Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mokutil for openSUSE:Factory checked in at 2026-11-04 19:42:41 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mokutil (Old) and /work/SRC/openSUSE:Factory/.mokutil.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mokutil" Wed Nov 4 19:42:41 2026 rev:35 rq:1394591 version:0.7.3 Changes: -------- --- /work/SRC/openSUSE:Factory/mokutil/mokutil.changes 2025-10-04 18:51:07.701472357 +0200 +++ /work/SRC/openSUSE:Factory/.mokutil.new.3759290/mokutil.changes 2026-11-04 19:42:48.321744417 +0100 @@ -1,0 +2,15 @@ +Tue Nov 3 03:21:54 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Update to 0.7.3 + + show help if no args or --help even on unsupported system + + remove unused int_to_b64() + + on --test-key, return non-zero if test key is not enrolled + + introduce --is-sb-enabled parameter + + return zero in case --test-key is enrolled + + Remove traditional des and md5 passwords + + man: fix typo "|- X" -> "| -X" + + PasswordCrypt: Fix an ABI issue + + Fix bash completion (bsc#1286920) +- Move the bash completion script to mokutil-bash-completion + +------------------------------------------------------------------- Old: ---- 0.7.2.tar.gz New: ---- 0.7.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mokutil.spec ++++++ --- /var/tmp/diff_new_pack.WO6LYd/_old 2026-11-04 19:42:49.415790212 +0100 +++ /var/tmp/diff_new_pack.WO6LYd/_new 2026-11-04 19:42:49.417790296 +0100 @@ -1,7 +1,7 @@ # # spec file for package mokutil # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,7 +17,7 @@ Name: mokutil -Version: 0.7.2 +Version: 0.7.3 Release: 0 Summary: Tools for manipulating machine owner keys License: GPL-3.0-only @@ -39,6 +39,16 @@ This program provides the means to enroll and erase the machine owner keys (MOK) stored in the database of shim. +%package bash-completion +Summary: Bash completion for mokutil +Requires: bash-completion +Requires: mokutil +Supplements: (mokutil and bash-completion) +BuildArch: noarch + +%description bash-completion +Bash shell completions for mokutil + %prep %setup -q %if 0%{?suse_version} <= 1500 @@ -57,6 +67,7 @@ %license COPYING %{_bindir}/mokutil %{_mandir}/man?/* -%dir %{_datadir}/bash-completion/completions/ + +%files bash-completion %{_datadir}/bash-completion/completions/mokutil ++++++ 0.7.2.tar.gz -> 0.7.3.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mokutil-0.7.2/.github/workflows/ci.yml new/mokutil-0.7.3/.github/workflows/ci.yml --- old/mokutil-0.7.2/.github/workflows/ci.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/mokutil-0.7.3/.github/workflows/ci.yml 2026-11-03 03:50:52.000000000 +0100 @@ -0,0 +1,52 @@ +name: CI + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + runs-on: ubuntu-latest + + # Run the job inside the container specified by the matrix + container: ${{ matrix.config.container }} + + strategy: + fail-fast: false # Don't cancel other jobs if one OS fails + matrix: + config: + - os_name: Ubuntu + container: ubuntu:latest + install_cmd: apt-get update && apt-get install -y git gcc make autoconf automake libtool pkg-config libefivar-dev libssl-dev libkeyutils-dev libcrypt-dev + + - os_name: Fedora + container: fedora:latest + install_cmd: dnf install -y git gcc make autoconf automake libtool pkgconfig efivar-devel openssl-devel keyutils-libs-devel libxcrypt-devel + + - os_name: openSUSE + container: opensuse/tumbleweed + install_cmd: zypper --non-interactive in git gcc make autoconf automake libtool pkgconfig gawk efivar-devel libopenssl-devel keyutils-devel libxcrypt-devel + + name: Build on ${{ matrix.config.os_name }} + + steps: + # We install dependencies first so that 'git' is available for the checkout step + - name: Install dependencies + run: ${{ matrix.config.install_cmd }} + + - name: Checkout code + uses: actions/checkout@v6 + + - name: Autogen + run: ./autogen.sh || autoreconf -ivf + + - name: Configure + run: ./configure + + - name: Build + run: make -j$(nproc) + + - name: Check + run: make check || echo "No tests defined" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mokutil-0.7.2/configure.ac new/mokutil-0.7.3/configure.ac --- old/mokutil-0.7.2/configure.ac 2024-03-19 09:45:06.000000000 +0100 +++ new/mokutil-0.7.3/configure.ac 2026-11-03 03:50:52.000000000 +0100 @@ -2,7 +2,7 @@ # Process this file with autoconf to produce a configure script. AC_PREREQ([2.68]) -AC_INIT([mokutil], [0.7.2], [[email protected]]) +AC_INIT([mokutil], [0.7.3], [[email protected]]) AM_INIT_AUTOMAKE([1.11 -Wno-portability tar-ustar dist-bzip2 no-dist-gzip]) AC_CONFIG_SRCDIR([src/mokutil.c]) AC_CONFIG_HEADERS([config.h]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mokutil-0.7.2/data/mokutil new/mokutil-0.7.3/data/mokutil --- old/mokutil-0.7.2/data/mokutil 2024-03-19 09:45:06.000000000 +0100 +++ new/mokutil-0.7.3/data/mokutil 2026-11-03 03:50:52.000000000 +0100 @@ -5,31 +5,81 @@ local cur=${COMP_WORDS[COMP_CWORD]} if [[ "$cur" == -* ]]; then - #COMPREPLY=( $( compgen -W "--help --list-enrolled --list-new --list-delete --import --delete --revoke-import --revoke-delete --export --password --clear-password --disable-validation --enable-validation --sb-state --test-key --reset --generate-hash --hash-file --root-pw --simple-hash" -- $cur ) ) - COMPREPLY=( $( compgen -W '$( _parse_help "$1" --long-help ) -h -l -N -D -i -d -x -p -c -t -f -g -P -s -X' -- "$cur" ) ) + COMPREPLY=( $( compgen -W " + --help + --version + --list-enrolled + --list-new + --list-delete + --import + --delete + --revoke-import + --revoke-delete + --export + --password + --clear-password + --disable-validation + --enable-validation + --sb-state + --is-sb-enabled + --test-key + --reset + --hash-file + --generate-hash + --root-pw + --ignore-db + --use-db + --mok + --mokx + --import-hash + --delete-hash + --set-verbosity + --set-fallback-verbosity + --set-fallback-noreboot + --trust-mok + --untrust-mok + --set-sbat-policy + --set-ssp-policy + --pk + --kek + --db + --dbx + --list-sbat-revocations + --sbat + --timeout + --ca-check + --ignore-keyring + --short + --all + -a -c -d -f -g -h -i -l -m -p -t -x -D -N -P -X -v + " -- "$cur" ) ) [[ $COMPREPLY == *= ]] && compopt -o nospace return 0 fi case "${COMP_WORDS[COMP_CWORD-1]}" in --import|-i|--delete|-d|--test-key|-t|--hash-file|-f) - _filedir + if declare -F _filedir >/dev/null; then + _filedir + else + COMPREPLY=( $( compgen -f -- "$cur" ) ) + fi return 0 ;; --import-hash|--delete-hash) COMPREPLY=( $( compgen -W "" ) ) return 0 ;; - --set-verbosity) - COMPREPLY=( $( compgen -W "true false") ) + --set-verbosity|--set-fallback-verbosity|--set-fallback-noreboot) + COMPREPLY=( $( compgen -W "true false" -- "$cur" ) ) return 0 ;; - --set-fallback-verbosity) - COMPREPLY=( $( compgen -W "true false") ) + --set-sbat-policy) + COMPREPLY=( $( compgen -W "latest automatic" -- "$cur" ) ) return 0 ;; - --set-fallback-noreboot) - COMPREPLY=( $( compgen -W "true false") ) + --set-ssp-policy) + COMPREPLY=( $( compgen -W "latest automatic delete" -- "$cur" ) ) return 0 ;; --generate-hash|-g) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mokutil-0.7.2/man/mokutil.1 new/mokutil-0.7.3/man/mokutil.1 --- old/mokutil-0.7.2/man/mokutil.1 2024-03-19 09:45:06.000000000 +0100 +++ new/mokutil-0.7.3/man/mokutil.1 2026-11-03 03:50:52.000000000 +0100 @@ -1,219 +1,341 @@ -.TH MOKUTIL 1 "Thu Jul 25 2013" +.TH MOKUTIL 1 "November 3, 2026" "0.7.3" "mokutil Manual" .SH NAME -mokutil \- utility to manipulate machine owner keys +mokutil \- utility to manipulate Machine Owner Keys (MOK) .SH SYNOPSIS -\fBmokutil\fR [--list-enrolled | -l] - ([--mokx | -X]) +\fBmokutil\fR [\fIoptions\fR] .br -\fBmokutil\fR [--list-new | -N] - ([--mokx | -X]) +\fBmokutil\fR [\fB--list-enrolled\fR | \fB-l\fR] [\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] [\fB--short\fR] [\fB--all\fR | \fB-a\fR] .br -\fBmokutil\fR [--list-delete | -D] - ([--mokx | -X]) +\fBmokutil\fR [\fB--list-new\fR | \fB-N\fR] [\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] [\fB--short\fR] .br -\fBmokutil\fR [--import \fIkeylist\fR| -i \fIkeylist\fR] - ([--hash-file \fIhashfile\fR | -f \fIhashfile\fR] | [--root-pw | -P] | - [--mokx | -X] | [--ca-check] | [--ignore-keyring]) +\fBmokutil\fR [\fB--list-delete\fR | \fB-D\fR] [\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] [\fB--short\fR] .br -\fBmokutil\fR [--delete \fIkeylist\fR | -d \fIkeylist\fR] - ([--hash-file \fIhashfile\fR | -f \fIhashfile\fR] | [--root-pw | -P] | - [--mokx |- X]) +\fBmokutil\fR [\fB--import\fR | \fB-i\fR] \fIkeylist\fR + ([\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] | [\fB--hash-file\fR | \fB-f\fR \fIhashfile\fR | \fB--root-pw\fR | \fB-P\fR] | + [\fB--ca-check\fR] | [\fB--ignore-keyring\fR]) .br -\fBmokutil\fR [--revoke-import] - ([--mokx | -X]) +\fBmokutil\fR [\fB--delete\fR | \fB-d\fR] \fIkeylist\fR + ([\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] | [\fB--hash-file\fR | \fB-f\fR \fIhashfile\fR | \fB--root-pw\fR | \fB-P\fR]) .br -\fBmokutil\fR [--revoke-delete] - ([--mokx | -X]) +\fBmokutil\fR [\fB--revoke-import\fR] [\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] .br -\fBmokutil\fR [--export | -x] +\fBmokutil\fR [\fB--revoke-delete\fR] [\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] .br -\fBmokutil\fR [--password | -p] - ([--hash-file \fIhashfile\fR | -f \fIhashfile\fR] | [--root-pw | -P]) +\fBmokutil\fR [\fB--export\fR | \fB-x\fR] [\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR | \fB--pk\fR | \fB--kek\fR | \fB--db\fR | \fB--dbx\fR] .br -\fBmokutil\fR [--clear-password | -c] +\fBmokutil\fR [\fB--password\fR | \fB-p\fR] ([\fB--hash-file\fR | \fB-f\fR \fIhashfile\fR] | [\fB--root-pw\fR | \fB-P\fR]) .br -\fBmokutil\fR [--disable-validation] +\fBmokutil\fR [\fB--clear-password\fR | \fB-c\fR] .br -\fBmokutil\fR [--enable-validation] +\fBmokutil\fR [\fB--disable-validation\fR] .br -\fBmokutil\fR [--sb-state] +\fBmokutil\fR [\fB--enable-validation\fR] .br -\fBmokutil\fR [--test-key \fIkeyfile\fR | -t \fIkeyfile\fR] - ([--mokx | -X] | [--ca-check] | [--ignore-keyring]) +\fBmokutil\fR [\fB--sb-state\fR] .br -\fBmokutil\fR [--reset] - ([--hash-file \fIhashfile\fR | -f \fIhashfile\fR] | [--root-pw | -P] | - [--mok | -X]) +\fBmokutil\fR [\fB--is-sb-enabled\fR] .br -\fBmokutil\fR [--generate-hash=\fIpassword\fR | -g\fIpassword\fR] +\fBmokutil\fR [\fB--test-key\fR | \fB-t\fR] \fIkeyfile\fR + ([\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] | [\fB--ca-check\fR] | [\fB--ignore-keyring\fR]) .br -\fBmokutil\fR [--ignore-db] +\fBmokutil\fR [\fB--reset\fR] + ([\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] | [\fB--hash-file\fR | \fB-f\fR \fIhashfile\fR | \fB--root-pw\fR | \fB-P\fR]) .br -\fBmokutil\fR [--use-db] +\fBmokutil\fR [\fB--generate-hash\fR[\fB=\fR\fIpassword\fR] | \fB-g\fR[\fIpassword\fR]] .br -\fBmokutil\fR [--import-hash \fIhash\fR] - ([--hash-file \fIhashfile\fR | -f \fIhashfile\fR] | [--root-pw | -P] | - [--mokx | -X]) +\fBmokutil\fR [\fB--ignore-db\fR] .br -\fBmokutil\fR [--delete-hash \fIhash\fR] - ([--hash-file \fIhashfile\fR | -f \fIhashfile\fR] | [--root-pw | -P] | - [--mokx | -X]) +\fBmokutil\fR [\fB--use-db\fR] .br -\fBmokutil\fR [--set-verbosity (\fItrue\fR | \fIfalse\fR)] +\fBmokutil\fR [\fB--import-hash\fR \fIhash\fR] + ([\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] | [\fB--hash-file\fR | \fB-f\fR \fIhashfile\fR | \fB--root-pw\fR | \fB-P\fR]) .br -\fBmokutil\fR [--set-fallback-verbosity (\fItrue\fR | \fIfalse\fR)] +\fBmokutil\fR [\fB--delete-hash\fR \fIhash\fR] + ([\fB--mok\fR | \fB-m\fR | \fB--mokx\fR | \fB-X\fR] | [\fB--hash-file\fR | \fB-f\fR \fIhashfile\fR | \fB--root-pw\fR | \fB-P\fR]) .br -\fBmokutil\fR [--set-fallback-noreboot (\fItrue\fR | \fIfalse\fR)] +\fBmokutil\fR [\fB--set-verbosity\fR (\fBtrue\fR | \fBfalse\fR)] .br -\fBmokutil\fR [--pk] +\fBmokutil\fR [\fB--set-fallback-verbosity\fR (\fBtrue\fR | \fBfalse\fR)] .br -\fBmokutil\fR [--kek] +\fBmokutil\fR [\fB--set-fallback-noreboot\fR (\fBtrue\fR | \fBfalse\fR)] .br -\fBmokutil\fR [--db] +\fBmokutil\fR [\fB--pk\fR] [\fB--short\fR] .br -\fBmokutil\fR [--dbx] +\fBmokutil\fR [\fB--kek\fR] [\fB--short\fR] .br -\fBmokutil\fR [--list-sbat-revocations] +\fBmokutil\fR [\fB--db\fR] [\fB--short\fR] .br -\fBmokutil\fR [--set-sbat-policy (\fIlatest\fR | \fIautomatic\fR | \fIdelete\fR)] +\fBmokutil\fR [\fB--dbx\fR] [\fB--short\fR] .br -\fBmokutil\fR [--timeout \fI-1,0..0x7fff\fR] +\fBmokutil\fR [\fB--list-sbat-revocations\fR | \fB--sbat\fR] .br -\fBmokutil\fR [--trust-mok] +\fBmokutil\fR [\fB--set-sbat-policy\fR (\fBlatest\fR | \fBautomatic\fR)] .br -\fBmokutil\fR [--untrust-mok] +\fBmokutil\fR [\fB--set-ssp-policy\fR (\fBlatest\fR | \fBautomatic\fR | \fBdelete\fR)] .br +\fBmokutil\fR [\fB--timeout\fR \fI-1,0..0x7fff\fR] +.br +\fBmokutil\fR [\fB--trust-mok\fR] +.br +\fBmokutil\fR [\fB--untrust-mok\fR] +.br +\fBmokutil\fR [\fB--help\fR | \fB-h\fR] +.br +\fBmokutil\fR [\fB--version\fR | \fB-v\fR] .SH DESCRIPTION -\fBmokutil\fR is a tool to import or delete the machines owner keys -(MOK) stored in the database of shim. +\fBmokutil\fR is a utility to import, delete, and manage Machine Owner Keys +(MOK) stored in the database of the \fBshim\fR EFI bootloader. + +UEFI Secure Boot uses built-in firmware key databases (like \fBdb\fR and \fBdbx\fR) +to verify the integrity of loaded EFI binaries. Machine Owner Keys (MOK) extend this trust +chain by allowing system owners to manage their own list of trusted certificates (\fBMokList\fR) +and forbidden certificates (\fBMokListX\fR) independently of the system's firmware. + +When an import or delete request is initiated using \fBmokutil\fR, the tool creates a pending request +by writing UEFI variables in NVRAM (such as \fBMokNew\fR or \fBMokDel\fR). Upon the subsequent system reboot, +the \fBshim\fR bootloader detects these variables and launches \fBMokManager\fR. \fBMokManager\fR runs +within the pre-boot environment, prompting the physical operator to confirm the request and enter the +configured MOK password, ensuring that key updates are authorized by a local user. .SH OPTIONS + +.SS Primary Commands .TP \fB-l, --list-enrolled\fR -List the keys the already stored in the database +List the certificates currently enrolled in the trusted database (\fBMokListRT\fR). +If \fB--mokx\fR or \fB-X\fR is specified, list the certificates in the forbidden database (\fBMokListXRT\fR) instead. +This list contains public keys and hashes used to validate or deny loading of bootloaders or kernels. .TP \fB-N, --list-new\fR -List the keys to be enrolled +List the keys queued in the pending enrollment request database (\fBMokNew\fR, or \fBMokXNew\fR if \fB--mokx\fR is active). +These keys are waiting for approval by the system owner in \fBMokManager\fR on the next reboot. .TP \fB-D, --list-delete\fR -List the keys to be deleted +List the keys queued in the pending deletion request database (\fBMokDel\fR, or \fBMokXDel\fR if \fB--mokx\fR is active). +These keys are waiting to be removed by the system owner in \fBMokManager\fR on the next reboot. .TP -\fB-i, --import\fR -Collect the following files and form an enrolling request to shim. The files must -be in DER format. -.TP -\fB-d, --delete\fR -Collect the following files and form a deleting request to shim. The files must be -in DER format. +\fB-i, --import\fR \fIkeylist\fR +Form an enrollment request to import one or more certificates