Fix check logic for SetupMode variable.

After going back and inspecting this further, the logic for "SetupMode"
being present at all was incorrect.  Also initialize our state earlier
so it's sure to always be set.

Signed-off-by: Peter Jones <pjones@redhat.com>
Bump version to 0.7.

Do not use 0.6; on some machines it misunderstands the SetupMode
variable.

Signed-off-by: Peter Jones <pjones@redhat.com>
fix verify_mok()

() Fix the return value semantics. If the MokList doesn't
exist, we are OK. If the MokList was compromised but we
were able to erase it, that is OK too. Only if the list
can't be nuked do we return an error.

() Fix use of potentially uninitialized attribute variable

() Actually use the return value when called from verify_buffer.

Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
shim.c: Add support for hashing/relocation of 32-bit binaries

Change-Id: Ib93305f7f1691d1b142567507df1058de62dde06
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
netboot.h: fix build error on 32-bit systems

Function prototype/implementation mismatch.

Change-Id: I89aaae1b49d0372d3aed76fc21c194e0ae55f72e
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
properly compile OpenSSL in 32-bit mode

Change-Id: Iff3ee5ae0f0b95b282b99a23e465723b4e9f6104
Signed-off-by: Andrey Petrov <andrey.petrov@intel.com>
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
fallback.c: fix 32-bit compilation

fh->Read expects pointer to 32-bit int, use UINTN

Change-Id: If1a728efd51a9a24dfcd8123e84bf4c0713491fe
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
fix fallback.so build dependency

Exposed during parallel builds

Change-Id: I9867858166dcafd69438f37ee5da14a267ace8f4
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
propagate some path variables

If these are overridden on the command line, pass them along to
the sub-makes.

Change-Id: I531ccb5d2f5e4be8e99d4892cdcfffffc1ad9877
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
allow 32-bit compilation with 64-bit compiler

Also removed unused LIB_PATH from some Makefiles.

Change-Id: I7d28d18f7531b51b6121a2ffb88bcaedec57c467
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
shim: improve error messages

%r when used in Print() will show a string representation of
an EFI_STATUS code.

Change-Id: I6db47f5213454603bd66177aca378ad01e9f0bd4
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Clarify meaning of insecure_mode

insecure_mode was intended to indicate that the user had explicity disabled
checks with mokutil, which means it wasn't the opposite of secure_mode().
Change the names to clarify this and don't show the insecure mode message
unless the user has explicitly enabled that mode.

Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Don't hook system services if shim has no built-in keys

Shim should only need to enforce its security policy when its launching
binaries signed with its built-in key. Binaries signed by keys in db or
Mokdb should be able to rely on their own security policy.

Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>