* [PATCH 1/1] OvmfPkg/EnrollDefaultKeys: import the non-default key into db
@ 2019-05-16 3:08 Gary Lin
2019-05-16 13:47 ` [edk2-devel] " Laszlo Ersek
0 siblings, 1 reply; 2+ messages in thread
From: Gary Lin @ 2019-05-16 3:08 UTC (permalink / raw)
To: devel; +Cc: Laszlo Ersek, Ard Biesheuvel, Jordan Justen
For QA test and development, we may need to test Secure Boot with a
devel key instead of UEFI CA.
This commit adds an argument, "--no-default", to EnrollDefaultKeys.efi.
With the argument, the key from SMBIOS Type 11 will also be enrolled
into db. Besides, the keys in AuthData.c, i.e. Microsoft KEK CA,
Microsoft PCA, and Microsoft UEFI CA will be excluded, so the developer
can easily create a varstore template for a specific key.
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Signed-off-by: Gary Lin <glin@suse.com>
---
OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 53 ++++++++++++++-----
1 file changed, 39 insertions(+), 14 deletions(-)
diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
index 75f2749dc84a..f45cb799f726 100644
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
@@ -538,6 +538,13 @@ ShellAppMain (
SETTINGS Settings;
UINT8 *PkKek1;
UINTN SizeOfPkKek1;
+ BOOLEAN NoDefault;
+
+ if (Argc == 2 && StrCmp (Argv[1], L"--no-default") == 0) {
+ NoDefault = TRUE;
+ } else {
+ NoDefault = FALSE;
+ }
//
// Prepare for failure.
@@ -594,13 +601,22 @@ ShellAppMain (
//
// Enroll db.
//
- Status = EnrollListOfCerts (
- EFI_IMAGE_SECURITY_DATABASE,
- &gEfiImageSecurityDatabaseGuid,
- &gEfiCertX509Guid,
- mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid,
- mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
- NULL);
+ if (NoDefault) {
+ Status = EnrollListOfCerts (
+ EFI_IMAGE_SECURITY_DATABASE,
+ &gEfiImageSecurityDatabaseGuid,
+ &gEfiCertX509Guid,
+ PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+ NULL);
+ } else {
+ Status = EnrollListOfCerts (
+ EFI_IMAGE_SECURITY_DATABASE,
+ &gEfiImageSecurityDatabaseGuid,
+ &gEfiCertX509Guid,
+ mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid,
+ mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
+ NULL);
+ }
if (EFI_ERROR (Status)) {
goto FreePkKek1;
}
@@ -621,13 +637,22 @@ ShellAppMain (
//
// Enroll KEK.
//
- Status = EnrollListOfCerts (
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &gEfiCertX509Guid,
- PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
- mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
- NULL);
+ if (NoDefault) {
+ Status = EnrollListOfCerts (
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &gEfiCertX509Guid,
+ PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+ NULL);
+ } else {
+ Status = EnrollListOfCerts (
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &gEfiCertX509Guid,
+ PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+ mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
+ NULL);
+ }
if (EFI_ERROR (Status)) {
goto FreePkKek1;
}
--
2.21.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [edk2-devel] [PATCH 1/1] OvmfPkg/EnrollDefaultKeys: import the non-default key into db
2019-05-16 3:08 [PATCH 1/1] OvmfPkg/EnrollDefaultKeys: import the non-default key into db Gary Lin
@ 2019-05-16 13:47 ` Laszlo Ersek
0 siblings, 0 replies; 2+ messages in thread
From: Laszlo Ersek @ 2019-05-16 13:47 UTC (permalink / raw)
To: devel, glin; +Cc: Ard Biesheuvel, Jordan Justen
On 05/16/19 05:08, Gary Lin wrote:
> For QA test and development, we may need to test Secure Boot with a
> devel key instead of UEFI CA.
>
> This commit adds an argument, "--no-default", to EnrollDefaultKeys.efi.
> With the argument, the key from SMBIOS Type 11 will also be enrolled
> into db. Besides, the keys in AuthData.c, i.e. Microsoft KEK CA,
> Microsoft PCA, and Microsoft UEFI CA will be excluded, so the developer
> can easily create a varstore template for a specific key.
>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Signed-off-by: Gary Lin <glin@suse.com>
> ---
> OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 53 ++++++++++++++-----
> 1 file changed, 39 insertions(+), 14 deletions(-)
>
> diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
> index 75f2749dc84a..f45cb799f726 100644
> --- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
> +++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
> @@ -538,6 +538,13 @@ ShellAppMain (
> SETTINGS Settings;
> UINT8 *PkKek1;
> UINTN SizeOfPkKek1;
> + BOOLEAN NoDefault;
> +
> + if (Argc == 2 && StrCmp (Argv[1], L"--no-default") == 0) {
> + NoDefault = TRUE;
> + } else {
> + NoDefault = FALSE;
> + }
>
> //
> // Prepare for failure.
> @@ -594,13 +601,22 @@ ShellAppMain (
> //
> // Enroll db.
> //
> - Status = EnrollListOfCerts (
> - EFI_IMAGE_SECURITY_DATABASE,
> - &gEfiImageSecurityDatabaseGuid,
> - &gEfiCertX509Guid,
> - mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid,
> - mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
> - NULL);
> + if (NoDefault) {
> + Status = EnrollListOfCerts (
> + EFI_IMAGE_SECURITY_DATABASE,
> + &gEfiImageSecurityDatabaseGuid,
> + &gEfiCertX509Guid,
> + PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
> + NULL);
> + } else {
> + Status = EnrollListOfCerts (
> + EFI_IMAGE_SECURITY_DATABASE,
> + &gEfiImageSecurityDatabaseGuid,
> + &gEfiCertX509Guid,
> + mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid,
> + mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
> + NULL);
> + }
> if (EFI_ERROR (Status)) {
> goto FreePkKek1;
> }
> @@ -621,13 +637,22 @@ ShellAppMain (
> //
> // Enroll KEK.
> //
> - Status = EnrollListOfCerts (
> - EFI_KEY_EXCHANGE_KEY_NAME,
> - &gEfiGlobalVariableGuid,
> - &gEfiCertX509Guid,
> - PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
> - mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
> - NULL);
> + if (NoDefault) {
> + Status = EnrollListOfCerts (
> + EFI_KEY_EXCHANGE_KEY_NAME,
> + &gEfiGlobalVariableGuid,
> + &gEfiCertX509Guid,
> + PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
> + NULL);
> + } else {
> + Status = EnrollListOfCerts (
> + EFI_KEY_EXCHANGE_KEY_NAME,
> + &gEfiGlobalVariableGuid,
> + &gEfiCertX509Guid,
> + PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
> + mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
> + NULL);
> + }
> if (EFI_ERROR (Status)) {
> goto FreePkKek1;
> }
>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Pushed as commit 89d7c543cf71.
Thanks,
Laszlo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-05-16 13:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-05-16 3:08 [PATCH 1/1] OvmfPkg/EnrollDefaultKeys: import the non-default key into db Gary Lin
2019-05-16 13:47 ` [edk2-devel] " Laszlo Ersek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox