@@ -386,15 +385,8 @@ EFI_STATUS CertToAuthVar(
386385
Ptr = &Data->SignatureData[0];
387386
i2d_X509((X509*)Cert, &Ptr);
388387

389-
// Derive the SignatureOwner GUID from the SHA-1 Thumbprint
390-
SHA1(&Data->SignatureData[0], Size, Sha1);
391-
392-
// Reorder, to have the GUID read in the same order as the byte data
393-
OwnerGuid.Data1 = SwapBytes32(((UINT32*)Sha1)[0]);
394-
OwnerGuid.Data2 = SwapBytes16(((UINT16*)Sha1)[2]);
395-
OwnerGuid.Data3 = SwapBytes16(((UINT16*)Sha1)[3]);
396-
CopyMem(&OwnerGuid.Data4, &Sha1[8], 8);
397-
CopyGuid(&Data->SignatureOwner, &OwnerGuid);
388+
// Use either the Microsoft VendorGUID or our own, to identify who provisioned the variable
389+
CopyGuid(&Data->SignatureOwner, UseMicrosoftGUID ? &gEfiMicrosoftGuid : &gEfiMosbyGuid);
398390

399391
Variable->Size = Esl->SignatureListSize;
400392
Variable->Data = (EFI_VARIABLE_AUTHENTICATION_2*)Esl;
@@ -470,15 +462,17 @@ EFI_STATUS PopulateAuthVar(
470462

471463
// Check for a DER encoded X509 certificate
472464
Ptr = Entry->Buffer.Data; // d2i_###() modifies the pointer
473-
Status = CertToAuthVar(d2i_X509(NULL, &Ptr, Entry->Buffer.Size), &Entry->Variable);
465+
Status = CertToAuthVar(d2i_X509(NULL, &Ptr, Entry->Buffer.Size), &Entry->Variable,
466+
Entry->Flags & USE_MICROSOFT_GUID);
474467
if (Status == EFI_SUCCESS)
475468
goto exit;
476469

477470
// Check for a PEM encoded X509 certificate
478471
bio = BIO_new_mem_buf(Entry->Buffer.Data, Entry->Buffer.Size);
479472
if (bio == NULL)
480473
ReportErrorAndExit(L"Failed to create X509 buffer\n");
481-
Status = CertToAuthVar(PEM_read_bio_X509(bio, NULL, NULL, NULL), &Entry->Variable);
474+
Status = CertToAuthVar(PEM_read_bio_X509(bio, NULL, NULL, NULL), &Entry->Variable,
475+
Entry->Flags & USE_MICROSOFT_GUID);
482476
if (Status == EFI_SUCCESS)
483477
goto exit;
484478
BIO_free(bio); // Can't reuse the bio
@@ -490,7 +484,7 @@ EFI_STATUS PopulateAuthVar(
490484
p12 = d2i_PKCS12_bio(bio, NULL);
491485
// Need to read both the key and cert, even if we don't use the key here
492486
if (PKCS12_parse(p12, NULL, (EVP_PKEY**)&Cred.Key, (X509**)&Cred.Cert, NULL)) {
493-
Status = CertToAuthVar(Cred.Cert, &Entry->Variable);
487+
Status = CertToAuthVar(Cred.Cert, &Entry->Variable, Entry->Flags & USE_MICROSOFT_GUID);
494488
PKCS12_free(p12);
495489
FreeCredentials(&Cred);
496490
if (Status == EFI_SUCCESS)

‎src/pki.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* MSSB (More Secure Secure Boot -- "Mosby") PKI/OpenSSL functions
3-
* Copyright 2024 Pete Batard <pete@akeo.ie>
3+
* Copyright 2024-2025 Pete Batard <pete@akeo.ie>
44
*
55
* This program is free software: you can redistribute it and/or modify
66
* it under the terms of the GNU General Public License as published by
@@ -46,7 +46,8 @@ VOID FreeCredentials(
4646

4747
EFI_STATUS CertToAuthVar(
4848
IN CONST VOID *Cert,
49-
OUT MOSBY_VARIABLE *Variable
49+
OUT MOSBY_VARIABLE *Variable,
50+
IN CONST BOOLEAN UseMicrosoftGUID
5051
);
5152

5253
EFI_STATUS PopulateAuthVar(

‎src/variables.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
#define MOSBY_LAST_INSTALL_TIME L"LastInstallTime"
2525

2626
/* GUID we use to store variables */
27-
STATIC EFI_GUID gMosbyVariableGuid =
27+
EFI_GUID gEfiMosbyGuid =
2828
{ 0x26A35749, 0x477E, 0x41A4, { 0xA9, 0x0A, 0x19, 0xC3, 0xAF, 0xEA, 0x85, 0x40 } };
2929

3030
/* Various messages we display to the user as they attempt to enter Setup Mode */
@@ -170,9 +170,9 @@ EFI_STATUS CheckSetupMode(VOID)
170170
// Check the amount of times the user got into UEFI Setup to try to enable Setup
171171
// Mode, so that we can provide more helpful messages.
172172
Size = sizeof(SetupModeAttempts);
173-
gRT->GetVariable(MOSBY_SETUP_MODE_ATTEMPTS, &gMosbyVariableGuid, NULL, &Size, &SetupModeAttempts);
173+
gRT->GetVariable(MOSBY_SETUP_MODE_ATTEMPTS, &gEfiMosbyGuid, NULL, &Size, &SetupModeAttempts);
174174
// Now that we have (possibly) read it, delete the variable
175-
gRT->SetVariable(MOSBY_SETUP_MODE_ATTEMPTS, &gMosbyVariableGuid, 0, 0, NULL);
175+
gRT->SetVariable(MOSBY_SETUP_MODE_ATTEMPTS, &gEfiMosbyGuid, 0, 0, NULL);
176176

177177
// Get the Secure Boot, Setup Mode and Audit Mode status
178178
Size = sizeof(SecureBoot);
@@ -226,7 +226,7 @@ EFI_STATUS CheckSetupMode(VOID)
226226
SetOsIndication(EFI_OS_INDICATIONS_BOOT_TO_FW_UI) == EFI_SUCCESS) {
227227
// Log one more attempt by the user to try to enable Setup mode
228228
SetupModeAttempts++;
229-
gRT->SetVariable(MOSBY_SETUP_MODE_ATTEMPTS, &gMosbyVariableGuid,
229+
gRT->SetVariable(MOSBY_SETUP_MODE_ATTEMPTS, &gEfiMosbyGuid,
230230
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
231231
sizeof(SetupModeAttempts), &SetupModeAttempts);
232232
}
@@ -252,7 +252,7 @@ BOOLEAN ExitNotice(
252252

253253
gRT->GetTime(&Time, NULL);
254254
// Store the last installation time, so we can alert the user if they re-run Mosby
255-
gRT->SetVariable(MOSBY_LAST_INSTALL_TIME, &gMosbyVariableGuid,
255+
gRT->SetVariable(MOSBY_LAST_INSTALL_TIME, &gEfiMosbyGuid,
256256
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
257257
sizeof(Time), &Time);
258258
Reboot = (ConsoleYesNo(KeysGenerated ? ExitMessage1 : ExitMessage2) == 0);

0 commit comments

Comments
 (0)