Linux gets the current attributes and uses that as the default when
writing or appending. When appending Linux automatically adds
the EFI_VARIABLE_APPEND_WRITE attribute. Linux requires the data
to come from a file. Change the type of attrib to uint32_t. Allow
the attribute to come from the command line. When appending,
EFI_VARIABLE_APPEND_WRITE is added to the command line specified
attribute option.
Details
Details
- Reviewers
imp
Tested updates via append to secure variables with signed updates.
Tested updates via write. Both testing was done without specifying
an attribute and with. Compared that the same command with -f worked
on Linux and FreeBSD. Testing that FreeBSD still worked when reading
from stdin.
Diff Detail
Diff Detail
- Repository
- rS FreeBSD src repository - subversion
- Lint
Lint Passed - Unit
No Test Coverage - Build Status
Buildable 5647 Build 5927: arc lint + arc unit
Event Timeline
Comment Actions
See inline. Basically I like this, but there's some issues.
| usr.sbin/efivar/efivar.c | ||
|---|---|---|
| 67 | I don't think this should be done. Also, you're diffing against an old version. | |
| 131 | This is not needed. efi_append_variable already does this: return efi_set_variable(guid, name, data, data_size,
attributes | EFI_VARIABLE_APPEND_WRITE, 0); | |
| 157–158 | You're allowed to set a variable that's not been set yet. This is incorrect. | |
| 159–160 | And this is wrong if it was never set. The default should still be 0x7. | |
| 322–323 | This is already in -current. | |
Comment Actions
Update to address comments so that writing a new variable works.
Use the sane attribute default and if the default is being used,
check for the old attribute file and use that. This could cause
an issue if the user tried to over ride the attribute but it matched
the sane default. This is probably low risk.
With this change I can delete the secure boot db keys via an authenticated
null db file. I can write a new db via an authenticated update passing
in -t 0x27. Authenticated appends also work (with -t 0x67 if it is the
first update).
Also various bases for the -t parameter.
This diverges from Linux but makes it more usable.