Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unlock efi #1526

Merged
merged 2 commits into from
Nov 7, 2024
Merged

Unlock efi #1526

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2faa4ad
efitools: unlock: must have UEFI_SIGN_ENABLE
ldts Oct 29, 2024
164a71d
base: efitools: verify the signing keys
quaresmajose Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 24 additions & 16 deletions meta-lmp-base/recipes-bsp/efitools/efitools_git.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,11 @@ SRC_URI += " \
file://build-keys-for-lockdown-only.patch \
file://allow-local-auths.patch \
file://lockdown.conf \
file://unlock.patch \
file://unlock.conf \
"

# UnLock needs the user keys
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would add a little bit more on the commit log as it looks like to me that the patch does more that only build the keys
And I'm not sure I understand what "build a key" is
Do we need to verify if the key files exists?

Copy link
Contributor Author

@ldts ldts Nov 7, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the tool (unlock.efi) requires that the user provides the UEFI keys in order for the tool to be built - because the keys are later on embedded/compiled_in in the coff image.

the second commit checks if the all the keys have been provided

I'll rephrase :)

SRC_URI:append = "${@bb.utils.contains('UEFI_SIGN_ENABLE', '1', ' file://unlock.patch file://unlock.conf', '', d)}"

COMPATIBLE_HOST = "(i.86|x86_64|arm|aarch64|riscv64).*-linux"

inherit deploy
Expand All @@ -42,33 +43,40 @@ python do_prepare_local_auths() {
dir = d.expand('${UEFI_SIGN_KEYDIR}/')

import shutil
import os
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typos in the commit message

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi daiane, which commit?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe my github displayed an old version when I commented. It's fixed now

Copy link
Contributor Author

@ldts ldts Nov 7, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no no, I just fixed it after your review - I forced pushed the branch


# Use auths already generated by the user
for _ in ('PK', 'KEK', 'DB', 'DBX', 'noPK', 'noKEK'):
shutil.copyfile(dir + _ + '.auth', d.expand('${S}/') + _ + '.auth')
file = _ + '.auth'
src = dir + file
if not os.path.isfile(src):
bb.fatal("File '%s' not found!" % src)
shutil.copyfile(src, d.expand('${S}/') + file)

}
addtask prepare_local_auths after do_configure before do_compile
do_prepare_local_auths[vardeps] += "UEFI_SIGN_ENABLE UEFI_SIGN_KEYDIR"

do_deploy() {
install -d ${DEPLOYDIR}
install -m 0600 ${D}${datadir}/efitools/efi/LockDown.efi ${DEPLOYDIR}
install -m 0600 ${B}/LockDown.efi ${DEPLOYDIR}
install -m 0600 ${WORKDIR}/lockdown.conf ${DEPLOYDIR}

if ! sbsign --key ${UEFI_SIGN_KEYDIR}/DB.key \
--cert ${UEFI_SIGN_KEYDIR}/DB.crt \
--output ${D}${datadir}/efitools/efi/UnLock-signed.efi \
${D}${datadir}/efitools/efi/UnLock.efi; then
bbfatal "Failed to sign UnLock.efi"
fi
if [ "${UEFI_SIGN_ENABLE}" = "1" ]; then
if ! sbsign --key ${UEFI_SIGN_KEYDIR}/DB.key \
--cert ${UEFI_SIGN_KEYDIR}/DB.crt \
--output ${WORKDIR}/UnLock-signed.efi \
${B}/UnLock.efi; then
bbfatal "Failed to sign UnLock.efi"
fi

if ! sbverify --cert ${UEFI_SIGN_KEYDIR}/DB.crt \
${D}${datadir}/efitools/efi/UnLock-signed.efi; then
bbfatal "Failed to verify UnLock-signed.efi"
fi
if ! sbverify --cert ${UEFI_SIGN_KEYDIR}/DB.crt \
${WORKDIR}/UnLock-signed.efi; then
bbfatal "Failed to verify UnLock-signed.efi"
fi

install -m 0600 ${D}${datadir}/efitools/efi/UnLock-signed.efi ${DEPLOYDIR}
install -m 0600 ${WORKDIR}/unlock.conf ${DEPLOYDIR}
install -m 0600 ${WORKDIR}/UnLock-signed.efi ${DEPLOYDIR}
install -m 0600 ${WORKDIR}/unlock.conf ${DEPLOYDIR}
fi
}
addtask deploy after do_install before do_build