src/lib/libsecureboot, branch release/14.4.0FreeBSD source treehttps://cgit-dev.freebsd.org/src/atom?h=release%2F14.4.02025-02-18T18:41:07Zlibsecureboot: Report failure for unsupported hash algorithm2025-02-18T18:41:07ZHuwylersimon.huwyler@gmail.com2025-01-17T14:55:15Zurn:sha1:0ea2924f8126bb32ee704b071a87185140297ab3
Reviewed by: sjg
Pull request: https://github.com/freebsd/freebsd-src/pull/1574
(cherry picked from commit caaeab697bf98bf96e2fa8cb4a1e22240511fbcc)
libsecureboot do not report expected unverified files2024-04-16T19:54:22ZSimon J. Gerratysjg@FreeBSD.org2024-02-12T22:35:01Zurn:sha1:16d49d0e4fe7061832c2c23ff9e91e7abdc272ac
By default only report unverified files at severity VE_WANT
and above. This inlcudes *.conf but not *.hints, *.cookie
or *.tgz which get VE_TRY as their severity.
If Verbose is set to 0, then VerifyFlags should default to 0 too.
Thus the combination of
module_verbose=0
VE_VEBOSE=0
is sufficient to make the loader almost totally silent.
When verify_prep has to find_manifest and it is verified ok
return VE_NOT_CHECKED to verify_file so that it can skip
repeating verify_fd
Also add better debugging output for is_verified and add_verify_status.
vectx handle compressed modules
When verifying a compressed module (.ko.gz or .ko.bz2)
stat() reports the size as -1 (unknown).
vectx_lseek needs to spot this during closing - and just read until
EOF is hit.
Note: because of the way libsa's open() works, verify_prep will see
the path to be verified as module.ko not module.ko.bz2 etc. This is
actually ok, because we need a separate module.ko.bz2 entry so that
the package can be verified, and the hash for module.ko is of the
uncompressed file which is what vectx will see.
Re-work local.trust.mk so site.trust.mk need only set
VE_SIGN_URL_LIST (if using the mentioned signing server)
interp.c: restrict interactive input
Apply the same restrictions to interactive input as for
unverified conf and hints files.
Use version.veriexec when LOADER_VERIEXEC is yes
Reviewed by: kevans
Sponsored by: Juniper Networks, Inc.
Differential Revision: https://reviews.freebsd.org/D43810
(cherry picked from commit f616d61ab6b071e5fbfdbae7033a9ef04c1444ad)
libsecureboot: be more verbose about validation failures2024-01-07T19:39:17ZStéphane Rochoystephane.rochoy@stormshield.eu2023-12-04T09:57:43Zurn:sha1:a13066579c6f0b80786472505f115cadbf301c25
Reviewed by: imp, sjg
Pull Request: https://github.com/freebsd/freebsd-src/pull/916
(cherry picked from commit 4b9d605768acabc460aa6dcfe8a1f8db35b16794)
Remove $FreeBSD$: one-line bare tag2023-08-16T17:55:20ZWarner Loshimp@FreeBSD.org2023-08-16T17:55:20Zurn:sha1:05248206f720394d95c2a7475429311df670a2e9
Remove /^\s*\$FreeBSD\$$\n/
Remove $FreeBSD$: one-line sh pattern2023-08-16T17:55:03ZWarner Loshimp@FreeBSD.org2023-08-16T17:55:03Zurn:sha1:d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf
Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Remove $FreeBSD$: one-line .c pattern2023-08-16T17:54:42ZWarner Loshimp@FreeBSD.org2023-08-16T17:54:42Zurn:sha1:1d386b48a555f61cb7325543adbbb5c3f3407a66
Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
Remove $FreeBSD$: one-line .h pattern2023-08-16T17:54:23ZWarner Loshimp@FreeBSD.org2023-08-16T17:54:23Zurn:sha1:42b388439bd3795e09258c57a74ce9eec3651c7b
Remove /^\s*\*+\s*\$FreeBSD\$.*$\n/
Remove $FreeBSD$: two-line .h pattern2023-08-16T17:54:16ZWarner Loshimp@FreeBSD.org2023-08-16T17:54:16Zurn:sha1:b3e7694832e81d7a904a10f525f8797b753bf0d3
Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
libsecureboot: do not accept certificate we cannot decode2023-07-05T19:37:14ZSimon J. Gerratysjg@FreeBSD.org2023-07-05T19:37:14Zurn:sha1:9c3478cb226385c468c0d029337f4e78e69931c8
Although we care more about the CN of a certificate than its status
(for purpose of reporting), we should skip if we have errors decoding.
Reviewed by: stevek
Sponsored by: Juniper Networks, Inc.
libsecureboot: avoid set but not used errors2023-06-30T06:52:17ZSimon J. Gerratysjg@FreeBSD.org2023-06-30T06:52:17Zurn:sha1:56f3f2d2491e30f369f9461c3cb2a366bdffbe1d
Reviewed by: stevek