vaseboot

Author	SHA1	Message	Date
Matthew Garrett	57b4382f0c	Fix race in EFI validation The Secure Boot code currently reads the kernel from disk, validates the signature and then reads it from disk again. A sufficiently exciting storage device could modify the kernel between these two events and trigger the execution of an untrusted kernel. Avoid re-reading it in order to ensure this isn't a problem, and in the process speed up boot by not reading the kernel twice.	2018-03-29 22:18:53 -04:00
Matthew Garrett	03b547c21e	Add verity hash passthrough Read the verity hash from the kernel binary and pass it to the running system via the kernel command line	2018-03-29 22:18:53 -04:00
Matthew Garrett	f4d00290ed	Fail validation if we can't find shim and Secure Boot is enabled If grub is signed with a key that's in the trusted EFI keyring, an attacker can point a boot entry at grub rather than at shim and grub will fail to locate the shim verification protocol. This would then allow booting an arbitrary kernel image. Fail validation if Secure Boot is enabled and we can't find the shim protocol in order to prevent this.	2018-03-29 22:18:53 -04:00
Matthew Garrett	23589dc78b	Add support for linuxefi	2018-03-29 22:18:52 -04:00