linux-kernel - Re: Fwd: UEFI Secure boot using qemu-kvm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1342690897.3059.24.camel@dabdike.int.hansenpartnership.com>
Date:	Thu, 19 Jul 2012 10:41:37 +0100
From:	James Bottomley <James.Bottomley@...senPartnership.com>
To:	Khalid Aziz <khalid.aziz@...com>
Cc:	joeyli <jlee@...e.com>, linux-kernel@...r.kernel.org,
	linux-efi@...r.kernel.org
Subject: Re: Fwd: UEFI Secure boot using qemu-kvm

On Thu, 2012-07-12 at 16:17 -0600, Khalid Aziz wrote:
> I Tried to follow the steps Joey had written down (Thanks for doing
> that!) on Ubuntu 12.04 and ran into some problems. Here is what I had to
> do differently to get it to work:
> 
> - Install libssl-dev
> 
> - Use "sudo alien --to-deb sbsigntools-0.3-1.1.x86_64.rpm" to convert
> sbsigntools package and "dpkg -i" the resulting deb package
> 
> - Before building efitools, edit Make.rules and replace "/usr/lib64"
> with "/usr/lib"
> 
> - Run "make PK.h DB.h KEK.h" followed by "make". Make will fail to build
> Loader.so with error being __stack_chk_fail is undefined. Ubuntu's
> version of gcc enables stack check by default and adding
> -fno-stack-protector to CFLAGS did not help. I haven't figured this one
> out yet but Helloworld.efi builds correctly.

Actually, I just ran into this too.  Apparently libefi.a needs to be
build with -fno-stack-protector ... at least that's where the problem is
coming from in my environment.  I don't have an ubuntu system to check,
but to verify this is your issue, try:

nm -D /usr/lib/libefi.a | grep __stack_chk_fail

(or whatever your path is to libefi.a) ... probably you should also
check libgnuefi.a, although this one is clear in my setup.

James







--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/