diff options
| author | Michael Brown | 2023-05-22 15:11:22 +0200 |
|---|---|---|
| committer | Michael Brown | 2023-05-22 16:37:11 +0200 |
| commit | 28184b7c22ca2297bd5c0ad9d333bc8620d38915 (patch) | |
| tree | 916e215eb19846c47dedcbdca4f0057c28f8690d /src/include/ipxe/errfile.h | |
| parent | [efi] Add definitions for the UEFI shim lock protocol (diff) | |
| download | ipxe-28184b7c22ca2297bd5c0ad9d333bc8620d38915.tar.gz ipxe-28184b7c22ca2297bd5c0ad9d333bc8620d38915.tar.xz ipxe-28184b7c22ca2297bd5c0ad9d333bc8620d38915.zip | |
[efi] Add support for executing images via a shim
Add support for using a shim as a helper to execute an EFI image.
When a shim has been specified via shim(), the shim image will be
passed to LoadImage() instead of the selected EFI image and the
command line will be prepended with the name of the selected EFI
image. The selected EFI image will be accessible to the shim via the
virtual filesystem as a hidden file.
Reduce the Secure Boot attack surface by removing, where possible, the
spurious requirement for a third party second stage loader binary such
as GRUB to be used solely in order to call the "shim lock protocol"
entry point.
Do not install the EFI PXE APIs when using a shim, since if shim finds
EFI_PXE_BASE_CODE_PROTOCOL on the loaded image's device handle then it
will attempt to download files afresh instead of using the files
already downloaded by iPXE and exposed via the EFI_SIMPLE_FILE_SYSTEM
protocol. (Experience shows that there is no point in trying to get a
fix for this upstreamed into shim.)
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/include/ipxe/errfile.h')
| -rw-r--r-- | src/include/ipxe/errfile.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h index 235611a5..daa038c5 100644 --- a/src/include/ipxe/errfile.h +++ b/src/include/ipxe/errfile.h @@ -405,6 +405,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define ERRFILE_dhe ( ERRFILE_OTHER | 0x005a0000 ) #define ERRFILE_efi_cmdline ( ERRFILE_OTHER | 0x005b0000 ) #define ERRFILE_efi_rng ( ERRFILE_OTHER | 0x005c0000 ) +#define ERRFILE_efi_shim ( ERRFILE_OTHER | 0x005d0000 ) /** @} */ |