Julian Andres Klode 6fe755c5c0 kern/efi/sb: Reject non-kernel files in the shim_lock verifier ...

We must not allow other verifiers to pass things like the GRUB modules.
Instead of maintaining a blocklist, maintain an allowlist of things
that we do not care about.

This allowlist really should be made reusable, and shared by the
lockdown verifier, but this is the minimal patch addressing
security concerns where the TPM verifier was able to mark modules
as verified (or the OpenPGP verifier for that matter), when it
should not do so on shim-powered secure boot systems.

Fixes: CVE-2022-28735

Signed-off-by: Julian Andres Klode <julian.klode@canonical.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2022-06-07 16:39:31 +02:00

..

grub

kern/efi/sb: Reject non-kernel files in the shim_lock verifier

2022-06-07 16:39:31 +02:00

xen

include: Remove trailing whitespaces

2022-03-14 16:01:26 +01:00

multiboot2.h

include: Remove trailing whitespaces

2022-03-14 16:01:26 +01:00

multiboot.h

Add gcc_struct to all packed structures when compiling with mingw.

2013-12-15 14:14:30 +01:00