Skip to content

Commit c9fb016

Browse files
pbatardpbatard
committed
Remove SSPV/SSPU provision
* Setting SkuSiPolicyVersion effectively prevents recent Windows boot media, that don't have an SkuSiPolicy.p7b, from booting, and what's more, fail boot without reporting an error to the user, as it effectively sets a "UEFI lock" when Secure Boot is enacted, per KB5042562. * Furthermore, some of the values in SkuSiPolicyUpdateSigners are offset to the system's UEFI functions, and are therefore not interchangeable between systems, meaning you can't just take an SkuSiPolicyUpdateSigners binary from on system and copy it to another. * Because of this, we remove all our business with SSPV/SSPU, and, for users who want to apply Microsoft's UEFI lock, rely on them following the standard procedure, which is to copy SkuSiPolicy.p7b to their system's ESP. * Closes #26.
1 parent b689492 commit c9fb016

6 files changed

Lines changed: 18 additions & 153 deletions

File tree

‎README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -120,15 +120,15 @@ variable to the data you want to install for it.
120120
* `-n`: No file logging (disables appending the screen ouput to `Mosby.log`).
121121
* `-r`: Try to reinstall the manufacturer's default PK/KEK/DB certs, if available.
122122
* `-s`: Silent option (Removes some of the early and late prompts).
123-
* `-u`: Update only: Only update the revocation databases, SBAT, and SSPV/SSPU as needed.
123+
* `-u`: Update only: Only update the revocation databases and SBAT as needed.
124124
* `-t`: Test mode. Disables some checks and enables the internal **low security** Random
125125
Number Generator, if no other Random Number Generator can be found.
126126
* `-x`: Install the Microsoft update that invalidates `Microsoft Windows Production PCA 2011`.
127127
You should only use this if you know what you are doing, as you you may not be able
128128
to boot or reinstall Windows otherwise. **You have been warned!**
129129

130-
You can also point to files using the `-pk`, `-kek`, `-db`, `-dbx`, `-mok`, `-dbt`, `-sbat`,
131-
`-sspv` and `-sspu` parameters.
130+
You can also point to files using the `-pk`, `-kek`, `-db`, `-dbx`, `-mok`, `-dbt` and `-sbat`
131+
parameters.
132132

133133
## Compilation
134134

@@ -225,8 +225,8 @@ other hand, we want to make it easy for people to be able to sign their UEFI boo
225225
they need it, because vetting bootloaders for Secure Boot should not be a daunting prospect.
226226

227227
At any rate, if you do want a Secure Boot signing key that is protected by a password, you
228-
can easily generated one with OpenSSL, and then point to its matching certificate when
229-
running `Mosby`.
228+
can easily generate one with OpenSSL, and then point to its matching certificate when running
229+
`Mosby`.
230230

231231
### How can I trust that Mosby is not doing something malicious behind the scenes?
232232

‎src/data.c‎

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919

2020
#include <stdint.h>
2121
#include "mosby.h"
22-
#include "ssp_var_defs.h"
2322

