Apply EKU check with compile option #664
Conversation
…OS_PP. Also modify the ModSign EKU check to use VerifyEKUsInPkcs7Signature() to check the signer certificate instead of the certificate directly from the key database. This commit supersedes the PR#232 and PR#661 (Apply the EKU checks) so that author's original codes can be quite independent of other modification. To answer the question in PR#232, author also changed the conditional statement to EFI_Status != EFI_SUCCESS right after VerifyEKUsInPkcs7Signature() in Cryptlib/Pk/CryptPkcs7Verify.c Signed-off-by: Dennis Tseng <dennis.tseng@suse.com>
This commit also supersedes PR#232 which was closed on Jul 1, 2021. So that original codesign EKU codes cannot be bothered. To enable the codesign check, ENABLE_CODESIGN_EKU can be set to 1. To disable the codesign check, ENABLE_CODESIGN_EKU can be set to 0 or just omit this flag. For example: make xxxx ENABLE_CODESIGN_EKU=1 xxxx shim.efi Signed-off-by: Dennis Tseng <dennis.tseng@suse.com>
| } | ||
|
|
||
| Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent); | ||
| if (Status != EFI_SUCCESS) { |
There was a problem hiding this comment.
The correct idiom in EDK-2 code, also mainly used in shim, is if (EFI_ERROR(Status)). The reasoning is that various EDK-2 functions can also return warnings (which are positive non-zero values; negative non-zero values are errors). So unless one explicitly wants the code to stop on warnings and errors (not usual) one should use EFI_ERROR.
Apologies if I've misunderstood and there's a reason to stop on warnings. If not, the comment applies three times that I can see in this PR.
By the way, I'm an interested outsider, so don't take this as a definitive comment from the shim project, but I believe it's correct!
There was a problem hiding this comment.
@mikebeaton Thanks for your comment. Although your suggestion is reasonable, we just want to keep consistency with the newest EDK-2 codes.
There was a problem hiding this comment.
Thanks for your reply. Could you clarify (e.g. with a link)? Obviously I'm not insisting how it should be done in shim code, but my understanding is that what I suggested is and was how EDK-2 code is written.
There was a problem hiding this comment.
Sure, here is the EDK2 codes we referred to. Thanks so much.
There was a problem hiding this comment.
Okay, it is indeed done the same way here. Thank you for the clarification.
Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
Also modify the ModSign EKU check to use VerifyEKUsInPkcs7Signature() to
check the signer certificate instead of the certificate directly from the
key database.
These commits supersede the PR#232 and PR#661 (Apply the EKU checks) and
separate the original author's codes from other commit so that the author's
original codes can be quite independent.
The author also answered the question in PR#232 and changed the conditional
statement to EFI_Status != EFI_SUCCESS right after VerifyEKUsInPkcs7Signature()
in Cryptlib/Pk/CryptPkcs7Verify.c
User can optionally enable codesign EKU check in compiling time.
To enable the codesign check, set ENABLE_CODESIGN_EKU to 1.
To disable the codesign check, set ENABLE_CODESIGN_EKU to 0
or just omit this flag.
For example:
make xxxx ENABLE_CODESIGN_EKU=1 xxxx shim.efi