specified in \fIkeylist\fR. +The keys must be provided as files in DER format. The action creates a pending \fBMokNew\fR (or \fBMokXNew\fR) +variable and requires configuring a MOK password for verification on reboot. +.TP +\fB-d, --delete\fR \fIkeylist\fR +Form a deletion request to remove one or more certificates specified in \fIkeylist\fR. +The keys must be provided as files in DER format. This creates a pending \fBMokDel\fR (or \fBMokXDel\fR) +variable and requires configuring a MOK password for verification on reboot. +.TP +\fB--import-hash\fR \fIhash\fR +Form an enrollment request for \fIhash\fR, given as a hexadecimal string on the command line. +SHA-224, SHA-256, SHA-384, and SHA-512 digests are recognized by their string length. +Note that this is the hash of a key or binary, not the password hash. +.TP +\fB--delete-hash\fR \fIhash\fR +Form a deletion request for \fIhash\fR, given as a hexadecimal string on the command line. +The same digest algorithms as \fB--import-hash\fR are accepted. .TP \fB--revoke-import\fR -Revoke the current import request (MokNew) +Revoke/cancel the current pending import request (\fBMokNew\fR or \fBMokXNew\fR). .TP \fB--revoke-delete\fR -Revoke the current delete request (MokDel) +Revoke/cancel the current pending delete request (\fBMokDel\fR or \fBMokXDel\fR). .TP \fB-x, --export\fR -Export the keys stored in MokListRT +Export the certificates stored in the targeted database to files in DER format in the current directory. +The default targets \fBMokListRT\fR. This can also target other databases if combined with options like +\fB--mokx\fR, \fB--pk\fR, \fB--kek\fR, \fB--db\fR, or \fB--dbx\fR. +.TP +\fB-t, --test-key\fR \fIkeyfile\fR +Test whether the specified DER-format key is already enrolled or blocked in the target databases, +or already present in a pending request. +Exits with status \fB0\fR if the key was found, and with status \fB1\fR if the key is not enrolled, +so the result can be tested from a script. .TP -\fB-p, --password\fR -Setup the password for MokManager (MokPW) -.TP -\fB-c, --clear-password\fR -Clear the password for MokManager (MokPW) +\fB--reset\fR +Issue a request to completely reset the target database (\fBMokList\fR, or \fBMokListX\fR if \fB--mokx\fR is specified). +This operation wipes all user-enrolled keys on the next reboot following user confirmation in \fBMokManager\fR. + +.SS Targeted Database & List Selection .TP -\fB--disable-validation\fR -Disable the validation process in shim +\fB-m, --mok\fR +Direct the command to target or manipulate the MOK list (\fBMokListRT\fR). This is the default target list. .TP -\fB--enable-validation\fR -Enable the validation process in shim +\fB-X, --mokx\fR +Direct the command to target or manipulate the MOK blacklist (\fBMokListXRT\fR) instead of the MOK list. + +.SS Certificate Filtering & Formatting .TP -\fB--sb-state\fR -Show SecureBoot State +\fB-a, --all\fR +When listing enrolled keys with \fB--list-enrolled\fR, list keys across all available signature databases +(\fBMokListRT\fR, \fBMokListXRT\fR, \fBPK\fR, \fBKEK\fR, \fBdb\fR, and \fBdbx\fR). .TP -\fB-t, --test-key\fR -Test if the key is enrolled or not +\fB--short\fR +Display key listings in a concise, single-line format instead of the default verbose certificate formatting. + +.SS Password Options .TP -\fB--reset\fR -Reset MOK list +\fB-p, --password\fR +Setup the password (\fBMokPW\fR) that \fBMokManager\fR will require to authorize the pending changes. +If neither \fB--hash-file\fR nor \fB--root-pw\fR is provided, the tool prompts interactively for the password. .TP -\fB--generate-hash\fR -Generate the password hash +\fB-c, --clear-password\fR +Clear the password for \fBMokManager\fR (\fBMokPW\fR). .TP -\fB--hash-file\fR -Use the password hash from a specific file +\fB-g\fR[\fIpassword\fR], \fB--generate-hash\fR[\fB=\fR\fIpassword\fR] +Generate and display a SHA-512 crypt password hash. If \fIpassword\fR is provided directly on the command line, +it generates the hash for it. If \fIpassword\fR is omitted, the utility prompts interactively for the password. +.TP +\fB-f, --hash-file\fR \fIhashfile\fR +Specify a file containing a pre-computed password hash. \fBmokutil\fR will use this hash instead of prompting. +This option is mutually exclusive with \fB--root-pw\fR. .TP \fB-P, --root-pw\fR -Use the root password hash from /etc/shadow +Instruct \fBmokutil\fR to use the root password hash from \fI/etc/shadow\fR. +This option is mutually exclusive with \fB--hash-file\fR. + +.SS Platform Verification Databases .TP -\fB--ignore-db\fR -Tell shim to not use the keys in db to verify EFI images +\fB--pk\fR +List the public keys or certificates enrolled in the Platform Key (\fBPK\fR) database. +The PK establishes the platform owner and controls access to the KEK database. .TP -\fB--use-db\fR -Tell shim to use the keys in db to verify EFI images (default) +\fB--kek\fR +List the keys enrolled in the Key Exchange Key (\fBKEK\fR) signature database. +Keys in KEK are used to write and authorize updates to the \fBdb\fR and \fBdbx\fR databases. .TP -\fB-X, --mokx\fR -Manipulate the MOK