Fix a compilation error / warning due to missing check on return valu…

.gitignore

@@ -4,8 +4,11 @@
 .*.sw?
 *~
 *.a
-*.env
+*.bin
+*.C
 *.E
+*.env
+*.esl
 *.o
 *.map
 *.pc
@@ -23,5 +26,7 @@ vgcore.*
 scan-results/
 src/efivar
 src/efivar-static
+src/efisecdb
+src/efisecdb-static
 src/makeguids
 src/guid-symbols.c

docs/.gitignore

@@ -0,0 +1 @@
+efisecdb.1

docs/Makefile

@@ -5,7 +5,9 @@ include $(TOPDIR)/src/include/version.mk
 include $(TOPDIR)/src/include/rules.mk
 include $(TOPDIR)/src/include/defaults.mk
 
-MAN1TARGETS = efivar.1
+MAN1TARGETS = efisecdb.1 \
+	      efivar.1
+
 MAN3TARGETS = efi_append_variable.3 \
 	     efi_del_variable.3 \
 	     efi_get_next_variable_name.3 \
@@ -36,13 +38,14 @@ MAN3TARGETS = efi_append_variable.3 \
 	     efi_variable_set_attributes.3 \
 	     efi_variable_realize.3
 
-all :
+all : $(MAN1TARGETS) $(MAN3TARGETS)
 
 clean :
+	@rm -f efisecdb.1
 
 test :
 
-install :
+install : $(MAN1TARGETS) $(MAN3TARGETS)
 	$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man1
 	$(foreach x, $(MAN1TARGETS), $(INSTALL) -m 644 $(x) $(DESTDIR)/$(MANDIR)/man1/;)
 	$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man3

