Skip to content

Commit c2d1ee7

Browse files
sergio-correiaJuergenReppSIT
authored andcommitted
tpm2_eventlog: parse vendor_db as EFI_SIGNATURE_DATA
Since 9a47a1e, EV_EFI_VARIABLE_AUTHORITY variables should be parsed explictly, so here we add support for parsing vendor_db -- which contains the shim's built-in vendor allowlist [1] -- as EFI_SIGNATURE_DATA, in a similar way that we do with db and Shim. Signed-off-by: Sergio Correia <scorreia@redhat.com> [1] https://github.com/rhboot/shim/blob/afc4955/README.tpm#L16
1 parent 7b29cac commit c2d1ee7

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

lib/tpm2_eventlog_yaml.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@
4343
#define NAME_SHIM "Shim"
4444
#define NAME_SHIM_LEN 4
4545
#define NAME_SECUREBOOT_LEN 10
46+
#define NAME_VENDOR_DB "vendor_db"
47+
#define NAME_VENDOR_DB_LEN 9
4648

4749
static void guid_unparse_lower(EFI_GUID guid, char guid_buf[37]) {
4850

@@ -646,8 +648,9 @@ static bool yaml_uefi_var(UEFI_VARIABLE_DATA *data, size_t size, UINT32 type,
646648
}
647649
return true;
648650
} else if ((strlen(ret) == NAME_DB_LEN && strncmp(ret, NAME_DB, NAME_DB_LEN) == 0) ||
649-
(strlen(ret) == NAME_SHIM_LEN && strncmp(ret, NAME_SHIM, NAME_SHIM_LEN) == 0)) {
650-
/* db and Shim will be parsed as EFI_SIGNATURE_DATA */
651+
(strlen(ret) == NAME_SHIM_LEN && strncmp(ret, NAME_SHIM, NAME_SHIM_LEN) == 0) ||
652+
(strlen(ret) == NAME_VENDOR_DB_LEN && strncmp(ret, NAME_VENDOR_DB, NAME_VENDOR_DB_LEN) == 0)) {
653+
/* db, Shim and vendor_db will be parsed as EFI_SIGNATURE_DATA */
651654
free(ret);
652655
tpm2_tool_output(" VariableData:\n");
653656
EFI_SIGNATURE_DATA *s= (EFI_SIGNATURE_DATA *)&data->UnicodeName[

0 commit comments

Comments
 (0)