blacklist (MOKX) instead of the MOK list +\fB--db\fR +List the keys in the secure boot signature database (\fBdb\fR). +The \fBdb\fR contains certificates, keys, or hashes trusted to run in the Secure Boot environment. .TP -\fB--import-hash\fR -Create an enrolling request for the hash of a key in DER format. Note that -this is not the password hash. +\fB--dbx\fR +List the keys in the secure boot forbidden signature database (\fBdbx\fR). +The \fBdbx\fR blacklist contains forbidden or compromised signatures that are explicitly denied execution. + +.SS Verification and Bypass Controls .TP -\fB--delete-hash\fR -Create a deleting request for the hash of a key in DER format. Note that -this is not the password hash. +\fB--ca-check\fR +Check whether the Certificate Authority (CA) of the specified key is already enrolled or blocked +in the targeted databases. .TP -\fB--set-verbosity\fR -Set the SHIM_VERBOSE to make shim more or less verbose +\fB--ignore-keyring\fR +By default, \fBmokutil\fR checks if a key is already enrolled in the kernel's built-in trusted keys keyring. +Use this option to bypass the kernel keyring check and force enrollment into the MOK database. .TP -\fB--set-fallback-verbosity\fR -Set the FALLBACK_VERBOSE to make fallback more or less verbose +\fB--disable-validation\fR +Form a request to turn off the signature validation in \fBshim\fR, so that \fBshim\fR loads EFI images +without verifying their signatures. The request is stored in the \fBMokSB\fR variable and has to be +confirmed by the physical operator in \fBMokManager\fR on the next reboot. \fBmokutil\fR prompts for +the Secure Boot validation toggle password described in \fBNOTES\fR. .TP -\fB--set-fallback-noreboot\fR -Set the FB_NO_REBOOT to prevent fallback from automatically rebooting the system +\fB--enable-validation\fR +Form a request to turn the signature validation in \fBshim\fR back on. This uses the same \fBMokSB\fR +variable, password prompt and \fBMokManager\fR confirmation as \fB--disable-validation\fR. .TP -\fB--pk\fR -List the keys in the public Platform Key (PK) +\fB--ignore-db\fR +Tell \fBshim\fR not to use the keys in the system's firmware \fBdb\fR database to verify EFI images. .TP -\fB--kek\fR -List the keys in the Key Exchange Key Signature database (KEK) +\fB--use-db\fR +Tell \fBshim\fR to use the keys in the system's firmware \fBdb\fR database to verify EFI images. This is the default. + +.SS Secure Boot Advanced Targeting (SBAT) .TP -\fB--db\fR -List the keys in the secure boot signature store (db) +\fB--list-sbat-revocations, --sbat\fR +List the current revocations active in the Secure Boot Advanced Targeting (\fBSBAT\fR) store (\fBSbatLevelRT\fR). +SBAT provides metadata-based generation numbers for bootloader components to quickly revoke vulnerable binaries. +.TP +\fB--set-sbat-policy\fR (\fBlatest\fR | \fBautomatic\fR) +Set the \fBSbatPolicy\fR UEFI variable. This variable tells \fBshim\fR how to apply SBAT revocations: +.RS +.IP "\(bu" 2 +\fBlatest\fR: Enforce the latest SBAT revocations. +.IP "\(bu" 2 +\fBautomatic\fR: Enforce the previous generation of SBAT revocations (automatic). +.RE +.IP +If UEFI Secure Boot is disabled, \fBshim\fR automatically deletes the SBAT revocations. +.TP +\fB--set-ssp-policy\fR (\fBlatest\fR | \fBautomatic\fR | \fBdelete\fR) +Set the \fBSSPPolicy\fR UEFI variable. This tells \fBshim\fR how to manage non-native Windows \fBSkuSiPolicy\fR +revocations for managing bootmgr revocations. +.RS +.IP "\(bu" 2 +\fBlatest\fR: Enforce the latest Windows SkuSiPolicy. +.IP "\(bu" 2 +\fBautomatic\fR: Enforce the previous Windows SkuSiPolicy (automatic). +.IP "\(bu" 2 +\fBdelete\fR: Delete non-native revocations. This is non-persistent and allowed only when Secure Boot is disabled. +.RE + +.SS Shim and Fallback Environment Controls .TP -\fB--dbx\fR -List the keys in the secure boot blacklist signature store (dbx) +\fB--sb-state\fR +Display detailed Secure Boot status information on the system, showing whether Secure Boot is enabled or disabled. .TP -\fB--list-sbat-revocations\fR -List the entries in the Secure Boot Advanced Targeting store (SBAT) +\fB--is-sb-enabled\fR +Check whether Secure Boot is currently enabled. This prints the same status information as +\fB--sb-state\fR; the difference is the exit status, which is \fB0\fR when Secure Boot is enabled and +\fB1\fR when it is disabled or the platform is in Setup Mode, so the state can be tested from a script. +.TP +\fB--set-verbosity\fR (\fBtrue\fR | \fBfalse\fR) +Configure the \fBSHIM_VERBOSE\fR variable to make the \fBshim\fR bootloader verbose or quiet. +.TP +\fB--set-fallback-verbosity\fR (\fBtrue\fR | \fBfalse\fR) +Configure the \fBFALLBACK_VERBOSE\fR variable to make the \fBfallback\fR EFI application verbose or quiet. +.TP +\fB--set-fallback-noreboot\fR (\fBtrue\fR | \fBfalse\fR) +Configure the \fBFB_NO_REBOOT\fR variable. Setting this to true prevents the \fBfallback\fR application from +automatically rebooting the system. +.TP +\fB--timeout\fR \fIseconds\fR +Set the countdown timeout for the MOK prompt inside \fBMokManager\fR on reboot. +Accepts values