docs/efisecdb.1.mdoc

@@ -0,0 +1,185 @@
+.Dd $Mdocdate: Jun 4 2020$
+.Dt EFISECDB 1
+.Sh NAME
+.Nm efisecdb
+.Nd utility for managing UEFI signature lists
+.Sh SYNOPSIS
+.Nm
+.Bk -words
+.Oo Fl i Ar file Oo Fl i Ar file
+.Oc ... Oc
+\ \p
+.Oo
+.Cm Fl g Ar guid
+.Ao Cm Fl a | Fl r Ac
+.Ao
+.Cm Oo Fl t Ar hash-type Oc Cm Fl h Ar hash |
+.Cm Fl c Ar file
+.Ac
+\ \p
+.Oo
+.Cm Fl g Ar guid
+.Ao Cm Fl a | Fl r Ac
+.Ao
+.Cm Oo Fl t Ar hash-type Oc Cm Fl h Ar hash |
+.Cm Fl c Ar file
+.Ac
+.Oc ... Oc
+.Ao
+.Cm Fl d Op Fl A
+|
+.Cm Fl o Ar file
+.Cm Fl L
+.Ac
+.Ek
+.Sh DESCRIPTION
+.Nm
+is a command line utility for management of UEFI signature lists in detached
+files. That is, it's for command line generation and management of files in the
+format of KEK, DB, and DBX.
+
+Operation occurs in three phases:
+.Bl -enum -compact
+.It
+Loading of security databases specified with
+.Fl Fl input
+.It
+Left-to-right processing of other options, using
+.Fl Fl hash-type, Fl Fl owner-guid, Fl Fl add,
+and
+.Fl Fl remove
+as state to build selectors to add or remove hashes and certificates specified by
+.Fl Fl hash
+and
+.Fl Fl certificate.
+.It
+Generation of output
+.El
+
+The accumulated state is persistent; once an Owner GUID, Add or Delete
+operation, or hash type are specified, they need only be present again to
+change the operations that follow.
+.Sh OPTIONS
+.Bl -tag
+.It Fl i Ar file | Fl Fl infile Ar file
+Read EFI Security Database from
+.Ar file
+.It Fl g Ar guid | Fl Fl owner-guid Ar guid
+Use the specified GUID or symbolic refrence (i.e. {empty}) for forthcoming
+addition and removal operations
+.It Fl a | Fl Fl add | Fl r | Fl Fl remove
+Select
+.Ar add
+or
+.Ar remove
+for forthcoming operations
+.It Fl t Ar hash-type | Fl Fl hash-type Ar hash-type
+Select
+.Ar hash-type 
+for forthcoming addition and removal operations
+.Po
+default \fIsha256\fR
+.Pc
+
+Use hash-type \fIhelp\fR to list supported hash types.
+.It Fl h Ar hash | Fl Fl hash Ar hash
+Add or remove the specified hash
+.It Fl c Ar file | Fl Fl certificate Ar file
+Add or remove the specified certificate
+.It Fl d | Fl Fl dump
+Produce a hex dump of the output
+.It Fl A | Fl Fl annotate
+Annotate the hex dump produced by
+.Fl Fl dump
+.It Fl o Ar file | Fl Fl outfile Ar file
+Write EFI Security Database to
+.Ar file
+.It Fl L
+List the well known guids
+
+The output is tab delimited: GUID short_name desription
+.Sh EXAMPLES
+.Ss Dumping the current system's \fIDBX\fP database with annotations
+.Bd -literal -compact
+host:~$ \fBefisecdb -d -A -i /sys/firmware/efi/efivars/dbx-d719b2cb-3d3a-4596-a3bc-dad00e67656f.txt\fR
+00000000  26 16 c4 c1 4c 50 92 40  ac a9 41 f9 36 93 43 28  |&...LP.@..A.6.C(|  esl[0].signature_type = {sha256}
+00000010  60 00 00 00                                       |....|              esl[0].signature_list_size = 96
+00000014              00 00 00 00                               |....|          esl[0].signature_header_size = 0
+00000018                           30 00 00 00                      |0...|      esl[0].signature_size = 48
+0000001c                                                                        esl[0].signature_header (end:0x0000001c)
+0000001c                                       bd 9a fa 77              |...w|  esl[0].signature[0].owner = {microsoft}
+00000020  59 03 32 4d bd 60 28 f4  e7 8f 78 4b              |Y.2M.`(...xK|
+0000002c                                       fe cf b2 32              |...2|  esl[0].signature[0].data (end:0x0000004c)
+00000030  d1 2e 99 4b 6d 48 5d 2c  71 67 72 8a a5 52 59 84  |...KmH],qgr..RY.|
+00000040  ad 5c a6 1e 75 16 22 1f  07 9a 14 36              |.\..u."....6|
+0000004c                                       bd 9a fa 77              |...w|  esl[0].signature[1].owner = {microsoft}
+00000050  59 03 32 4d bd 60 28 f4  e7 8f 78 4b              |Y.2M.`(...xK|
+0000005c                                       fe 63 a8 4f              |.c.O|  esl[0].signature[1].data (end:0x0000007c)
+00000060  78 2c c9 d3 fc f2 cc f9  fc 11 fb d0 37 60 87 87  |x,..........7`..|
+00000070  58 d2 62 85 ed 12 66 9b  dc 6e 6d 01              |X.b...f..nm.|
+0000007c
+.Ed
+.Ss Building a new EFI Security Database for use as \fIKEK\fP, replacing one certificate.
+.Bd -literal -compact
+# Figure out the original cert... the easy way
+host:~$ \fBstrings KEK-* | grep microsoft.*crt\fR\p
+Dhttp://www.microsoft.com/pki/certs/MicCorThiParMarRoo_2010-10-05.crt0
+
+# Find it, because --export isn't implemented yet
+host:~$ \fBwget \e\p
+        --user-agent='Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko' \e\p
+        http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_2010-10-05.crt\fR\p
+--2020-06-04 20:41:27--  http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_2010-10-05.crt
+Resolving www.microsoft.com (www.microsoft.com)... 2600:141b:800:287::356e, 2600:141b:800:2a0::356e, 23.43.254.254
+Connecting to www.microsoft.com (www.microsoft.com)|2600:141b:800:287::356e|:80... connected.
+HTTP request sent, awaiting response... 200 OK
+Length: 1539 (1.5K) [application/octet-stream]
+Saving to: ‘MicCorThiParMarRoo_2010-10-05.crt’
+
+MicCorThiParMarRoo_ 100%[===================>]   1.50K  --.-KB/s    in 0s      
+
+2020-06-04 20:41:27 (177 MB/s) - ‘MicCorThiParMarRoo_2010-10-05.crt’ saved [1539/1539]
+
+# Pick a GUID-like object, any GUID-like object...
+host:~$ \fBuuidgen\fR
+aab3960c-501e-485e-ac59-62805970a3dd
+
+# Remove the old KEK entry and add a different one
+host:~$ \fBefisecdb -i KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c \e\p
+        -g {microsoft} -r -c MicCorThiParMarRoo_2010-10-05.crt \e\p
+        -g aab3960c-501e-485e-ac59-62805970a3dd -a -c pjkek.cer \e\p
+        -o newkek.bin\fR\p
+.Ed
+.Ss Searching the list of well-known GUIDs
+.Bd -literal -compact
+host:~$ \fBefisecdb -L | grep shim\fR\p
+{605dab50-e046-4300-abb6-3dd810dd8b23}	{shim}	shim
+.Ed
+.Sh STANDARDS
+.Rs
+.%A UEFI Specification Working Group
+.%B Unified Extensible Firmware Interface (UEFI) Specification Version 2.8
+.%I Unified Extensible Firmware Interface Forum
+.%D March 2019
+.%U https://uefi.org/specifications\ \&
+.Re
+.Sh SEE ALSO
+.Xr authvar 1 ,
+.Xr efikeygen 1 ,
+.Xr pesign 1
+.Sh AUTHORS
+.An Peter Jones
+.Sh BUGS
+.Nm
+is currently lacking several useful features:
+.Bl -bullet -compact
+.It
+positional exporting of certificates
+.It
+.Fl Fl dump
+and
+.Fl Fl annotate
+do not adjust the output width for the terminal
+.It
+certificates can't be specified for removal by their \fIToBeSigned\fR hash
+.El

