sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-01-21 18:30:56 +03:00
Code Issues Packages Projects Releases Wiki Activity

[build] Mark existing files as explicitly forbidden for Secure Boot

Browse Source 
The third-party 802.11 stack and NFS protocol code are known to
include multiple potential vulnerabilities and are explicitly
forbidden from being included in Secure Boot signed builds.  This is
currently handled at the per-directory level by defining a list of
source directories (SRCDIRS_INSEC) that are to be excluded from Secure
Boot builds.

Annotate all files in these directories with FILE_SECBOOT() to convey
this information to the new per-file Secure Boot permissibility check,
and remove the old separation between SRCDIRS and SRCDIRS_INSEC.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2026-01-13 14:38:37 +00:00
parent b09af00fab
commit 30948987fd
95 changed files with 141 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/Makefile.housekeeping
View File

@@ -436,11 +436,6 @@ endif
#
# Source file handling
# Exclude known-insecure files from Secure Boot builds
ifeq ($(SECUREBOOT),0)
SRCDIRS += $(SRCDIRS_INSEC)
endif
# SRCDIRS lists all directories containing source files.
srcdirs :
@$(ECHO) $(SRCDIRS)