between \fB0\fR and \fB0x7fff\fR (in seconds), or \fB-1\fR to wait indefinitely. +Out-of-range values are clamped rather than rejected: a value greater than \fB0x7fff\fR is stored as +\fB0x7fff\fR, and any negative value is stored as \fB-1\fR. +Setting the timeout to \fB10\fR deletes \fBMokTimeout\fR instead of storing it, since 10 seconds is +already the built-in default of \fBshim\fR. .TP -\fB--set-sbat-policy (\fIlatest\fR | \fIautomatic\fR)\fR -Set the SbatPolicy UEFI Variable to have shim apply either the latest -or the automatic SBAT revocations. If UEFI Secure Boot is disabled, then -shim will automatically delete SBAT revocations -.TP -\fB--set-ssp-policy (\fIlatest\fR | \fIautomatic\fR | \fIdelete\fR)\fR -Set the SspPolicy UEFI Variable to have shim apply either the latest -or the automatic Windows SkuSiPolicy to manage bootmgr revocations. Since -these are non-native revocations, shim will not automatically delete -them. If this is needed, spp-policy can be set to delete when Secure -Boot is disabled. The delete policy is non-persistent. +\fB--trust-mok\fR +Tell the kernel to trust keys within the MOK list in the kernel keyring. .TP -\fB--timeout\fR -Set the timeout for MOK prompt +\fB--untrust-mok\fR +Tell the kernel not to trust MOK list keys in the kernel keyring. + +.SS Information & Help .TP -\fB--ca-check\fR -Check if the CA of the given key is already enrolled or blocked in the key -databases. +\fB-h, --help\fR +Display a summary of usage, primary options, and supplementary options, and exit. .TP -\fB--ignore-keyring\fR -Ignore the kernel builtin trusted keys keyring check when enrolling a key into MokList +\fB-v, --version\fR +Display the program version and exit. + +.SH EXIT STATUS .TP -\fB--trust-mok\fR -Trust MOK keys within the kernel keyring +\fB0\fR +Success. .TP -\fB--untrust-mok\fR -Do not trust MOK keys within the kernel keyring +\fB1\fR +EFI variables are not supported on the system. +This status is also returned by \fB--is-sb-enabled\fR when Secure Boot is disabled or the platform is +in Setup Mode, and by \fB--test-key\fR when the key is \fBnot\fR enrolled in the target database. +.TP +\fB255\fR +A command failed. For example, the system does not support Secure Boot, the given key file could not +be read, or an EFI variable could not be read or written. + +.SH NOTES +\fBmokutil\fR uses two distinct passwords: .TP +\fBMOK password\fR +Used to authorize key enrollment and deletion requests (\fB--import\fR, \fB--delete\fR, \fB--reset\fR, \fB--password\fR). +The password is stored as a crypt(3) hash (\fBMokPW\fR). +Allowed length: \fB1\fR to \fB256\fR characters. +.TP +\fBSecure Boot validation toggle password\fR +Used to authorize \fB--disable-validation\fR and \fB--enable-validation\fR requests. +The password is stored in plaintext in NVRAM. MokManager will pick a few characters as the security prompt. +Allowed length: \fB8\fR to \fB16\fR characters. + +Pending enrollment or deletion requests can only be handled on the next system reboot before any operating system +is booted. The operator must have physical access to the system to complete the actions via \fBMokManager\fR. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mokutil-0.7.2/src/mokutil.c new/mokutil-0.7.3/src/mokutil.c --- old/mokutil-0.7.2/src/mokutil.c 2024-03-19 09:45:06.000000000 +0100 +++ new/mokutil-0.7.3/src/mokutil.c 2026-11-03 03:50:52.000000000 +0100 @@ -89,6 +89,7 @@ #define UNTRUST_MOK (1 << 28) #define SET_SBAT (1 << 29) #define SET_SSP (1 << 30) +#define IS_SB_ENABLED (1 << 31) #define DEFAULT_CRYPT_METHOD SHA512_BASED #define DEFAULT_SALT_SIZE SHA512_SALT_MAX @@ -116,11 +117,12 @@ printf ("\n"); printf ("Options:\n"); printf (" --help, -h\t\t\t\tShow help\n"); + printf (" --version, -v\t\t\t\tShow the version\n"); printf (" --list-enrolled, -l\t\t\tList the enrolled keys\n"); printf (" --list-new, -N\t\t\tList the keys to be enrolled\n"); printf (" --list-delete, -D\t\t\tList the keys to be deleted\n"); printf (" --import, -i <der file...>\t\tImport keys\n"); - printf (" --delete, -D <der file...>\t\tDelete specific keys\n"); + printf (" --delete, -d <der file...>\t\tDelete specific keys\n"); printf (" --revoke-import\t\t\tRevoke the import request\n"); printf (" --revoke-delete\t\t\tRevoke the delete request\n"); printf (" --export, -x\t\t\t\tExport keys to files\n"); @@ -129,6 +131,7 @@ printf (" --disable-validation\t\t\tDisable signature validation\n"); printf (" --enable-validation\t\t\tEnable signature validation\n"); printf (" --sb-state\t\t\t\tShow SecureBoot State\n"); + printf (" --is-sb-enabled\t\t\tIndicates if SecureBoot is enabled or not\n"); printf (" --test-key, -t <der file>\t\tTest if the key is enrolled or not\n"); printf (" --reset\t\t\t\tReset MOK list\n"); printf (" --generate-hash[=password], -g\tGenerate the password hash\n"); @@ -152,9 +155,9 @@ printf (" --db\t\t\t\t\tList the keys in db\n"); printf (" --dbx\t\t\t\t\tList the keys in dbx\n"); printf (" --timeout <-1,0..0x7fff>\t\tSet the timeout for MOK prompt\n"); - printf (" --list-sbat-revocations\t\tList the entries in SBAT\n"); + printf (" --list-sbat-revocations, --sbat\tList the entries in SBAT\n"); printf ("\n"); - printf ("Supplimentary Options:\n"); + printf ("Supplementary Options:\n"); printf (" --hash-file, -f <hash file>\t\tUse the specific password hash\n"); printf (" --root-pw, -P\t\t\t\tUse the root password\n"); printf (" --mok, -m\t\t\t\tManipulate the MOK list\n"); @@ -493,6 +496,14 @@ fprintf (stderr, "Failed to get root password hash\n"); goto error; } + switch (pw_crypt.method) { + case SHA256_BASED: + case SHA512_BASED: + break; + default: + fprintf (stderr, "root password uses unsupported algorithm\n"); + goto error; + } } else { if (get_password (&password, &pw_len, PASSWORD_MIN, PASSWORD_MAX) < 0) { fprintf (stderr, "Abort\n"); @@ -1400,7 +1411,7 @@ } static int -sb_state () +sb_state_internal () { uint8_t *data = NULL; size_t data_size; @@ -1408,6 +1419,7 @@ int32_t secureboot = -1; int32_t setupmode = -1; int32_t moksbstate = -1; + int ret = 0; if (efi_get_variable (efi_guid_global, "SecureBoot", &data, &data_size, &attributes) < 0) { @@ -1453,17 +1465,34 @@ if (secureboot == 1 && setupmode == 0) { printf ("SecureBoot enabled\n"); + ret = 0; if (moksbstate == 1) printf ("SecureBoot validation is disabled in shim\n"); } else if (secureboot == 0 || setupmode == 1) { printf ("SecureBoot disabled\n"); + ret = 1; if (setupmode == 1) printf ("Platform is in Setup Mode\n"); } else { printf ("Cannot determine secure boot state.\n"); } - return 0; + return ret; +} + +static int +sb_state () +{ + int ret = sb_state_internal (); + + /* in this case, ignore the ret value except on failure */ + return (ret < 0)? ret: 0; +} + +static int +is_sb_enabled () +{ + return sb_state_internal (); } static inline int @@ -1567,10 +1596,10 @@ if (is_valid_request (&efi_guid_x509_cert, key, read_size, req)) { printf ("%s is not enrolled\n", key_file); - ret = 0; + ret = 1; } else { print_skip_message (key_file, key, read_size, req); - ret = 1; + ret = 0; } error: @@ -1855,6 +1884,7 @@ {"disable-validation", no_argument, 0, 0 }, {"enable-validation", no_argument, 0, 0 }, {"sb-state", no_argument, 0, 0 }, + {"is-sb-enabled", no_argument, 0, 0 }, {"test-key", required_argument, 0, 't'}, {"reset", no_argument, 0, 0 }, {"hash-file", required_argument, 0, 'f'}, @@ -1908,6 +1938,8 @@ command |= ENABLE_VALIDATION; } else if (strcmp (option, "sb-state") == 0) { command |= SB_STATE; + } else if (strcmp (option, "is-sb-enabled") == 0) { + command |= IS_SB_ENABLED; } else if (strcmp (option, "reset") == 0) { command |= RESET; } else if (strcmp (option, "ignore-db") == 0) { @@ -2156,14 +2188,25 @@ if (pw_hash_file && use_root_pw) command |= HELP; - if (!(command & HELP) && !efi_variables_supported ()) { - fprintf (stderr, "EFI variables are not supported on this system\n"); - exit (1); - } if (db_name != MOK_LIST_RT && !(command & ~MOKX)) command |= LIST_ENROLLED; + /* no matter if mokutil is supported (EFI) or not (BIOS) in the system, print + the help menu if no command line arguments provided or explicit help + requested */ + if (!command || (command & HELP)) { + print_help (); + ret = 0; + goto out; + } + + /* check if EFI variable is supported on the system */ + if (!efi_variables_supported ()) { + fprintf (stderr, "EFI variables are not supported on this system\n"); + exit (1); + } + sb_check = !(command & HELP || command & TEST_KEY || command & VERBOSITY || command & TIMEOUT || command & FB_VERBOSITY || command & FB_NOREBOOT); @@ -2247,6 +2290,9 @@ case SB_STATE: ret = sb_state (); break; + case IS_SB_ENABLED: + ret = is_sb_enabled (); + break; case TEST_KEY: ret = test_key (ENROLL_MOK, key_file); break; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mokutil-0.7.2/src/password-crypt.c new/mokutil-0.7.3/src/password-crypt.c --- old/mokutil-0.7.2/src/password-crypt.c 2024-03-19 09:45:06.000000000 +0100 +++ new/mokutil-0.7.3/src/password-crypt.c 2026-11-03 03:50:52.000000000 +0100 @@ -33,7 +33,6 @@ #include <sys/time.h> #include <sys/types.h> #include <unistd.h> -#include <openssl/md5.h> #include <openssl/sha.h> #include "password-crypt.h" @@ -46,11 +45,6 @@ #define SHA256_DEFAULT_ROUNDS 5000 #define SHA512_DEFAULT_ROUNDS 5000 -static const char b64t[64] = -"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; - -static const char md5_prefix[] = "$1$"; - static const char sha256_prefix[] = "$5$"; static const char sha512_prefix[] = "$6$"; @@ -60,7 +54,6 @@ static const char sha_rounds_prefix[] = "rounds="; -static int restore_md5_array (const char *string, uint8_t *hash); static int restore_sha256_array (const char *string, uint8_t *hash); static int restore_sha512_array (const char *string, uint8_t *hash); @@ -81,17 +74,15 @@ uint16_t get_pw_salt_size (const HashMethod method) { switch (method) { - case TRADITIONAL_DES: - return T_DES_SALT_MAX; - case EXTEND_BSDI_DES: - return E_BSI_DES_SALT_MAX; - case MD5_BASED: - return MD5_SALT_MAX; case SHA256_BASED: case SHA512_BASED: return gen_salt_size (8, 16); case BLOWFISH_BASED: return BLOWFISH_SALT_MAX; + case TRADITIONAL_DES: + case EXTEND_BSDI_DES: + case MD5_BASED: + return -1; } return -1; @@ -101,18 +92,16 @@ get_pw_hash_size (const HashMethod method) { switch (method) { - case TRADITIONAL_DES: - return TRAD_DES_HASH_SIZE; - case EXTEND_BSDI_DES: - return BSDI_DES_HASH_SIZE; - case MD5_BASED: - return MD5_DIGEST_LENGTH; case SHA256_BASED: return SHA256_DIGEST_LENGTH; case SHA512_BASED: return SHA512_DIGEST_LENGTH; case BLOWFISH_BASED: return BLOWFISH_HASH_SIZE; + case TRADITIONAL_DES: + case EXTEND_BSDI_DES: + case MD5_BASED: + return -1; } return -1; @@ -122,71 +111,22 @@ get_crypt_prefix (const HashMethod method) { switch (method) { - case TRADITIONAL_DES: - return ""; /* per "man crypt" */ - case EXTEND_BSDI_DES: - return "_"; /* per "man crypt" */ - case MD5_BASED: - return "$1$"; case SHA256_BASED: return "$5$"; case SHA512_BASED: return "$6$"; case BLOWFISH_BASED: return "$2y$10$"; /* FIXME change the count */ + case TRADITIONAL_DES: + case EXTEND_BSDI_DES: + case MD5_BASED: + return NULL; } return NULL; } static int -decode_trad_des_pass (const char *string, pw_crypt_t *pw_crypt) -{ - /* Expected string: [./0-9A-Za-z]{13} */ - pw_crypt->iter_count = 25; - pw_crypt->salt_size = 2; - memcpy (pw_crypt->salt, string, 2); - pw_crypt->salt[2] = '\0'; - memcpy (pw_crypt->hash, string, TRAD_DES_HASH_SIZE); - pw_crypt->hash[TRAD_DES_HASH_SIZE] = '\0'; - - return 0; -} - -static int -decode_md5_pass (const char *string, pw_crypt_t *pw_crypt) -{ - /* Expected string: [./0-9A-Za-z]{1,8}\$[./0-9A-Za-z]{22} */ - char *tmp, *ptr = (char *)string; - char b64_hash[MD5_B64_LENGTH + 1]; - int count = 0; - - pw_crypt->iter_count = 1000; - - /* get salt */ - for (tmp = ptr; *tmp != '$'; tmp++) { - if (*tmp == '\0') - return -1; - count++; - } - count = MIN(count, MD5_SALT_MAX); - memcpy (pw_crypt->salt, ptr, count); - pw_crypt->salt_size = count; - ptr = tmp + 1; - - /* get hash */ - if (strlen(ptr) != MD5_B64_LENGTH) - return -1; - memcpy (b64_hash, ptr, MD5_B64_LENGTH); - b64_hash[MD5_B64_LENGTH] = '\0'; - - if (restore_md5_array (b64_hash, pw_crypt->hash) < 0) - return -1; - - return 0; -} - -static int decode_sha256_pass (const char *string, pw_crypt_t *pw_crypt) { /* Expected string: (rounds=[0-9]{1,9}\$)?([./0-9A-Za-z]{1,16})?\$[./0-9A-Za-z]{43} */ @@ -327,11 +267,6 @@ if (!pw_crypt) return -1; - if (strncmp (crypt_pass, md5_prefix, 3) == 0) { - pw_crypt->method = MD5_BASED; - return decode_md5_pass (crypt_pass + strlen (md5_prefix), pw_crypt); - } - if (strncmp (crypt_pass, sha256_prefix, 3) == 0) { pw_crypt->method = SHA256_BASED; return decode_sha256_pass (crypt_pass + strlen (sha256_prefix), pw_crypt); @@ -349,20 +284,9 @@ return decode_blowfish_pass (crypt_pass, pw_crypt); } - if (strlen (crypt_pass) == TRAD_DES_HASH_SIZE) { - pw_crypt->method = TRADITIONAL_DES; - return decode_trad_des_pass (crypt_pass, pw_crypt); - } - return -1; } -char -int_to_b64 (const int i) -{ - return b64t[i & 0x3f]; -} - int b64_to_int (const char c) { @@ -404,42 +328,6 @@ return 0; } - -static int -restore_md5_array (const char *string, uint8_t *hash) -{ - uint32_t tmp = 0; - int value1, value2; - - if (strlen (string) != MD5_B64_LENGTH) - return -1; - - if (split_24bit (string, hash, 0, 4, 0, 6, 12) < 0) - return -1; - - if (split_24bit (string, hash, 4, 4, 1, 7, 13) < 0) - return -1; - - if (split_24bit (string, hash, 8, 4, 2, 8, 14) < 0) - return -1; - - if (split_24bit (string, hash, 12, 4, 3, 9, 15) < 0) - return -1; - - if (split_24bit (string, hash, 16, 4, 4, 10, 5) < 0) - return -1; - - value1 = b64_to_int (string[21]); - if (value1 < 0) - return -1; - value2 = b64_to_int (string[20]); - if (value2 < 0) - return -1; - tmp = (value1 << 6) | value2; - hash[11] = (uint8_t)tmp; - - return 0; -} static int restore_sha256_array (const char *string, uint8_t *hash) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mokutil-0.7.2/src/password-crypt.h new/mokutil-0.7.3/src/password-crypt.h --- old/mokutil-0.7.2/src/password-crypt.h 2024-03-19 09:45:06.000000000 +0100 +++ new/mokutil-0.7.3/src/password-crypt.h 2026-11-03 03:50:52.000000000 +0100 @@ -34,17 +34,19 @@ #include <stdint.h> /* The max salt size (in characters [./0-9A-Za-z]) */ -#define T_DES_SALT_MAX 2 -#define E_BSI_DES_SALT_MAX 4 -#define MD5_SALT_MAX 8 #define SHA256_SALT_MAX 16 #define SHA512_SALT_MAX 16 #define BLOWFISH_SALT_MAX 22 +/* + * These numeric values are stored in the MokAuth EFI variable and + * consumed by MokManager. These need to be in sync with what's in + * MokManager code. + */ typedef enum { - TRADITIONAL_DES = 0, - EXTEND_BSDI_DES, - MD5_BASED, + TRADITIONAL_DES = 0, /* unsupported, kept for ABI compatibility*/ + EXTEND_BSDI_DES, /* unsupported, kept for ABI compatibility*/ + MD5_BASED, /* unsupported, kept for ABI compatibility*/ SHA256_BASED, SHA512_BASED, BLOWFISH_BASED @@ -60,7 +62,6 @@ #define PASSWORD_CRYPT_SIZE sizeof(pw_crypt_t) -#define MD5_B64_LENGTH 22 #define SHA256_B64_LENGTH 43 #define SHA512_B64_LENGTH 86 @@ -68,7 +69,6 @@ int get_pw_hash_size (const HashMethod method); const char *get_crypt_prefix (const HashMethod method); int decode_pass (const char *crypt_pass, pw_crypt_t *pw_crypt); -char int_to_b64 (const int i); int b64_to_int (const char c); #endif /* __PASSWORD_CRYPT_H__ */
