libsecureboot: allow OpenPGP support to be dormantSince we can now add OpenPGP trust anchors at runtime,ensure the latent support is available.Ensure we do not add duplicate keys to trust store.
libsecureboot: allow OpenPGP support to be dormantSince we can now add OpenPGP trust anchors at runtime,ensure the latent support is available.Ensure we do not add duplicate keys to trust store.Also allow reporting names of trust anchors added/revokedWe only do this for loader and only after initializing trust store.Thus only changes to initial trust store will be logged.MFC of r349446Reviewed by: stevekDifferential Revision: https://reviews.freebsd.org/D20700
show more ...
load_key_buf do not free data from dearmorThe data returned by dearmor is referenced by the keyleave it alone!MFC r347980Reviewed by: stevek
libsecureboot: allow control of when pseudo pcr is updatedDuring boot we only want to measure things which *must*be verified - this should provide more deterministic ordering.MFC r347981Review
libsecureboot: allow control of when pseudo pcr is updatedDuring boot we only want to measure things which *must*be verified - this should provide more deterministic ordering.MFC r347981Reviewed by: stevekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D20297
libsecureboot: make it easier to customize trust anchorsAvoid making hash self-tests depend on X.509 certs.Include OpenPGP keys in trust store count.MFC of r347408Reviewed by: stevekSponsored
libsecureboot: make it easier to customize trust anchorsAvoid making hash self-tests depend on X.509 certs.Include OpenPGP keys in trust store count.MFC of r347408Reviewed by: stevekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D20208
Allow no_hash to appear in manifest.sbin/veriexec will ignore entries that have no hash anyway,but loader needs to be explicitly told that such files areok to ignore (not verify).We will report
Allow no_hash to appear in manifest.sbin/veriexec will ignore entries that have no hash anyway,but loader needs to be explicitly told that such files areok to ignore (not verify).We will report as Unverified depending on verbose level,but with no reason - because we are not rejecting the file.MFC r346604
MFC r345830: Create kernel module to parse Veriexec manifest based on envsSubmitted by: Kornel Duleba <[email protected]>Obtained from: SemihalfSponsored by: Stormshield
MFC r344840: Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocationUEFI related headers were copied from edk2.A new build option "MK_LOADER_EFI_SECUREBO
MFC r344840: Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocationUEFI related headers were copied from edk2.A new build option "MK_LOADER_EFI_SECUREBOOT" was added to allowloading of trusted anchors from UEFI.Certificate revocation support is also introduced.The forbidden certificates are loaded from dbx variable.Verification fails in two cases:There is a direct match between cert in dbx and the one in the chain.The CA used to sign the chain is found in dbx.One can also insert a hash of TBS section of a certificate into dbx.In this case verifications fails only if a direct match with acertificate in chain is found.Submitted by: Kornel Duleba <[email protected]>Obtained from: SemihalfSponsored by: Stormshield
Add support for loader veriexecAlso sbin/veriexec for mac_veriexecMFC r343281,344564-344568,344780,344784,345289,346070