diff options
| author | Michael Brown <mcb30@ipxe.org> | 2022-01-13 14:10:03 +0000 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2022-01-13 14:12:44 +0000 |
| commit | f4f9adf618cd85d330a896e1f721f3aa78d2409d (patch) | |
| tree | 92cf1a5ad3ac644c8ebfc66213f42ecba973047b /src/core | |
| parent | fbbdc39260cf37aa749e897e773f59807d1b8362 (diff) | |
| download | ipxe-f4f9adf618cd85d330a896e1f721f3aa78d2409d.tar.gz | |
[efi] Include Secure Boot Advanced Targeting (SBAT) metadatasbat
SBAT defines an encoding for security generation numbers stored as a
CSV file within a special ".sbat" section in the signed binary. If a
Secure Boot exploit is discovered then the generation number will be
incremented alongside the corresponding fix.
Platforms may then record the minimum generation number required for
any given product. This allows for an efficient revocation mechanism
that consumes minimal flash storage space (in contrast to the DBX
mechanism, which allows for only a single-digit number of revocation
events to ever take place across all possible signed binaries).
Add SBAT metadata to iPXE EFI binaries to support this mechanism.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/core')
| -rw-r--r-- | src/core/version.c | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/src/core/version.c b/src/core/version.c index c984335c2..22f444065 100644 --- a/src/core/version.c +++ b/src/core/version.c @@ -32,6 +32,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include <wchar.h> #include <ipxe/features.h> #include <ipxe/version.h> +#include <ipxe/sbat.h> #include <config/general.h> #include <config/branding.h> @@ -92,3 +93,32 @@ const wchar_t build_wname[] = WSTRING ( BUILD_NAME ); /** Copy of build name string within ".prefix" */ const char build_name_prefix[] __attribute__ (( section ( ".prefix.name" ) )) = BUILD_NAME; + +/** SBAT upstream iPXE line + * + * This line represents the security generation of the upstream + * codebase from which this build is derived. + */ +#define SBAT_IPXE \ + SBAT_LINE ( "ipxe", IPXE_SBAT_GENERATION, \ + "iPXE", BUILD_NAME, VERSION, "https://ipxe.org" ) + +/** SBAT local build line + * + * This line states the security generation of the local build, which + * may include non-default features or non-upstreamed modifications. + */ +#if PRODUCT_SBAT_GENERATION +#define SBAT_PRODUCT \ + SBAT_LINE ( "ipxe." PRODUCT_SBAT_NAME, PRODUCT_SBAT_GENERATION, \ + PRODUCT_SHORT_NAME, BUILD_NAME, VERSION, \ + PRODUCT_URI ) +#else +#define SBAT_PRODUCT "" +#endif + +/** SBAT data */ +#define SBAT_DATA SBAT_HEADER "" SBAT_IPXE "" SBAT_PRODUCT + +/** SBAT data (without any NUL terminator) */ +const char sbat[ sizeof ( SBAT_DATA ) - 1 ] __sbat = SBAT_DATA; |