2423
// From https://go.microsoft.com/fwlink/?LinkId=321185
2524
unsigned char kek_2011_ms_cer[] = {
@@ -7422,7 +7421,7 @@ EFI_STATUS InitializeList(
74227421
IN OUT MOSBY_LIST *List
74237422
)
74247423
{
7425-
if (MOSBY_MAX_LIST_SIZE < 22)
7424+
if (MOSBY_MAX_LIST_SIZE < 20)
74267425
return EFI_INVALID_PARAMETER;
74277426
ZeroMem(List, sizeof(MOSBY_LIST));
74287427
List->Entry[List->Size].Type = KEK;
@@ -7634,23 +7633,5 @@ EFI_STATUS InitializeList(
76347633
List->Entry[List->Size].Buffer.Data = sbat_level_txt;
76357634
List->Entry[List->Size].Buffer.Size = sbat_level_txt_len;
76367635
List->Size++;
7637-
List->Entry[List->Size].Type = SSPU;
7638-
List->Entry[List->Size].Flags = USE_BUFFER | ALLOW_UPDATE;
7639-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS;
7640-
List->Entry[List->Size].Path = L"sspu_var_defs.h";
7641-
List->Entry[List->Size].Url = "https://github.com/rhboot/shim/raw/main/include/ssp_var_defs.h";
7642-
List->Entry[List->Size].Description = "SkuSiPolicyUpdateSigners [2023.04.29]";
7643-
List->Entry[List->Size].Buffer.Data = SkuSiPolicyUpdateSigners;
7644-
List->Entry[List->Size].Buffer.Size = sizeof(SkuSiPolicyUpdateSigners);
7645-
List->Size++;
7646-
List->Entry[List->Size].Type = SSPV;
7647-
List->Entry[List->Size].Flags = USE_BUFFER | ALLOW_UPDATE;
7648-
List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS;
7649-
List->Entry[List->Size].Path = L"sspv_var_defs.h";
7650-
List->Entry[List->Size].Url = "https://github.com/rhboot/shim/raw/main/include/ssp_var_defs.h";
7651-
List->Entry[List->Size].Description = "SkuSiPolicyVersion [2023.04.29]";
7652-
List->Entry[List->Size].Buffer.Data = SkuSiPolicyVersion;
7653-
List->Entry[List->Size].Buffer.Size = sizeof(SkuSiPolicyVersion);
7654-
List->Size++;
76557636
return EFI_SUCCESS;
76567637
}

‎src/gen_data.sh‎

Lines changed: 5 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,6 @@
11
#!/bin/env bash
22
# This script generates the C source for the data we embed in Mosby.
33

4-
github_url="https://github.com/"
5-
6-
# Retrieve the commit date from a GitHub URL
7-
get_commit_date() {
8-
url=$1
9-
if [[ "${url}" =~ ^"${github_url}" ]]; then
10-
project=${url/#${github_url}}
11-
project=$(echo ${project} | cut -f1,2 -d'/')
12-
date_url="${url#*main/}"
13-
date_url="${date_url//\//%2F}"
14-
date_url="https://api.github.com/repos/${project}/commits?path=${date_url}&page=1&per_page=1"
15-
commit_date="$(curl -s -L ${date_url} | python -m json.tool | grep -m1 -Eo '[0-9]+\-[0-9]+\-[0-9]+')"
16-
commit_date=${commit_date//-/.}
17-
echo $commit_date
18-
else
19-
echo NO_DATE
20-
fi
21-
}
22-
234
# The binaries we want to embedd and their URLs.
245
declare -A source; declare -a order;
256
source['kek_2011_ms.cer']='https://go.microsoft.com/fwlink/?LinkId=321185'; order+=('kek_2011_ms.cer');
@@ -52,8 +33,6 @@ source['dbx_update_svn_arm.bin']='https://github.com/microsoft/secureboot_object
5233
# Shim does not provide an SBatLevel.txt we can download, so we currently use our own.
5334
# See: https://github.com/rhboot/shim/issues/685
5435
source['sbat_level.txt']='https://github.com/pbatard/Mosby/raw/main/data/sbat_level.txt'; order+=('sbat_level.txt');
55-
# Microsoft SSP variables... provided by Red Hat, since Microsoft doesn't make these public yet.
56-
source['ssp_var_defs.h']='https://github.com/rhboot/shim/raw/main/include/ssp_var_defs.h'; order+=('ssp_var_defs.h');
5736

5837
declare -A exclusive_set=(
5938
['db_2011_win_ms.cer']='MOSBY_SET1'
@@ -97,11 +76,6 @@ declare -A archguard=(
9776
['riscv64']='#if defined(_M_RISCV64) || (defined (__riscv) && (__riscv_xlen == 64))'
9877
)
9978

100-
declare -A ssp_varname=(
101-
['SSPU']='SkuSiPolicyUpdateSigners'
102-
['SSPV']='SkuSiPolicyVersion'
103-
)
104-
10579
# Using { ... } > some_file allows us to redirect everything between { and }
10680
{
10781
cat << EOF
@@ -126,28 +100,16 @@ cat << EOF
126100
127101
#include <stdint.h>
128102
#include "mosby.h"
129-
#include "ssp_var_defs.h"
130103
131104
EOF
132105

