Verification by vendor cert -- dead code?
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 348
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/rhboot/shim/blob/7ba7440c49d32f911fb9e1c213307947a777085d/shim.c#L542
How is this code-path reachable?
The vendor cert is addended into MokListRT, thus when loading a vendor signed executable, the certificate check succeeds in check_allowlist in shim.c, measuring the matching certificate under the name MokListRT into PCR7. The success condition in the #if defined(VENDOR_CERT_FILE) section in verify_one_signature never executes for valid executables.
Under PCR7, I am only able to get a measurement named under MokListRT in the eventlog, never Shim.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in shim.c around line 542 and trace verify_one_signature, check_allowlist, and the VENDOR_CERT_FILE condition for vendor-signed executables. Compare that path with PCR7 event-log measurements named MokListRT and Shim. Done means establishing whether the condition is reachable and explaining the observed measurement behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100