109 lines
4.0 KiB
Diff
109 lines
4.0 KiB
Diff
From 7fc985a350f9f7f5abbd19cef7a1947a3e33e5c8 Mon Sep 17 00:00:00 2001
|
|
From: root <root@yow-cgts4-lx.wrs.com>
|
|
Date: Mon, 15 Jan 2018 13:25:04 -0500
|
|
Subject: [PATCH] Use Titanium certificate
|
|
|
|
Signed-off-by: Scott Little <scott.little@windriver.com>
|
|
---
|
|
Make.defaults | 6 ++++++
|
|
Makefile | 29 ++++++++++++++++-------------
|
|
2 files changed, 22 insertions(+), 13 deletions(-)
|
|
|
|
diff --git a/Make.defaults b/Make.defaults
|
|
index e11ab5a..d16510c 100644
|
|
--- a/Make.defaults
|
|
+++ b/Make.defaults
|
|
@@ -51,6 +51,12 @@ CLANG_BUGS = $(if $(findstring gcc,$(CC)),-maccumulate-outgoing-args,)
|
|
|
|
COMMIT_ID ?= $(shell if [ -e .git ] ; then git log -1 --pretty=format:%H ; elif [ -f commit ]; then cat commit ; else echo master; fi)
|
|
|
|
+# We compile a certificate into shim. Usually this is a one-time generated
|
|
+# certificate (make-certs script) however we want to include a custom
|
|
+# certificate for which we have the key. We use the key to sign the kernel and
|
|
+# grub down the road
|
|
+INTERNAL_CERT = tis-shim
|
|
+
|
|
ifneq ($(origin OVERRIDE_SECURITY_POLICY), undefined)
|
|
CFLAGS += -DOVERRIDE_SECURITY_POLICY
|
|
endif
|
|
diff --git a/Makefile b/Makefile
|
|
index 115e7f0..f2b37fa 100644
|
|
--- a/Makefile
|
|
+++ b/Makefile
|
|
@@ -32,9 +32,10 @@ TARGETS += $(MMNAME).signed $(FBNAME).signed
|
|
CFLAGS += -DENABLE_SHIM_CERT
|
|
else
|
|
TARGETS += $(MMNAME) $(FBNAME)
|
|
+CFLAGS += -DENABLE_SHIM_CERT
|
|
endif
|
|
OBJS = shim.o mok.o netboot.o cert.o replacements.o tpm.o version.o errlog.o
|
|
-KEYS = shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer
|
|
+KEYS = shim_cert.h ocsp.* ca.* $(INTERNAL_CERT).crt $(INTERNAL_CERT).csr $(INTERNAL_CERT).p12 $(INTERNAL_CERT).pem $(INTERNAL_CERT).key $(INTERNAL_CERT).cer
|
|
ORIG_SOURCES = shim.c mok.c netboot.c replacements.c tpm.c errlog.c shim.h version.h $(wildcard include/*.h)
|
|
MOK_OBJS = MokManager.o PasswordCrypt.o crypt_blowfish.o
|
|
ORIG_MOK_SOURCES = MokManager.c PasswordCrypt.c crypt_blowfish.c shim.h $(wildcard include/*.h)
|
|
@@ -52,14 +53,18 @@ FALLBACK_SRCS = $(foreach source,$(ORIG_FALLBACK_SRCS),$(TOPDIR)/$(source))
|
|
|
|
all: $(TARGETS)
|
|
|
|
-shim.crt:
|
|
- $(TOPDIR)/make-certs shim shim@xn--u4h.net all codesign 1.3.6.1.4.1.311.10.3.1 </dev/null
|
|
+# certificate is now provided in source. To generate a random certificate,
|
|
+# uncomment this rule
|
|
+#$(INTERNAL_CERT).crt:
|
|
+# $(TOPDIR)/make-certs $(INTERNAL_CERT) shim@xn--u4h.net all codesign 1.3.6.1.4.1.311.10.3.1 </dev/null
|
|
|
|
-shim.cer: shim.crt
|
|
+$(INTERNAL_CERT).cer: $(INTERNAL_CERT).crt
|
|
$(OPENSSL) x509 -outform der -in $< -out $@
|
|
|
|
.NOTPARALLEL: shim_cert.h
|
|
-shim_cert.h: shim.cer
|
|
+# name "shim_cert.h" rather than "$(INTERNAL_CERT).h" used so C files can just
|
|
+# use a fixed name for #include
|
|
+shim_cert.h: $(INTERNAL_CERT).cer
|
|
echo "static UINT8 shim_cert[] __attribute__((__unused__)) = {" > $@
|
|
$(HEXDUMP) -v -e '1/1 "0x%02x, "' $< >> $@
|
|
echo "};" >> $@
|
|
@@ -70,15 +75,13 @@ version.c : $(TOPDIR)/version.c.in
|
|
-e "s,@@COMMIT@@,$(COMMIT_ID)," \
|
|
< $< > $@
|
|
|
|
-certdb/secmod.db: shim.crt
|
|
+certdb/secmod.db: $(INTERNAL_CERT).crt
|
|
-mkdir certdb
|
|
- $(PK12UTIL) -d certdb/ -i shim.p12 -W "" -K ""
|
|
- $(CERTUTIL) -d certdb/ -A -i shim.crt -n shim -t u
|
|
+ $(PK12UTIL) -d certdb/ -i $(INTERNAL_CERT).p12 -W "" -K ""
|
|
+ $(CERTUTIL) -d certdb/ -A -i $(INTERNAL_CERT).crt -n shim -t u
|
|
|
|
shim.o: $(SOURCES)
|
|
-ifneq ($(origin ENABLE_SHIM_CERT),undefined)
|
|
shim.o: shim_cert.h
|
|
-endif
|
|
shim.o: $(wildcard $(TOPDIR)/*.h)
|
|
|
|
cert.o : $(TOPDIR)/cert.S
|
|
@@ -213,8 +216,8 @@ endif
|
|
$^ $@
|
|
|
|
ifneq ($(origin ENABLE_SBSIGN),undefined)
|
|
-%.efi.signed: %.efi shim.key shim.crt
|
|
- $(SBSIGN) --key shim.key --cert shim.crt --output $@ $<
|
|
+%.efi.signed: %.efi $(INTERNAL_CERT).key $(INTERNAL_CERT).crt
|
|
+ $(SBSIGN) --key $(INTERNAL_CERT).key --cert $(INTERNAL_CERT).crt --output $@ $<
|
|
else
|
|
%.efi.signed: %.efi certdb/secmod.db
|
|
$(PESIGN) -n certdb -i $< -c "shim" -s -o $@ -f
|
|
@@ -258,6 +261,6 @@ archive: tag
|
|
@rm -rf /tmp/shim-$(VERSION)
|
|
@echo "The archive is in shim-$(VERSION).tar.bz2"
|
|
|
|
-.PHONY : install-deps shim.key
|
|
+.PHONY : install-deps $(INTERNAL_CERT).key
|
|
|
|
export ARCH CC LD OBJCOPY EFI_INCLUDE
|
|
--
|
|
1.8.3.1
|
|
|