diff options
| author | Ka Ho Ng <khng@FreeBSD.org> | 2025-11-27 02:17:14 +0000 |
|---|---|---|
| committer | Ka Ho Ng <khng@FreeBSD.org> | 2025-11-27 02:18:23 +0000 |
| commit | 52c0749723bd80017fb0c0487440762a783ad323 (patch) | |
| tree | 37658a16781dc792656c687a6ef657009971740f | |
| parent | 35232d8edb5b8b3f18b6d9b2a93ecc252f8ed5a2 (diff) | |
libsecureboot: do further checks on files without manifests
verify_prep can return VE_FINGERPRINT_NONE. Consider such scenario so
the VE_GEUSS heuristics works with files that likely will not have
fingerprints in the manifest file.
Obtained from: Hewlett Packard Enterprise
Reviewed by: sjg
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D53940
| -rw-r--r-- | lib/libsecureboot/verify_file.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libsecureboot/verify_file.c b/lib/libsecureboot/verify_file.c index 753204a33b6a..ee263dafe774 100644 --- a/lib/libsecureboot/verify_file.c +++ b/lib/libsecureboot/verify_file.c @@ -539,7 +539,7 @@ verify_file(int fd, const char *filename, off_t off, int severity, return (0); if (rc != VE_FINGERPRINT_WRONG && loaded_manifests) { - if (rc != VE_NOT_CHECKED) + if (rc != VE_NOT_CHECKED && rc != VE_FINGERPRINT_NONE) return (rc); if (severity <= VE_GUESS) |