dany/u-boot-megous
1
0
Fork 0
mirror of https://xff.cz/git/u-boot/ synced 2025-09-01 08:42:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

efi_loader: read-only AuditMode and DeployedMode

Browse Source 
Set the read only property of the UEFI variables AuditMode and DeployedMode
conforming to the UEFI specification.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This commit is contained in:
Heinrich Schuchardt
2020-07-04 18:34:15 +02:00
parent fd7b6730ab
commit 55a830560e
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
lib/efi_loader/efi_variable.c
View File

@@ -183,32 +183,36 @@ static const char *parse_attr(const char *str, u32 *attrp, u64 *timep)
static efi_status_t efi_set_secure_state(u8 secure_boot, u8 setup_mode, static efi_status_t efi_set_secure_state(u8 secure_boot, u8 setup_mode,
u8 audit_mode, u8 deployed_mode) u8 audit_mode, u8 deployed_mode)
{ {
u32 attributes;
efi_status_t ret; efi_status_t ret;
const u32 attributes_ro = EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS |
EFI_VARIABLE_READ_ONLY;
const u32 attributes_rw = EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS;
attributes = EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS |
EFI_VARIABLE_READ_ONLY;
ret = efi_set_variable_int(L"SecureBoot", &efi_global_variable_guid, ret = efi_set_variable_int(L"SecureBoot", &efi_global_variable_guid,
attributes, sizeof(secure_boot), attributes_ro, sizeof(secure_boot),
&secure_boot, false); &secure_boot, false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
ret = efi_set_variable_int(L"SetupMode", &efi_global_variable_guid, ret = efi_set_variable_int(L"SetupMode", &efi_global_variable_guid,
attributes, sizeof(setup_mode), attributes_ro, sizeof(setup_mode),
&setup_mode, false); &setup_mode, false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
ret = efi_set_variable_int(L"AuditMode", &efi_global_variable_guid, ret = efi_set_variable_int(L"AuditMode", &efi_global_variable_guid,
attributes, sizeof(audit_mode), audit_mode || setup_mode ?
&audit_mode, false); attributes_ro : attributes_rw,
sizeof(audit_mode), &audit_mode, false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
ret = efi_set_variable_int(L"DeployedMode", ret = efi_set_variable_int(L"DeployedMode",
&efi_global_variable_guid, attributes, &efi_global_variable_guid,
audit_mode || deployed_mode || setup_mode ?
attributes_ro : attributes_rw,
sizeof(deployed_mode), &deployed_mode, sizeof(deployed_mode), &deployed_mode,
false); false);
err: err: