From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.windriver.com (mail.windriver.com [147.11.1.11]) (using TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id E8C8D21E1DAF8 for ; Mon, 7 Aug 2017 11:45:35 -0700 (PDT) Received: from ALA-HCA.corp.ad.wrs.com (ala-hca.corp.ad.wrs.com [147.11.189.40]) by mail.windriver.com (8.15.2/8.15.1) with ESMTPS id v77IlnvE002747 (version=TLSv1 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 7 Aug 2017 11:47:49 -0700 (PDT) Received: from ala-wpaul-lx1.wrs.com (147.11.157.242) by ALA-HCA.corp.ad.wrs.com (147.11.189.50) with Microsoft SMTP Server (TLS) id 14.3.361.1; Mon, 7 Aug 2017 11:47:49 -0700 From: Bill Paul Organization: Wind River Systems To: Date: Mon, 7 Aug 2017 11:57:40 -0700 User-Agent: KMail/1.13.5 (Linux/2.6.32-28-generic; KDE/4.4.5; x86_64; ; ) References: In-Reply-To: MIME-Version: 1.0 Message-ID: <201708071157.40881.wpaul@windriver.com> Subject: Re: Setting Secure Boot Variables X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Aug 2017 18:45:36 -0000 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Of all the gin joints in all the towns in all the world, Zach Smith had to walk into mine at 09:38:33 on Monday 07 August 2017 and say: > Is there any way I can pre-set the values for the PK, KEK, certificate, > etc. for using Secure Boot? Can you clarify what you mean a little? I'm assuming you have a bunch of machines that come from the manufacturer with UEFI firmware, and you want to know how to load UEFI secure boot keys on them prior to deployment. Is that right, or did you have something else in mind? You can typically load secure boot keys from USB thumb drive, but the UI for doing this is not defined by the spec and as such it can vary from vendor to vendor. The only way I can think of to create an automated loading scheme that will work on any platform is to write your own UEFI application. Setting secure boot keys is basically done using the SetVariable() API. I'm pretty sure there are some code examples out there that illustrate how this is done. Unfortunately one complication is that in order to manually set the UEFI keys, the system must be set to custom mode, and that usually requires going into the setup menu (i.e. to establish "physical presence"). This means you have to boot each system up and press a button somewhere. In some cases it may require you to open the case and set a switch or jumper. It's possible the system may come from the vendor with keys already loaded, which means you'll have to put the system into custom mode in order to delete/replace them. Once you're in custom mode, you can execute your custom app to reset the keys. You should load the db and dbx databases first, then the KEK, and then finally the PK. Once the PK is set, the system should transition to secure mode. From then on, changing the PK/KEK/db/dbx variables will require digitally signed updates or else you'll have to set the system back to custom mode again. If you are the vendor of the machines, you could manually set up one system, make a copy of the flash image and then duplicate that on to all others. -Bill > I have found an array in SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c that seems to > use variable names which are defined in > MdePkg/Include/Guid/GlobalVariable.h, but I haven't been able to locate any > way to associate these names with key values. Is this possible? I am trying > to automate the setup of Secure Boot and its keys. > > Thanks, > > Zach > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel -- ============================================================================= -Bill Paul (510) 749-2329 | Senior Member of Technical Staff, wpaul@windriver.com | Master of Unix-Fu - Wind River Systems ============================================================================= "I put a dollar in a change machine. Nothing changed." - George Carlin =============================================================================