diff --git a/mokutil-constify-efi-guid.patch b/mokutil-constify-efi-guid.patch new file mode 100644 index 0000000..de8e432 --- /dev/null +++ b/mokutil-constify-efi-guid.patch @@ -0,0 +1,87 @@ +From eba569a8e6c33f07042758cbfa1706d7339464e1 Mon Sep 17 00:00:00 2001 +From: Gary Lin +Date: Wed, 13 Jan 2016 16:05:21 +0800 +Subject: [PATCH] Make all efi_guid_t const + +All UEFI GUIDs defined in efivar are const. Declare all of them const +to make gcc happy. + +Signed-off-by: Gary Lin +--- + src/mokutil.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index 1fb34f9..d2c52b4 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -200,7 +200,7 @@ efichar_from_char (efi_char16_t *dest, const char *src, size_t dest_len) + } + + static uint32_t +-efi_hash_size (efi_guid_t *hash_type) ++efi_hash_size (const efi_guid_t *hash_type) + { + if (efi_guid_cmp (hash_type, &efi_guid_sha1) == 0) { + return SHA_DIGEST_LENGTH; +@@ -218,7 +218,7 @@ efi_hash_size (efi_guid_t *hash_type) + } + + static uint32_t +-signature_size (efi_guid_t *hash_type) ++signature_size (const efi_guid_t *hash_type) + { + uint32_t hash_size; + +@@ -439,7 +439,7 @@ list_keys (uint8_t *data, size_t data_size) + + /* match the hash in the hash array and return the index if matched */ + static int +-match_hash_array (efi_guid_t *hash_type, const void *hash, ++match_hash_array (const efi_guid_t *hash_type, const void *hash, + const void *hash_array, const uint32_t array_size) + { + uint32_t hash_size, hash_count; +@@ -469,8 +469,8 @@ match_hash_array (efi_guid_t *hash_type, const void *hash, + } + + static int +-delete_data_from_list (efi_guid_t *var_guid, const char *var_name, +- efi_guid_t *type, void *data, uint32_t data_size) ++delete_data_from_list (const efi_guid_t *var_guid, const char *var_name, ++ const efi_guid_t *type, void *data, uint32_t data_size) + { + uint8_t *var_data = NULL; + size_t var_data_size = 0; +@@ -1006,8 +1006,8 @@ is_valid_cert (void *cert, uint32_t cert_size) + } + + static int +-is_duplicate (efi_guid_t *type, const void *data, const uint32_t data_size, +- efi_guid_t *vendor, const char *db_name) ++is_duplicate (const efi_guid_t *type, const void *data, const uint32_t data_size, ++ const efi_guid_t *vendor, const char *db_name) + { + uint8_t *var_data; + size_t var_data_size; +@@ -1059,7 +1059,7 @@ done: + } + + static int +-is_valid_request (efi_guid_t *type, void *mok, uint32_t mok_size, ++is_valid_request (const efi_guid_t *type, void *mok, uint32_t mok_size, + MokRequest req) + { + switch (req) { +@@ -1096,7 +1096,7 @@ is_valid_request (efi_guid_t *type, void *mok, uint32_t mok_size, + } + + static int +-in_pending_request (efi_guid_t *type, void *data, uint32_t data_size, ++in_pending_request (const efi_guid_t *type, void *data, uint32_t data_size, + MokRequest req) + { + uint8_t *authvar_data; +-- +2.9.0 + diff --git a/mokutil-set-efi-variable-file-mode.patch b/mokutil-set-efi-variable-file-mode.patch new file mode 100644 index 0000000..4eaac4f --- /dev/null +++ b/mokutil-set-efi-variable-file-mode.patch @@ -0,0 +1,37 @@ +From 951daed3f98e9a3de2bc36cd82525cdbf7595e3e Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jun 2016 10:19:43 -0400 +Subject: [PATCH] mokutil: be explicit about file modes in all cases. + +Signed-off-by: Peter Jones +--- + src/mokutil.