Please Clarify SBAT
@jsetje is already working on this.
Since Mar 9, 2021.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 348
- PR merge metrics
- No merged PRs in 30d
Description
Can you clarify the SBAT process a bit more.
It's clear a new section in a PE is added that has a list of CSV values. Are they terminated by LF or CR/LF (or is there no terminator) or is it a double z-term type set of strings?
Which PE gets these. I presume SHIM gets it plus whatever SHIM loads?
Say Shim loads GRUBx but a vulnerability was found and now need to move to GRUBy, are we then updating the CSV values for both SHIM and GRUBy meaning we still have to end up getting SHIM signed again by MS?
What if Shim load APP1.0, there is no vulnerability but now there is APP1.1, I presume the old CSV values would still be used?
One of the .MD files mentions the SBAT_{GUID} variable, what exactly is that, is there a unique {GUID} for each vendor or product or is it just a global thing in general?
etc..
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.