src/Android.mk

@@ -46,9 +46,12 @@ LIBEFIVAR_SOURCES := \
 	lib.c \
 	vars.c
 
+LIBEFISEC_SOURCES := \
+	sec.c
+
 include $(LOCAL_PATH)/include/version.mk
 
-LOCAL_SRC_FILES := $(LIBEFIBOOT_SOURCES) $(LIBEFIVAR_SOURCES)
+LOCAL_SRC_FILES := $(LIBEFIBOOT_SOURCES) $(LIBEFIVAR_SOURCES) $(LIBEFISEC_SOURCES)
 LOCAL_CFLAGS := -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -std=gnu11 -DLIBEFIVAR_VERSION=$(VERSION) -Wno-missing-field-initializers
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/include
 LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_C_INCLUDES) $(LOCAL_C_INCLUDES)/efivar $(local-generated-sources-dir)

src/Makefile

@@ -5,26 +5,29 @@ include $(TOPDIR)/src/include/version.mk
 include $(TOPDIR)/src/include/rules.mk
 include $(TOPDIR)/src/include/defaults.mk
 
-LIBTARGETS=libefivar.so libefiboot.so
-STATICLIBTARGETS=libefivar.a libefiboot.a
-BINTARGETS=efivar
+LIBTARGETS=libefivar.so libefiboot.so libefisec.so
+STATICLIBTARGETS=libefivar.a libefiboot.a libefisec.a
+BINTARGETS=efivar efisecdb
 STATICBINTARGETS=efivar-static
-PCTARGETS=efivar.pc efiboot.pc
+PCTARGETS=efivar.pc efiboot.pc efisec.pc
 TARGETS=$(LIBTARGETS) $(BINTARGETS) $(PCTARGETS)
 STATICTARGETS=$(STATICLIBTARGETS) $(STATICBINTARGETS)
 
