[PATCH edk2-platforms] Platform/DeveloperBox: actually enable secure boot checking

[PATCH edk2-platforms] Platform/DeveloperBox: actually enable secure boot checking

[Ard Biesheuvel]

The current secure boot enabled DeveloperBox build contains all the
pieces to maintain the authenticated variable store, but doesn't
actually bother to check the signature on anything it boots. Fix that.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 Platform/Socionext/DeveloperBox/DeveloperBox.dsc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
index 39077ab5ee79..4ddb0d427f13 100644
--- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
+++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
@@ -245,7 +245,12 @@
   }
   MdeModulePkg/Universal/ResetSystemRuntimeDxe/ResetSystemRuntimeDxe.inf
   MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
+    <LibraryClasses>
+!if $(SECURE_BOOT_ENABLE) == TRUE
+      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
+!endif
+  }
   ArmPkg/Drivers/TimerDxe/TimerDxe.inf
   ArmPkg/Drivers/GenericWatchdogDxe/GenericWatchdogDxe.inf
   MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
-- 
2.17.1

Re: [PATCH edk2-platforms] Platform/DeveloperBox: actually enable secure boot checking

[Leif Lindholm]

On Wed, Apr 10, 2019 at 11:06:02AM -0700, Ard Biesheuvel wrote:
> The current secure boot enabled DeveloperBox build contains all the
> pieces to maintain the authenticated variable store, but doesn't
> actually bother to check the signature on anything it boots. Fix that.
> 
> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

We haven't actually dropped the CLA from edk2-platforms (yet), so we
probably still need the contributed-under for now. If you add that
before committing:

Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>

> ---
>  Platform/Socionext/DeveloperBox/DeveloperBox.dsc | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
> index 39077ab5ee79..4ddb0d427f13 100644
> --- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
> +++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
> @@ -245,7 +245,12 @@
>    }
>    MdeModulePkg/Universal/ResetSystemRuntimeDxe/ResetSystemRuntimeDxe.inf
>    MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> -  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> +  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
> +    <LibraryClasses>
> +!if $(SECURE_BOOT_ENABLE) == TRUE
> +      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
> +!endif
> +  }
>    ArmPkg/Drivers/TimerDxe/TimerDxe.inf
>    ArmPkg/Drivers/GenericWatchdogDxe/GenericWatchdogDxe.inf
>    MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> -- 
> 2.17.1
> 

Re: [PATCH edk2-platforms] Platform/DeveloperBox: actually enable secure boot checking

[Ard Biesheuvel]

On Thu, 11 Apr 2019 at 12:29, Leif Lindholm <leif.lindholm@linaro.org> wrote:
>
> On Wed, Apr 10, 2019 at 11:06:02AM -0700, Ard Biesheuvel wrote:
> > The current secure boot enabled DeveloperBox build contains all the
> > pieces to maintain the authenticated variable store, but doesn't
> > actually bother to check the signature on anything it boots. Fix that.
> >
> > Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>
> We haven't actually dropped the CLA from edk2-platforms (yet), so we
> probably still need the contributed-under for now. If you add that
> before committing:
>
> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
>

Thanks. Pushed as 7d8dc6544c93..11c98f35af40

> > ---
> >  Platform/Socionext/DeveloperBox/DeveloperBox.dsc | 7 ++++++-
> >  1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
> > index 39077ab5ee79..4ddb0d427f13 100644
> > --- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
> > +++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
> > @@ -245,7 +245,12 @@
> >    }
> >    MdeModulePkg/Universal/ResetSystemRuntimeDxe/ResetSystemRuntimeDxe.inf
> >    MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > -  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > +  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
> > +    <LibraryClasses>
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > +      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
> > +!endif
> > +  }
> >    ArmPkg/Drivers/TimerDxe/TimerDxe.inf
> >    ArmPkg/Drivers/GenericWatchdogDxe/GenericWatchdogDxe.inf
> >    MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > --
> > 2.17.1
> >