Enable secure boot
| 56 | |
| 57 | // Enable secure boot |
| 58 | VOID EnableSecureBoot(VOID) |
| 59 | { |
| 60 | EFI_STATUS Status = EFI_NOT_FOUND; |
| 61 | BOOLEAN WantDefaultKeys; |
| 62 | CONST CHAR16 *ErrorString = NULL; |
| 63 | UINTN CloverSignatureSize = 0; |
| 64 | VOID *CloverSignature = NULL; |
| 65 | // Check in setup mode |
| 66 | if (gSettings.SecureBoot || !gSettings.SecureBootSetupMode) { |
| 67 | return; |
| 68 | } |
| 69 | // Ask user if they want to use default keys |
| 70 | WantDefaultKeys = YesNoMessage(L"Secure Boot", L"Enroll the default keys too?"); |
| 71 | DBG("Enabling secure boot with%s default keys\n", WantDefaultKeys ? "" : "out"); |
| 72 | // Get this image's certificate |
| 73 | if (SelfFullDevicePath != NULL) { |
| 74 | UINT32 AuthenticationStatus = 0; |
| 75 | UINTN FileSize = 0; |
| 76 | // Open the file buffer |
| 77 | VOID *FileBuffer = GetFileBufferByFilePath(FALSE, SelfFullDevicePath, &FileSize, &AuthenticationStatus); |
| 78 | if (FileBuffer != NULL) { |
| 79 | if (FileSize > 0) { |
| 80 | // Retrieve the certificates |
| 81 | CloverSignature = GetImageSignatureDatabase(FileBuffer, FileSize, &CloverSignatureSize, FALSE); |
| 82 | if (CloverSignature != NULL) { |
| 83 | if (CloverSignatureSize > 0) { |
| 84 | // Found signature |
| 85 | Status = EFI_SUCCESS; |
| 86 | } else { |
| 87 | FreePool(CloverSignature); |
| 88 | CloverSignature = NULL; |
| 89 | } |
| 90 | } |
| 91 | } |
| 92 | FreePool(FileBuffer); |
| 93 | } |
| 94 | // Check and alert about image not found |
| 95 | if ((FileBuffer == NULL) || (FileSize == 0)) { |
| 96 | CHAR16 *FilePath = FileDevicePathToStr(SelfFullDevicePath); |
| 97 | if (FilePath != NULL) { |
| 98 | DBG("Failed to load Clover image from %ls\n", FilePath); |
| 99 | FreePool(FilePath); |
| 100 | } else { |
| 101 | DBG("Failed to load Clover image\n"); |
| 102 | } |
| 103 | } |
| 104 | } |
| 105 | if (EFI_ERROR(Status) || (CloverSignature == NULL)) { |
| 106 | ErrorString = L"Clover does not have a certificate"; |
| 107 | } else { |
| 108 | // Enroll secure boot keys |
| 109 | Status = EnrollSecureBootKeys(CloverSignature, CloverSignatureSize, WantDefaultKeys); |
| 110 | if (EFI_ERROR(Status)) { |
| 111 | ErrorString = L"Failed to enroll secure boot keys"; |
| 112 | } |
| 113 | FreePool(CloverSignature); |
| 114 | } |
| 115 | // Reinit secure boot now |
no test coverage detected