Add ident-like blobs to shim.efi for version checking.

I feel dirty.
Improve PE image bounds checking.

Signed-off-by: Peter Jones <pjones@redhat.com>
Add Tiano patch e98e59c237e17f064a4ecffb39d45499f89720a1

This is:
    Fix a bug in OpensslLib that PKCS7_verify will use over 8k stack space.

    Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
    Reviewed-by: Ye Ting  <ting.ye@intel.com>
    Reviewed-by: Dong Guo <guo.dong@intel.com>

from upstream.
Update to current Tiano Cryptlib
Reapply patches lost in the update
Do more strict checking on PE Headers.

Signed-off-by: Peter Jones <pjones@redhat.com>
Try to actually make debug printing look reasonable.

Signed-off-by: Peter Jones <pjones@redhat.com>
Put SHIM_VERBOSE under shim's guid, not global.

Signed-off-by: Peter Jones <pjones@redhat.com>
Unhook system services as we exit.

If we never find a valid thing to boot, we need to undo the weird things
we've done.

Signed-off-by: Peter Jones <pjones@redhat.com>
Bump version to 0.5

Signed-off-by: Peter Jones <pjones@redhat.com>
additional bounds-checking on section sizes

This adds additional bounds-checking on the section sizes. Also adds
-Wsign-compare to the Makefile and replaces some signed variables with
unsigned counteparts for robustness.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Don't reject all binaries without a certificate database.

If a binary isn't signed, but its hash is enrolled in db, it won't have
a certificate database.  So in those cases, don't check it against
certificate databases in db/dbx/etc, but we don't need to reject it
outright.

Signed-off-by: Peter Jones <pjones@redhat.com>
Revert "additional bounds-checking on section sizes"

This reverts commit 21e40f0174814b3d91836e38c7cf95c8f2f1f3a4.

In principle I like the idea of what's going on here, but
generate_hash() really does need to have the expected result.
We should be checking both mok and the system's SB settings

When we call hook_system_services(), we're currently only checking mok's
setting.  We should use secure_mode() instead so it'll check both.

Signed-off-by: Peter Jones <pjones@redhat.com>
Don't free GetVariable() return data without checking the status code.

This breaks every machine from before Secure Boot was a thing.

Signed-off-by: Peter Jones <pjones@redhat.com>