133-
# Get the SSP date from the last GitHub commit of ssp_var_defs.h
134-
ssp_date_url="${source[ssp_var_defs.h]}"
135-
ssp_date_url="${ssp_date_url#*main/}"
136-
ssp_date_url="${ssp_date_url//\//%2F}"
137-
ssp_date_url="https://api.github.com/repos/rhboot/shim/commits?path=${ssp_date_url}&page=1&per_page=1"
138-
ssp_date="$(curl -s -L ${ssp_date_url} | grep -m1 -Eo '[0-9]+\-[0-9]+\-[0-9]+')"
139-
ssp_date=${ssp_date//-/.}
140-
141106
for file in "${order[@]}"; do
142107
# '-o' will try to use an override from the current repo
143108
if [[ "$1" == "-o" && -f ../data/${file} ]]; then
144109
cp ../data/${file} .
145110
else
146111
curl -f -s -L ${source[${file}]} -o ${file} || { echo "Failed to retreive ${source[${file}]}"; exit 1; }
147112
fi
148-
if [[ "${file}" = "ssp_var_defs.h" ]]; then
149-
continue
150-
fi
151113
echo "// From ${source[${file}]}"
152114
if [[ "${description[${file}]}" == "" ]]; then
153115
type=${file%%_*}
@@ -171,12 +133,6 @@ for file in "${order[@]}"; do
171133
rm ${file}
172134
done
173135

174-
# Break down ssp_var_defs.h into 2 distinct SSPU and SSPV entries
175-
unset order[-1]
176-
source['sspu_var_defs.h']=${source['ssp_var_defs.h']}; order+=('sspu_var_defs.h');
177-
source['sspv_var_defs.h']=${source['ssp_var_defs.h']}; order+=('sspv_var_defs.h');
178-
unset source[ssp_var_defs.h]
179-
180136
echo "EFI_STATUS InitializeList("
181137
echo " IN OUT MOSBY_LIST *List"
182138
echo ")"
@@ -193,11 +149,9 @@ for file in "${order[@]}"; do
193149
url=${source[${file}]}
194150
if [[ "$type" == "DBX" && "$arch" != "all" ]]; then
195151
echo "${archguard[$arch]}"
196-
elif [[ "$type" == "SSP" ]]; then
197-
type="SSPU"
198152
fi
199153
echo " List->Entry[List->Size].Type = ${type};"
200-
if [[ "$type" == "SBAT" || "$type" == "SSPU" || "$type" == "SSPV" ]]; then
154+
if [[ "$type" == "SBAT" ]]; then
201155
echo " List->Entry[List->Size].Flags = USE_BUFFER | ALLOW_UPDATE;"
202156
elif [[ "$type" == "DBX" ]]; then
203157
echo " List->Entry[List->Size].Flags = ALLOW_UPDATE;"
@@ -207,7 +161,7 @@ for file in "${order[@]}"; do
207161
if [[ "${exclusive_set[${file}]}" != "" ]]; then
208162
echo " List->Entry[List->Size].Set = ${exclusive_set[${file}]};"
209163
fi
210-
if [[ "$type" == "SBAT" || "$type" == "MOK" || "$type" == "SSPU" || "$type" == "SSPV" ]]; then
164+
if [[ "$type" == "SBAT" || "$type" == "MOK" ]]; then
211165
echo " List->Entry[List->Size].Attrs = UEFI_VAR_NV_BS;"
212166
else
213167
# The whole "append" business of the UEFI spec's SetVariable() is bullshit.
@@ -223,15 +177,9 @@ for file in "${order[@]}"; do
223177
fi
224178
echo " List->Entry[List->Size].Path = L\"${file}\";"
225179
echo " List->Entry[List->Size].Url = \"${url}\";"
226-
if [[ "$type" == "SSPU" || "$type" == "SSPV" ]]; then
227-
echo " List->Entry[List->Size].Description = \"${ssp_varname[${type}]} [$(get_commit_date ${url})]\";"
228-
echo " List->Entry[List->Size].Buffer.Data = ${ssp_varname[${type}]};"
229-
echo " List->Entry[List->Size].Buffer.Size = sizeof(${ssp_varname[${type}]});"
230-
else
231-
echo " List->Entry[List->Size].Description = \"${description[${file}]}\";"
232-
echo " List->Entry[List->Size].Buffer.Data = ${data};"
233-
echo " List->Entry[List->Size].Buffer.Size = ${data}_len;"
234-
fi
180+
echo " List->Entry[List->Size].Description = \"${description[${file}]}\";"
181+
echo " List->Entry[List->Size].Buffer.Data = ${data};"
182+
echo " List->Entry[List->Size].Buffer.Size = ${data}_len;"
235183
echo " List->Size++;"
236184
if [[ "$type" == "DBX" && "$arch" != "all" ]]; then
237185
echo "#endif"

