Shim 15.7 for OL7 (ol7-shim-x86_64-20221129)

[iokomin]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/oracle/shim-review/tree/ol7-shim-x86_64-20221129

---

What is the SHA256 hash of your final SHIM binary?

---

77f0e3bdc92445004e15d2364e867e36212fe2c1bdcb8c913577473a454bc013 shimia32.efi e218b9de5fd6038a53fcecead8d9dbf2121003aab5ae7a89ff3ad3387d8ad1ff shimx64.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#142

[julian-klode]

This submission has been made without NX support despite NX support being mandatory for signing since November 30, and is very significantly different from the previous one. Did you get special accomodations from MS to allow this?

Also fbe previous Submission Link points to OL8, not OL7.

[iokomin]

@julian-klode previous public submission for ol7 - #141
There was another non-public keybase review for shim 15.6 accepted and signed as part of grub2 embargo cve-2021-3695 work.

For NX support, this submission is based on latest shim master with all NX related patches it includes - https://github.com/rhboot/shim/search?q=nx&type=commits , please let me know which required NX patch is missing.
I also see #307 is opened, could you please update it with patch information?

[julian-klode]

All the support code is there yes but the set NX bit flag in post-process-pe is disabled by default and that default flag is changed in main I think.

[iokomin]

@julian-klode

This submission has been made without NX support despite NX support being mandatory for signing since November 30, and is very significantly different from the previous one. Did you get special accomodations from MS to allow this?

Oracle obtained one time exception from Microsoft for this submission in order to mitigate grub2 SecureBoot CVE-2022-2601 and CVE-2022-3775.

[iokomin]

@julian-klode please let us know if you have any other concerns or questions for this and #305 requests which might block review. Both requests are based on the same shim source code base, just different set of vendor_db certificates per OL releases.

[vathpela]

This looks reasonable to me, and I've rebuilt it and verified the binaries are as expected.

[iokomin]

submission ID: 14228186206811813

[iokomin]

The submission signed by Microsoft, closing review