Re: [PATCH v2] certs: Add EFI_CERT_X509_GUID support for dbx entries

2020-09-14 Thread Jarkko Sakkinen
On Mon, Sep 14, 2020 at 09:01:34PM +0300, Jarkko Sakkinen wrote: > On Wed, Sep 09, 2020 at 01:27:36PM -0400, Eric Snowberg wrote: > > The Secure Boot Forbidden Signature Database, dbx, contains a list of now > > revoked signatures and keys previously approved to boot with UEFI Secure > > Boot enabl

Re: [PATCH v2] certs: Add EFI_CERT_X509_GUID support for dbx entries

2020-09-09 Thread Eric Snowberg
> On Sep 9, 2020, at 11:40 AM, Randy Dunlap wrote: > > On 9/9/20 10:27 AM, Eric Snowberg wrote: >> diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h >> index 38ec7f5f9041..d8f2e0fdfbf4 100644 >> --- a/include/crypto/pkcs7.h >> +++ b/include/crypto/pkcs7.h >> @@ -26,11 +26,19 @@ exter

Re: [PATCH v2] certs: Add EFI_CERT_X509_GUID support for dbx entries

2020-09-09 Thread Randy Dunlap
On 9/9/20 10:27 AM, Eric Snowberg wrote: > diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h > index 38ec7f5f9041..d8f2e0fdfbf4 100644 > --- a/include/crypto/pkcs7.h > +++ b/include/crypto/pkcs7.h > @@ -26,11 +26,19 @@ extern int pkcs7_get_content_data(const struct > pkcs7_message *pkcs

[PATCH v2] certs: Add EFI_CERT_X509_GUID support for dbx entries

2020-09-09 Thread Eric Snowberg
The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA256_GUID, EFI_CERT_SHA256_GUID, and EFI_CERT_X509_GUID entries. Currentl