david/ipxe
david
/
ipxe
Archived
1
0
Fork 0
Code

[build] Exclude selected directories from Secure Boot builds 

When submitting binaries for UEFI Secure Boot signing, certain
known-dubious subsystems (such as 802.11 and NFS) must be excluded
from the build.  Mark the directories containing these subsystems as
insecure, and allow the build target to include an explicit "security
flag" (a literal "-sb" appended to the build platform) to exclude
these source directories from the build process.

For example:

  make bin-x86_64-efi-sb/ipxe.efi

will build iPXE with all code from the 802.11 and NFS subsystems
excluded from the build.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown 2017-09-18 13:32:39 +01:00
parent d46c53cfc6
commit 7428ab7258
2 changed files with 34 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/Makefile
View File

@ -62,7 +62,7 @@ QEMUIMG := qemu-img
SRCDIRS := SRCDIRS :=
SRCDIRS += libgcc SRCDIRS += libgcc
SRCDIRS += core SRCDIRS += core
SRCDIRS += net net/oncrpc net/tcp net/udp net/infiniband net/80211 SRCDIRS += net net/tcp net/udp net/infiniband
SRCDIRS += image SRCDIRS += image
SRCDIRS += drivers/bus SRCDIRS += drivers/bus
SRCDIRS += drivers/net SRCDIRS += drivers/net
@ -71,10 +71,6 @@ SRCDIRS += drivers/net/e1000e
SRCDIRS += drivers/net/igb SRCDIRS += drivers/net/igb
SRCDIRS += drivers/net/igbvf SRCDIRS += drivers/net/igbvf
SRCDIRS += drivers/net/phantom SRCDIRS += drivers/net/phantom
SRCDIRS += drivers/net/rtl818x
SRCDIRS += drivers/net/ath
SRCDIRS += drivers/net/ath/ath5k
SRCDIRS += drivers/net/ath/ath9k
SRCDIRS += drivers/net/vxge SRCDIRS += drivers/net/vxge
SRCDIRS += drivers/net/efi SRCDIRS += drivers/net/efi
SRCDIRS += drivers/net/tg3 SRCDIRS += drivers/net/tg3
@ -105,6 +101,16 @@ SRCDIRS += hci/keymap
SRCDIRS += usr SRCDIRS += usr
SRCDIRS += config SRCDIRS += config
# These directories contain code that is not eligible for UEFI Secure
# Boot signing.
#
SRCDIRS_INSEC += net/oncrpc
SRCDIRS_INSEC += net/80211
SRCDIRS_INSEC += drivers/net/rtl818x
SRCDIRS_INSEC += drivers/net/ath
SRCDIRS_INSEC += drivers/net/ath/ath5k
SRCDIRS_INSEC += drivers/net/ath/ath9k
# NON_AUTO_SRCS lists files that are excluded from the normal # NON_AUTO_SRCS lists files that are excluded from the normal
# automatic build system. # automatic build system.
# #

33
src/Makefile.housekeeping
View File

@ -299,7 +299,7 @@ endif
# #
# Select build architecture and platform based on $(BIN) # Select build architecture and platform based on $(BIN)
# #
# BIN has the form bin[-[arch-]platform] # BIN has the form bin[-[<arch>-]<platform>[-sb]]
ARCHS := $(patsubst arch/%,%,$(wildcard arch/*)) ARCHS := $(patsubst arch/%,%,$(wildcard arch/*))
PLATFORMS := $(patsubst config/defaults/%.h,%,\ PLATFORMS := $(patsubst config/defaults/%.h,%,\
@ -312,17 +312,18 @@ platforms :
ifdef BIN ifdef BIN
# Determine architecture portion of $(BIN), if present # Split $(BIN) into architecture, platform, and security flag (where present)
BIN_ARCH := $(strip $(foreach A,$(ARCHS),\ BIN_ELEMENTS := $(subst -,$(SPACE),$(BIN))
$(patsubst bin-$(A)-%,$(A),\ BIN_APS := $(wordlist 2,4,$(BIN_ELEMENTS))
$(filter bin-$(A)-%,$(BIN))))) ifeq ($(lastword $(BIN_APS)),sb)
BIN_AP := $(wordlist 2,$(words $(BIN_APS)),discard $(BIN_APS))
# Determine platform portion of $(BIN), if present BIN_SECUREBOOT := 1
ifeq ($(BIN_ARCH),)
BIN_PLATFORM := $(patsubst bin-%,%,$(filter bin-%,$(BIN)))
else else
BIN_PLATFORM := $(patsubst bin-$(BIN_ARCH)-%,%,$(BIN)) BIN_AP := $(BIN_APS)
BIN_SECUREBOOT := 0
endif endif
BIN_PLATFORM := $(lastword $(BIN_AP))
BIN_ARCH := $(wordlist 2,$(words $(BIN_AP)),discard $(BIN_AP))
# Determine build architecture # Determine build architecture
DEFAULT_ARCH := i386 DEFAULT_ARCH := i386
@ -339,6 +340,13 @@ CFLAGS += -DPLATFORM=$(PLATFORM)
platform : platform :
@$(ECHO) $(PLATFORM) @$(ECHO) $(PLATFORM)
# Determine security flag
DEFAULT_SECUREBOOT := 0
SECUREBOOT := $(firstword $(BIN_SECUREBOOT) $(DEFAULT_SECUREBOOT))
CFLAGS += -DSECUREBOOT=$(SECUREBOOT)
secureboot :
@$(ECHO) $(SECUREBOOT)
endif # defined(BIN) endif # defined(BIN)
# Include architecture-specific Makefile # Include architecture-specific Makefile
@ -357,6 +365,11 @@ endif
# #
# Source file handling # Source file handling
# Exclude known-insecure files from Secure Boot builds
ifeq ($(SECUREBOOT),0)
SRCDIRS += $(SRCDIRS_INSEC)
endif
# SRCDIRS lists all directories containing source files. # SRCDIRS lists all directories containing source files.
srcdirs : srcdirs :
@$(ECHO) $(SRCDIRS) @$(ECHO) $(SRCDIRS)