Generate and use generated_sbat_var_defs.h

Build changes to generate include/generated_sbat_var_defs.h from
SbatLevel_Variable.txt and use that header file. From here on
forward SbatLevel_Variable.txt should be the only place a new
revocation needs to be recorded.

Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>

Author: vathpela

.gitignore

@@ -39,6 +39,7 @@ Make.local
 /fuzz-*
 !/fuzz-*.c
 /generate_sbat_var_defs
+/generated_sbat_var_defs.h
 /leak-*
 /post-process-pe
 /random.bin

Makefile

@@ -38,8 +38,6 @@ CFLAGS += -DENABLE_SHIM_CERT
 else
 TARGETS += $(MMNAME) $(FBNAME)
 endif
-# This is temporary and will go away soon
-TARGETS += generate_sbat_var_defs
 OBJS	= shim.o globals.o mok.o netboot.o cert.o dp.o replacements.o tpm.o version.o errlog.o sbat.o sbat_data.o sbat_var.o pe.o pe-relocate.o httpboot.o csv.o load-options.o
 KEYS	= shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer
 ORIG_SOURCES	= shim.c globals.c mok.c netboot.c dp.c replacements.c tpm.c errlog.c sbat.c pe.c pe-relocate.c httpboot.c shim.h version.h $(wildcard include/*.h) cert.S sbat_var.S
@@ -102,6 +100,7 @@ shim.crt:
 shim.cer: shim.crt
 	$(OPENSSL) x509 -outform der -in $< -out $@
 
+
 .NOTPARALLEL: shim_cert.h
 shim_cert.h: shim.cer
 	echo "static UINT8 shim_cert[] __attribute__((__unused__)) = {" > $@
@@ -123,8 +122,10 @@ shim.o: $(SOURCES)
 ifneq ($(origin ENABLE_SHIM_CERT),undefined)
 shim.o: shim_cert.h
 endif
+sbat_var.S : generated_sbat_var_defs.h
 shim.o: $(wildcard $(TOPDIR)/*.h)
 
+
 sbat.%.csv : data/sbat.%.csv
 	$(DOS2UNIX) $(D2UFLAGS) $< $@
 	tail -c1 $@ | read -r _ || echo >> $@ # ensure a trailing newline
@@ -193,6 +194,10 @@ post-process-pe : $(TOPDIR)/post-process-pe.c
 generate_sbat_var_defs: $(TOPDIR)/generate_sbat_var_defs.c
 	$(HOSTCC) -std=gnu11 -Og -g3 -Wall -Wextra -Wno-missing-field-initializers -Werror -o $@ $<
 
+.NOTPARALLEL: generated_sbat_var_defs.h
+generated_sbat_var_defs.h: generate_sbat_var_defs
+	./generate_sbat_var_defs $(TOPDIR) > $@
+
 buildid : $(TOPDIR)/buildid.c
 	$(HOSTCC) -I/usr/include -Og -g3 -Wall -Werror -Wextra -o $@ $< -lelf
 
@@ -317,7 +322,7 @@ fuzz fuzz-clean fuzz-coverage fuzz-lto :
 		EFI_INCLUDES="$(EFI_INCLUDES)" \
 		fuzz-clean $@
 
-test test-clean test-coverage test-lto :
+test test-clean test-coverage test-lto : generated_sbat_var_defs.h
 	@make -f $(TOPDIR)/include/test.mk \
 		COMPILER="$(COMPILER)" \
 		CROSS_COMPILE="$(CROSS_COMPILE)" \
@@ -361,7 +366,7 @@ clean-lib-objs:
 clean-shim-objs:
 	@rm -rvf $(TARGET) *.o $(SHIM_OBJS) $(MOK_OBJS) $(FALLBACK_OBJS) $(KEYS) certdb $(BOOTCSVNAME)
 	@rm -vf *.debug *.so *.efi *.efi.* *.tar.* version.c buildid post-process-pe compile_commands.json
-	@rm -vf generate_sbat_var_defs
+	@rm -vf generate_sbat_var_defs generated_sbat_var_defs.h
 	@rm -vf Cryptlib/*.[oa] Cryptlib/*/*.[oa]
 	@if [ -d .git ] ; then git clean -f -d -e 'Cryptlib/OpenSSL/*'; fi
 