‎src/mosby.c‎

Lines changed: 7 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,6 @@
2525
#include "variables.h"
2626
#include "version.h"
2727

28-
/* Convert a Windows version to an integer */
29-
#define WINVER_TO_UINT64(ver) (((UINT64)(ver)[0] << 48) | ((UINT64)(ver)[1] << 32) | \
30-
((UINT64)(ver)[2] << 16) | ((UINT64)(ver)[3]))
31-
3228
/* Globals */
3329
EFI_HANDLE gBaseImageHandle = NULL;
3430

@@ -89,18 +85,6 @@ MOSBY_KEY_INFO KeyInfo[MAX_TYPES] = {
8985
.OptionName = L"-sbat",
9086
.VariableName = L"SbatLevel",
9187
.VariableGuid = &gEfiShimLockGuid,
92-
},
93-
[SSPU] = {
94-
.DisplayName = "SSPU:",
95-
.OptionName = L"-sspu",
96-
.VariableName = L"SkuSiPolicyUpdateSigners",
97-
.VariableGuid = &gEfiMicrosoftGuid,
98-
},
99-
[SSPV] = {
100-
.DisplayName = "SSPV:",
101-
.OptionName = L"-sspv",
102-
.VariableName = L"SkuSiPolicyVersion",
103-
.VariableGuid = &gEfiMicrosoftGuid,
10488
}
10589
};
10690

@@ -158,11 +142,10 @@ STATIC INTN RemoveDuplicates(
158142
MOSBY_LIST *List
159143
)
160144
{
161-
INTN i, LastEntry;
145+
INTN i, LastEntry = -1;
162146

