From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: suse.com, ip: 195.135.221.5, mailfrom: glin@suse.com) Received: from smtp.nue.novell.com (smtp.nue.novell.com [195.135.221.5]) by groups.io with SMTP; Wed, 15 May 2019 20:08:57 -0700 Received: from GaryWorkstation.suse.de (unknown.telstraglobal.net [202.47.205.198]) by smtp.nue.novell.com with ESMTP (NOT encrypted); Thu, 16 May 2019 05:08:53 +0200 From: "Gary Lin" To: devel@edk2.groups.io Cc: Laszlo Ersek , Ard Biesheuvel , Jordan Justen Subject: [PATCH 1/1] OvmfPkg/EnrollDefaultKeys: import the non-default key into db Date: Thu, 16 May 2019 11:08:34 +0800 Message-Id: <20190516030834.12203-1-glin@suse.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit For QA test and development, we may need to test Secure Boot with a devel key instead of UEFI CA. This commit adds an argument, "--no-default", to EnrollDefaultKeys.efi. With the argument, the key from SMBIOS Type 11 will also be enrolled into db. Besides, the keys in AuthData.c, i.e. Microsoft KEK CA, Microsoft PCA, and Microsoft UEFI CA will be excluded, so the developer can easily create a varstore template for a specific key. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Jordan Justen Signed-off-by: Gary Lin --- OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 53 ++++++++++++++----- 1 file changed, 39 insertions(+), 14 deletions(-) diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c index 75f2749dc84a..f45cb799f726 100644 --- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c +++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c @@ -538,6 +538,13 @@ ShellAppMain ( SETTINGS Settings; UINT8 *PkKek1; UINTN SizeOfPkKek1; + BOOLEAN NoDefault; + + if (Argc == 2 && StrCmp (Argv[1], L"--no-default") == 0) { + NoDefault = TRUE; + } else { + NoDefault = FALSE; + } // // Prepare for failure. @@ -594,13 +601,22 @@ ShellAppMain ( // // Enroll db. // - Status = EnrollListOfCerts ( - EFI_IMAGE_SECURITY_DATABASE, - &gEfiImageSecurityDatabaseGuid, - &gEfiCertX509Guid, - mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid, - mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid, - NULL); + if (NoDefault) { + Status = EnrollListOfCerts ( + EFI_IMAGE_SECURITY_DATABASE, + &gEfiImageSecurityDatabaseGuid, + &gEfiCertX509Guid, + PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid, + NULL); + } else { + Status = EnrollListOfCerts ( + EFI_IMAGE_SECURITY_DATABASE, + &gEfiImageSecurityDatabaseGuid, + &gEfiCertX509Guid, + mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid, + mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid, + NULL); + } if (EFI_ERROR (Status)) { goto FreePkKek1; } @@ -621,13 +637,22 @@ ShellAppMain ( // // Enroll KEK. // - Status = EnrollListOfCerts ( - EFI_KEY_EXCHANGE_KEY_NAME, - &gEfiGlobalVariableGuid, - &gEfiCertX509Guid, - PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid, - mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid, - NULL); + if (NoDefault) { + Status = EnrollListOfCerts ( + EFI_KEY_EXCHANGE_KEY_NAME, + &gEfiGlobalVariableGuid, + &gEfiCertX509Guid, + PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid, + NULL); + } else { + Status = EnrollListOfCerts ( + EFI_KEY_EXCHANGE_KEY_NAME, + &gEfiGlobalVariableGuid, + &gEfiCertX509Guid, + PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid, + mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid, + NULL); + } if (EFI_ERROR (Status)) { goto FreePkKek1; } -- 2.21.0