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index d2c52b4..d554f6c 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -574,7 +574,8 @@ delete_data_from_list (const efi_guid_t *var_guid, const char *var_name, + | EFI_VARIABLE_BOOTSERVICE_ACCESS + | EFI_VARIABLE_RUNTIME_ACCESS; + ret = efi_set_variable (*var_guid, var_name, +- var_data, total, attributes); ++ var_data, total, attributes, ++ S_IRUSR | S_IWUSR); + if (ret < 0) { + fprintf (stderr, "Failed to write variable \"%s\": %m\n", + var_name); +@@ -938,7 +939,8 @@ update_request (void *new_list, int list_len, MokRequest req, + data_size = list_len; + + if (efi_set_variable (efi_guid_shim, req_name, +- data, data_size, attributes) < 0) { ++ data, data_size, attributes, ++ S_IRUSR | S_IWUSR) < 0) { + switch (req) { + case ENROLL_MOK: + fprintf (stderr, "Failed to enroll new keys\n"); +-- +2.9.0 + diff --git a/mokutil-support-revoke-builtin-cert.patch b/mokutil-support-revoke-builtin-cert.patch index def21f2..e14b749 100644 --- a/mokutil-support-revoke-builtin-cert.patch +++ b/mokutil-support-revoke-builtin-cert.patch @@ -1,7 +1,7 @@ From fe695869306567a1ae6c7ddbd87c2fbdc4a5bba1 Mon Sep 17 00:00:00 2001 From: Gary Ching-Pang Lin Date: Fri, 21 Feb 2014 17:56:55 +0800 -Subject: [PATCH 1/2] Add the option to revoke the built-in certificate +Subject: [PATCH 1/3] Add the option to revoke the built-in certificate This is an openSUSE-only patch. @@ -141,13 +141,13 @@ index 5b34f22..ab3d04f 100644 print_help (); break; -- -1.8.4.5 +2.9.0 From 09ac7c76b0c313abc664fe104bc32d89df0e0976 Mon Sep 17 00:00:00 2001 From: Gary Ching-Pang Lin Date: Tue, 4 Nov 2014 14:50:36 +0800 -Subject: [PATCH 2/2] Use the efivar functions to access UEFI variables +Subject: [PATCH 2/3] Use the efivar functions to access UEFI variables This is an openSUSE-only patch. @@ -236,5 +236,33 @@ index ab3d04f..9dcf4f1 100644 goto error; } -- -1.8.4.5 +2.9.0 + + +From 05c64b7b7d44f1c2a106e7273a33f83e57452d92 Mon Sep 17 00:00:00 2001 +From: Gary Lin +Date: Wed, 13 Jul 2016 14:58:15 +0800 +Subject: [PATCH 3/3] Use efi_set_variable from efivar 0.24 + +This is an openSUSE-only patch. +--- + src/mokutil.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index 9dcf4f1..1a8ccc9 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -2061,7 +2061,8 @@ revoke_builtin_cert (void) + | EFI_VARIABLE_RUNTIME_ACCESS; + + if (efi_set_variable (efi_guid_shim, "ClearVerify", +- data, data_size, attributes) < 0) { ++ data, data_size, attributes, ++ S_IRUSR | S_IWUSR) < 0) { + fprintf (stderr, "Failed to write ClearVerify\n"); + goto error; + } +-- +2.9.0 diff --git a/mokutil.changes b/mokutil.changes index 9133d9c..ce61c8d 100644 --- a/mokutil.changes +++ b/mokutil.changes @@ -1,3 +1,14 @@ +------------------------------------------------------------------- +Wed Jul 13 04:52:23 UTC 2016 - glin@suse.com + +- Patches for efivar 0.24 + + Add mokutil-set-efi-variable-file-mode.patch to set the file + mode explicitly. + + Add mokutil-constify-efi-guid.patch to make all efi_guild_t + variables const. + + Refresh mokutil-support-revoke-builtin-cert.patch for the + change of efi_set_variable() + ------------------------------------------------------------------- Tue Jun 30 08:43:45 UTC 2015 - glin@suse.com diff --git a/mokutil.spec b/mokutil.spec index cec577d..e392498 100644 --- a/mokutil.spec +++ b/mokutil.spec @@ -1,7 +1,7 @@ # # spec file for package mokutil # -# Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -28,6 +28,10 @@ Source: %{name}-%{version}.tar.bz2 Patch1: mokutil-fix-overflow.patch # PATCH-FIX-UPSTREAM mokutil-fshort-wchar.patch glin@suse.com -- Add "-fshort-wchar" to make sure the UEFI strings are UCS-2 encoding Patch2: mokutil-fshort-wchar.patch +# PATCH-FIX-UPSTREAM mokutil-set-efi-variable-file-mode.patch glin@suse.com -- Be explicit about file modes in all cases +Patch3: mokutil-set-efi-variable-file-mode.patch +# PATCH-FIX-UPSTREAM mokutil-constify-efi-guid.patch glin@suse.com -- Make all efi_guild_t variables const +Patch4: mokutil-constify-efi-guid.patch # OPENSUSE ONLY # PATCH-FIX-OPENSUSE mokutil-support-revoke-builtin-cert.patch glin@suse.com -- Add an option to revoke the built-in certificate Patch100: mokutil-support-revoke-builtin-cert.patch @@ -53,6 +57,8 @@ Authors: %setup -q %patch1 -p1 %patch2 -p1 +%patch3 -p1 +%patch4 -p1 %patch100 -p1 %build