Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apply EKU check with compile option #664

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

dennis-tseng99
Copy link
Contributor

Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
Also modify the ModSign EKU check to use VerifyEKUsInPkcs7Signature() to
check the signer certificate instead of the certificate directly from the
key database.

These commits supersede the PR#232 and PR#661 (Apply the EKU checks) and
separate the original author's codes from other commit so that the author's
original codes can be quite independent.

The author also answered the question in PR#232 and changed the conditional
statement to EFI_Status != EFI_SUCCESS right after VerifyEKUsInPkcs7Signature()
in Cryptlib/Pk/CryptPkcs7Verify.c

User can optionally enable codesign EKU check in compiling time.
To enable the codesign check, set ENABLE_CODESIGN_EKU to 1.
To disable the codesign check, set ENABLE_CODESIGN_EKU to 0
or just omit this flag.

For example:
make xxxx ENABLE_CODESIGN_EKU=1 xxxx shim.efi

lcp and others added 2 commits June 5, 2024 16:21
…OS_PP.

Also modify the ModSign EKU check to use VerifyEKUsInPkcs7Signature() to
check the signer certificate instead of the certificate directly from the
key database.

This commit supersedes the PR#232 and PR#661 (Apply the EKU checks) so
that author's original codes can be quite independent of other modification.

To answer the question in PR#232, author also changed the conditional
statement to EFI_Status != EFI_SUCCESS right after VerifyEKUsInPkcs7Signature()
in Cryptlib/Pk/CryptPkcs7Verify.c

Signed-off-by: Dennis Tseng <[email protected]>
This commit also supersedes PR#232 which was closed on Jul 1, 2021.
So that original codesign EKU codes cannot be bothered.

To enable the codesign check, ENABLE_CODESIGN_EKU can be set to 1.
To disable the codesign check, ENABLE_CODESIGN_EKU can be set to 0
or just omit this flag.

For example:
make xxxx ENABLE_CODESIGN_EKU=1 xxxx shim.efi

Signed-off-by: Dennis Tseng <[email protected]>
}

Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);
if (Status != EFI_SUCCESS) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The correct idiom in EDK-2 code, also mainly used in shim, is if (EFI_ERROR(Status)). The reasoning is that various EDK-2 functions can also return warnings (which are positive non-zero values; negative non-zero values are errors). So unless one explicitly wants the code to stop on warnings and errors (not usual) one should use EFI_ERROR.

Apologies if I've misunderstood and there's a reason to stop on warnings. If not, the comment applies three times that I can see in this PR.

By the way, I'm an interested outsider, so don't take this as a definitive comment from the shim project, but I believe it's correct!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mikebeaton Thanks for your comment. Although your suggestion is reasonable, we just want to keep consistency with the newest EDK-2 codes.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your reply. Could you clarify (e.g. with a link)? Obviously I'm not insisting how it should be done in shim code, but my understanding is that what I suggested is and was how EDK-2 code is written.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, here is the EDK2 codes we referred to. Thanks so much.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, it is indeed done the same way here. Thank you for the clarification.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants