OcBootManagementLib: Add AppleSecureBoot support on EFI files
#include <Library/OcDebugLogLib.h>
#include <Library/DevicePathLib.h>
#include <Library/MemoryAllocationLib.h>
+#include <Library/OcAppleSecureBootLib.h>
#include <Library/OcBootManagementLib.h>
#include <Library/OcDevicePathLib.h>
#include <Library/OcFileLib.h>
@@ -159,6 +160,7 @@ InternalEfiLoadImage (
OUT EFI_HANDLE *ImageHandle
)
{
+ EFI_STATUS SecureBootStatus;
EFI_STATUS Status;
VOID *AllocatedBuffer;
UINT32 RealSize;
@@ -196,6 +198,27 @@ InternalEfiLoadImage (
}
}
+ if (DevicePath != NULL && SourceBuffer != NULL) {
+ SecureBootStatus = OcAppleSecureBootVerify (
+ DevicePath,
+ SourceBuffer,
+ SourceSize
+ );
+ } else {
+ SecureBootStatus = EFI_UNSUPPORTED;
+ }
+
+ //
+ // A security violation means we should just die.
+ //
+ if (SecureBootStatus == EFI_SECURITY_VIOLATION) {
+ DEBUG ((
+ DEBUG_WARN,
+ "OCB: Apple Secure Boot prohibits this boot entry, enforcing!\n"
+ ));
+ return EFI_SECURITY_VIOLATION;
+ }
+
if (SourceBuffer != NULL) {
RealSize = (UINT32) SourceSize;
#ifdef MDE_CPU_IA32
@@ -211,6 +234,12 @@ InternalEfiLoadImage (
}
}
+ if (SecureBootStatus == EFI_SUCCESS) {
+ //
+ // TODO: Here we should use a custom COFF loader!
+ //
+ }
+
Status = mOriginalEfiLoadImage (
BootPolicy,
ParentImageHandle,
