diff options
author | AKASHI Takahiro <takahiro.akashi@linaro.org> | 2020-08-14 08:39:23 +0300 |
---|---|---|
committer | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2020-08-14 13:28:25 +0300 |
commit | 52956e535e65c852b1f95d2ca5044cb7c4fc6bbe (patch) | |
tree | 2e7e3317e17608b7c7c4c003fa15477b52d5b7b4 /include | |
parent | f68a6d583578799ec2011476ebd1e10590c6eb3c (diff) | |
download | u-boot-52956e535e65c852b1f95d2ca5044cb7c4fc6bbe.tar.xz |
efi_loader: signature: correct a behavior against multiple signatures
Under the current implementation, all the signatures, if any, in
a signed image must be verified before loading it.
Meanwhile, UEFI specification v2.8b section 32.5.3.3 says,
Multiple signatures are allowed to exist in the binary’s certificate
table (as per PE/COFF Section “Attribute Certificate Table”). Only
one hash or signature is required to be present in db in order to pass
validation, so long as neither the SHA-256 hash of the binary nor any
present signature is reflected in dbx.
This patch makes the semantics of signature verification compliant with
the specification mentioned above.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Diffstat (limited to 'include')
-rw-r--r-- | include/efi_loader.h | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/include/efi_loader.h b/include/efi_loader.h index b941b5e994..50a17a33ca 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -773,13 +773,16 @@ struct pkcs7_message; bool efi_signature_lookup_digest(struct efi_image_regions *regs, struct efi_signature_store *db); -bool efi_signature_verify_one(struct efi_image_regions *regs, - struct pkcs7_message *msg, - struct efi_signature_store *db); bool efi_signature_verify(struct efi_image_regions *regs, struct pkcs7_message *msg, struct efi_signature_store *db, struct efi_signature_store *dbx); +static inline bool efi_signature_verify_one(struct efi_image_regions *regs, + struct pkcs7_message *msg, + struct efi_signature_store *db) +{ + return efi_signature_verify(regs, msg, db, NULL); +} bool efi_signature_check_signers(struct pkcs7_message *msg, struct efi_signature_store *dbx); |