+LIBEFISEC_SOURCES = sec.c secdb.c esl-iter.c util.c
+LIBEFISEC_OBJECTS = $(patsubst %.c,%.o,$(LIBEFISEC_SOURCES))
 LIBEFIBOOT_SOURCES = crc32.c creator.c disk.c gpt.c loadopt.c path-helpers.c \
 		     linux.c $(sort $(wildcard linux-*.c))
 LIBEFIBOOT_OBJECTS = $(patsubst %.c,%.o,$(LIBEFIBOOT_SOURCES))
 LIBEFIVAR_SOURCES = crc32.c dp.c dp-acpi.c dp-hw.c dp-media.c dp-message.c \
 	efivarfs.c error.c export.c guid.c guids.S guid-symbols.c \
-	lib.c vars.c
+	lib.c vars.c time.c
 LIBEFIVAR_OBJECTS = $(patsubst %.S,%.o,$(patsubst %.c,%.o,$(LIBEFIVAR_SOURCES)))
 EFIVAR_SOURCES = efivar.c
 GENERATED_SOURCES = include/efivar/efivar-guids.h guid-symbols.c
-MAKEGUIDS_SOURCES = makeguids.c guid.c
-ALL_SOURCES=$(LIBEFIBOOT_SOURCES) $(LIBEFIVAR_SOURCES) $(MAKEGUIDS_SOURCES) \
-	$(sort $(wildcard include/efivar/*.h)) $(GENERATED_SOURCES) $(EFIVAR_SOURCES)
+MAKEGUIDS_SOURCES = makeguids.c guid.c util.c
+ALL_SOURCES=$(LIBEFISEC_SOURCES) $(LIBEFIBOOT_SOURCES) $(LIBEFIVAR_SOURCES) \
+	    $(MAKEGUIDS_SOURCES) $(GENERATED_SOURCES) $(EFIVAR_SOURCES) \
+	    $(sort $(wildcard include/efivar/*.h))
 
 $(call deps-of,$(ALL_SOURCES)) : | deps
 -include $(call deps-of,$(ALL_SOURCES))
@@ -59,6 +62,7 @@ makeguids : CFLAGS=$(HOST_CFLAGS)
 makeguids : LDFLAGS=$(HOST_LDFLAGS)
 makeguids : CCLDFLAGS=$(HOST_CCLDFLAGS)
 makeguids : $(MAKEGUIDS_SOURCES)
+makeguids : | makeguids.h
 
 guids.o : guids.S | guids.bin names.bin
 
@@ -86,6 +90,20 @@ libefiboot.so : | libefiboot.map libefivar.so
 libefiboot.so : LIBS=efivar
 libefiboot.so : MAP=libefiboot.map
 
+libefisec.a : $(patsubst %.o,%.static.o,$(LIBEFISEC_OBJECTS))
+
+libefisec.so : $(LIBEFISEC_OBJECTS)
+libefisec.so : | libefisec.map
+libefisec.so : MAP=libefisec.map
+
+efisecdb : efisecdb.c secdb-dump.c util.c guids.S | libefisec.so
+efisecdb : LIBS=efivar efisec dl
+
+efisecdb-static : efisecdb.c
+efisecdb-static : $(patsubst %.o,%.static.o,$(LIBEFISEC_OBJECTS) $(LIBEFIVAR_OBJECTS))
+efisecdb-static : | $(GENERATED_SOURCES)
+efisecdb-static : LIBS=efivar efisec dl
+
 deps : $(ALL_SOURCES)
 	@$(MAKE) -f $(SRCDIR)/include/deps.mk deps SOURCES="$(ALL_SOURCES)"
 
@@ -116,6 +134,7 @@ test : all
 .PHONY: test deps abiclean abixml
 .SECONDARY : libefivar.so.1.$(VERSION) libefivar.so.1
 .SECONDARY : libefiboot.so.1.$(VERSION) libefiboot.so.1
+.SECONDARY : libefisec.so.1.$(VERSION) libefisec.so.1
 .SECONDARY : include/efivar/efivar-guids.h guid-symbols.c
 .INTERMEDIATE : guids.bin names.bin
 .PRECIOUS : guid-symbols.o makeguids