include/sbat_var_defs.h

@@ -7,7 +7,9 @@
 #define QUOTE(s) #s
 
 /*
- * This is the entry for the sbat data format
+ * SbatLevel Epoch and SHIM_DEVEL definitions are here
+ * Actual revocations are now soley defined in
+ * SbatLevel_Variable.txt
  */
 #define SBAT_VAR_SIG "sbat,"
 #define SBAT_VAR_VERSION "1,"
@@ -22,51 +24,10 @@
 
 #define SBAT_VAR_LATEST_DATE "2022050100"
 #define SBAT_VAR_LATEST_REVOCATIONS "component,2\nothercomponent,2\n"
-#define SBAT_VAR_LATEST \
-	SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \
-	SBAT_VAR_LATEST_REVOCATIONS
-#else /* !ENABLE_SHIM_DEVEL */
-
-/*
- * Some distros may want to apply revocations from 2022052400
- * or 2022111500 automatically. They can be selected by setting
- * SBAT_AUTOMATIC_DATE=<datestamp> at build time. Otherwise the
- * default is to apply the second to most recent revocations
- * automatically. Distros that need to manage automatic updates
- * externally from shim can choose the epoch 2021030218 emtpy
- * revocations.
- */
-#ifndef SBAT_AUTOMATIC_DATE
-#define SBAT_AUTOMATIC_DATE 2023012900
-#endif /* SBAT_AUTOMATIC_DATE */
-#if SBAT_AUTOMATIC_DATE == 2021030218
-#define SBAT_VAR_AUTOMATIC_REVOCATIONS
-#elif SBAT_AUTOMATIC_DATE == 2022052400
-#define SBAT_VAR_AUTOMATIC_REVOCATIONS "grub,2\n"
-#elif SBAT_AUTOMATIC_DATE == 2022111500
-#define SBAT_VAR_AUTOMATIC_REVOCATIONS "shim,2\ngrub,3\n"
-#elif SBAT_AUTOMATIC_DATE == 2023012900
-#define SBAT_VAR_AUTOMATIC_REVOCATIONS "shim,2\ngrub,3\ngrub.debian,4\n"
-#elif SBAT_AUTOMATIC_DATE == 2024010900
-#define SBAT_VAR_AUTOMATIC_REVOCATIONS "shim,4\ngrub,3\ngrub.debian,4\n"
-#else
-#error "Unknown SBAT_AUTOMATIC_DATE"
-#endif /* SBAT_AUTOMATIC_DATE == */
-#define SBAT_VAR_AUTOMATIC_DATE QUOTEVAL(SBAT_AUTOMATIC_DATE)
-#define SBAT_VAR_AUTOMATIC \
-	SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_AUTOMATIC_DATE "\n" \
-	SBAT_VAR_AUTOMATIC_REVOCATIONS
 
-/*
- * Revocations for:
- * - January 2024 shim CVEs
- * - October 2023 grub CVEs
- * - Debian/Ubuntu (peimage) CVE-2024-2312
- */
-#define SBAT_VAR_LATEST_DATE "2024040900"
-#define SBAT_VAR_LATEST_REVOCATIONS "shim,4\ngrub,4\ngrub.peimage,2\n"
 #define SBAT_VAR_LATEST \
 	SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \
 	SBAT_VAR_LATEST_REVOCATIONS
 #endif /* ENABLE_SHIM_DEVEL */
+
 #endif /* !SBAT_VAR_DEFS_H_ */

sbat_var.S

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: BSD-2-Clause-Patent
 
 #include "include/sbat_var_defs.h"
+#include "generated_sbat_var_defs.h"
 
 	.section .sbatlevel, "a", %progbits
 	.balignl 4, 0

test-sbat.c

@@ -8,6 +8,7 @@
 #include "sbat_var_defs.h"
 #endif
 #include "shim.h"
+#include "generated_sbat_var_defs.h"
 
 #include <stdio.h>