Re: [RFC PATCH] efi_loader: fix uefi secure boot with intermediate certs

2022-02-19 Thread Ilias Apalodimas
On Sat, Feb 19, 2022 at 10:47:16AM +0100, Heinrich Schuchardt wrote: > On 2/14/22 10:14, Ilias Apalodimas wrote: > > The general rule of accepting or rejecting an image is > > 1. Is the sha256 of the image in dbx > > 2. Is the image signed with a certificate that's found in db and > > not

Re: [RFC PATCH] efi_loader: fix uefi secure boot with intermediate certs

2022-02-19 Thread Heinrich Schuchardt
On 2/14/22 10:14, Ilias Apalodimas wrote: The general rule of accepting or rejecting an image is 1. Is the sha256 of the image in dbx 2. Is the image signed with a certificate that's found in db and not in dbx 3. The image carries a cert which is signed by a cert in db (and not in

Re: [RFC PATCH] efi_loader: fix uefi secure boot with intermediate certs

2022-02-14 Thread Ilias Apalodimas
On Mon, Feb 14, 2022 at 11:32:53AM +0100, Heinrich Schuchardt wrote: > On 2/14/22 10:14, Ilias Apalodimas wrote: > > The general rule of accepting or rejecting an image is > > 1. Is the sha256 of the image in dbx > > 2. Is the image signed with a certificate that's found in db and > > not

Re: [RFC PATCH] efi_loader: fix uefi secure boot with intermediate certs

2022-02-14 Thread Heinrich Schuchardt
On 2/14/22 10:14, Ilias Apalodimas wrote: The general rule of accepting or rejecting an image is 1. Is the sha256 of the image in dbx 2. Is the image signed with a certificate that's found in db and not in dbx 3. The image carries a cert which is signed by a cert in db (and not in