163-
LastEntry = -1;
164147
for (i = 0; i < List->Size; i++) {
165-
if (List->Entry[i].Type != Type)
148+
if (List->Entry[i].Type != Type || List->Entry[i].Flags & NO_INSTALL)
166149
continue;
167150
if (LastEntry >= 0)
168151
List->Entry[LastEntry].Flags |= NO_INSTALL;
@@ -225,7 +208,6 @@ EFI_STATUS EFIAPI efi_main(
225208
EFI_TIME Time = { 0 };
226209
UINT8 Set = MOSBY_SET1;
227210
UINTN i, j, k, l, def[3] = { 0 }, Size;
228-
UINT16 *SystemSSPV = NULL;
229211
UINT32 SystemSBatVer = 0, InstallSBatVer = 0;
230212
INTN Argc, Type, Sel, LastEntry;
231213
MOSBY_BUFFER DefaultKey[ARRAY_SIZE(def)] = { 0 }, DefaultCert, Cert;
@@ -249,7 +231,7 @@ EFI_STATUS EFIAPI efi_main(
249231
while (Argc > 1) {
250232
if (StrCmp(ArgvCopy[1], L"-h") == 0) {
251233
Print(L"Usage: Mosby [-h] [-d] [-i] [-n] [-s] [-u] [-v] [-x] [-var <file>] [-var <file>] [...]\n");
252-
Print(L" Supported var values: pk, kek, db, dbx, dbt, mok, sbat, sspu, sspv\n");
234+
Print(L" Supported var values: pk, kek, db, dbx, dbt, mok, sbat\n");
253235
goto exit;
254236
} else if (StrCmp(ArgvCopy[1], L"-i") == 0) {
255237
Print(L"Embedded data:\n");
@@ -583,12 +565,7 @@ EFI_STATUS EFIAPI efi_main(
583565
/* Process the finalized list, with all the certs, and generate the AuthVars */
584566
for (i = 0; i < List.Size; i++) {
585567
switch (List.Entry[i].Type) {
586-
case SSPV:
587-
if (List.Entry[i].Buffer.Size != 4 * sizeof(UINT16))
588-
Abort(EFI_INVALID_PARAMETER, L"Invalid SSPV size\n");
589-
// Fall through
590568
case SBAT:
591-
case SSPU:
592569
List.Entry[i].Flags = USE_BUFFER | ALLOW_UPDATE;
593570
List.Entry[i].Attrs = UEFI_VAR_NV_BS;
594571
break;
@@ -609,37 +586,17 @@ EFI_STATUS EFIAPI efi_main(
609586
if (InstallSBatVer == 0)
610587
Abort(EFI_NO_MAPPING, L"Internal error\n");
611588
Status = ReadVariable(L"SbatLevel", &gEfiShimLockGuid, &Size, (VOID**)&SBat);
612-
if (Status == EFI_SUCCESS)
589+
if (Status == EFI_SUCCESS) {
613590
SystemSBatVer = GetSBatVersion(SBat, Size);
614-
if (TestMode)
615-
Print(L"Provided SBAT: %d, System SBAT: %d\n", InstallSBatVer, SystemSBatVer);
591+
RecallPrint(L"System SBAT is %d, Embedded SBAT is %d\n", SystemSBatVer, InstallSBatVer);
592+
} else
593+
RecallPrint(L"No SBAT variable was detected on this system\n");
616594
if (InstallSBatVer <= SystemSBatVer) {
617-
// TODO: Allow override
618595
RecallPrint(L"Not installing SBAT since this system's SBAT is either the same or newer\n");
619596
List.Entry[LastEntry].Flags |= NO_INSTALL;
620597
}
621598
SafeFree(SBat);
622599

623-
/* Find out if we need to update the SSP's */
624-
LastEntry = RemoveDuplicates(SSPU, &List);
625-
if (LastEntry < 0)
626-
Abort(EFI_NO_MAPPING, L"Internal error\n");
627-
LastEntry = RemoveDuplicates(SSPV, &List);
628-
if (LastEntry < 0)
629-
Abort(EFI_NO_MAPPING, L"Internal error\n");
630-
Size = 4 * sizeof(UINT16);
631-
Status = ReadVariable(L"SkuSiPolicyVersion", &gEfiMicrosoftGuid, &Size, (VOID**)&SystemSSPV);
632-
if (Status == EFI_SUCCESS && Size != 4 * sizeof(UINT16))
633-
Abort(EFI_UNSUPPORTED, L"Unexpected SSPV variable size\n");
634-
if (Status == EFI_SUCCESS &&
635-
WINVER_TO_UINT64(SystemSSPV) >= (WINVER_TO_UINT64((UINT16*)List.Entry[LastEntry].Buffer.Data))) {
636-
// TODO: Allow override
637-
RecallPrint(L"Not installing SSP vars since this system's SSPV is either the same or newer\n");
638-
List.Entry[LastEntry].Flags |= NO_INSTALL;
639-
List.Entry[RemoveDuplicates(SSPU, &List)].Flags |= NO_INSTALL;
640-
}
641-
FreePool(SystemSSPV);
642-
643600
if (UpdateMode)
644601
goto install;
645602

‎src/mosby.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,8 +110,6 @@ enum {
110110
DBT,
111111
MOK,
112112
SBAT,
113-
SSPU,
114-
SSPV,
115113
MAX_TYPES
116114
};
117115

‎src/ssp_var_defs.h‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)