UEFI Shell + startup.nsh

UEFI Shell + startup.nsh

[Rafael Machado]

Hi everyone.

I have a question.
Considering I have a PXE server that my client downloads a shell.efi app.
Considering also that  I need to execute a .nsh script, but I their is no
media at the system.  (no usb or storage device attached)

Is there any way to embed a startup.nsh at the shell.efi application?
As far as I know with PXE just one file is downloaded and executed. (I am
also checking how to use the EfiRamDisk protocol to create a temporary
place for the .nsh generated files.)

PS.: I don't know to much about HttpBoot. Does HttpBoot has this limitation
of downloading a single file at startup?

Any help will be appreciated.
Thanks and Regards
Rafael R. Machado

Re: UEFI Shell + startup.nsh

[Paulo Alcantara]

Rafael Machado <rafaelrodrigues.machado@gmail.com> writes:

> I have a question.
> Considering I have a PXE server that my client downloads a shell.efi app.
> Considering also that  I need to execute a .nsh script, but I their is no
> media at the system.  (no usb or storage device attached)
>
> Is there any way to embed a startup.nsh at the shell.efi application?
> As far as I know with PXE just one file is downloaded and executed. (I am
> also checking how to use the EfiRamDisk protocol to create a temporary
> place for the .nsh generated files.)

You'd probably need to format your UEFI RAM disk with an FAT file
system, download the .nsh script into it, then UEFI shell application
would look for the startup script and then execute it.

Paulo

Re: UEFI Shell + startup.nsh

[Laszlo Ersek]

On 01/24/19 13:22, Rafael Machado wrote:
> Hi everyone.
> 
> I have a question.
> Considering I have a PXE server that my client downloads a shell.efi app.
> Considering also that  I need to execute a .nsh script, but I their is no
> media at the system.  (no usb or storage device attached)
> 
> Is there any way to embed a startup.nsh at the shell.efi application?
> As far as I know with PXE just one file is downloaded and executed. (I am
> also checking how to use the EfiRamDisk protocol to create a temporary
> place for the .nsh generated files.)
> 
> PS.: I don't know to much about HttpBoot. Does HttpBoot has this limitation
> of downloading a single file at startup?

With HttpBoot, you can solve this. The Wiki article (and the relevant
section) are at:

https://github.com/tianocore/tianocore.github.io/wiki/HTTP-Boot#ram-disk-boot-from-http

Here's how:

(1) First, create a FAT image such that the UEFI shell is in the default
boot loader location, according to the architecture. (e.g.
EFI/BOOT/BOOTAA64.EFI). Second, place "startup.nsh" in the FAT image
such that the shell find it, according to the UEFI shell spec.

For this, you can use "mkdosfs" (for formatting the image) and mmd and
mcopy (from the mtools package) for copying stuff into the image.
Alternatively, you can use "guestfish",  or even just loop-mount the FAT
image on Linux. (If you create the image in the first place, then it's
trustworthy; no need to worry about filesystem driver attacks.)

(2) Once you have the FAT image, let's call it "fat.img", use
"genisoimage" to generate an ISO image that has "fat.img" as its
ElTorito boot image.

  genisoimage -input-charset ASCII -efi-boot fat.img -no-emul-boot \
    -o stuff.iso -- fat.img

(3) Serve "stuff.iso" over HTTP.


I really hope you are doing this on a trusted, local network!

Secure Boot wouldn't be of much help here; the UEFI shell binary is not
signed. (And, signing it would be dumb, given that the shell does not
check signatures on shell scripts, so the scripts can cause the shell to
do basically anything at all.) HTTPS would likely count as an improvement.

HTH
Laszlo

Re: UEFI Shell + startup.nsh

[Rafael Machado]

Thanks a lot for the help Laszlo!
Will take a look. (Also agree about having a signed UEFI Shell not being a
good idea.)

Best Regards
Rafael

Em qui, 24 de jan de 2019 às 10:47, Laszlo Ersek <lersek@redhat.com>
escreveu:

> On 01/24/19 13:22, Rafael Machado wrote:
> > Hi everyone.
> >
> > I have a question.
> > Considering I have a PXE server that my client downloads a shell.efi app.
> > Considering also that  I need to execute a .nsh script, but I their is no
> > media at the system.  (no usb or storage device attached)
> >
> > Is there any way to embed a startup.nsh at the shell.efi application?
> > As far as I know with PXE just one file is downloaded and executed. (I am
> > also checking how to use the EfiRamDisk protocol to create a temporary
> > place for the .nsh generated files.)
> >
> > PS.: I don't know to much about HttpBoot. Does HttpBoot has this
> limitation
> > of downloading a single file at startup?
>
> With HttpBoot, you can solve this. The Wiki article (and the relevant
> section) are at:
>
>
> https://github.com/tianocore/tianocore.github.io/wiki/HTTP-Boot#ram-disk-boot-from-http
>
> Here's how:
>
> (1) First, create a FAT image such that the UEFI shell is in the default
> boot loader location, according to the architecture. (e.g.
> EFI/BOOT/BOOTAA64.EFI). Second, place "startup.nsh" in the FAT image
> such that the shell find it, according to the UEFI shell spec.
>
> For this, you can use "mkdosfs" (for formatting the image) and mmd and
> mcopy (from the mtools package) for copying stuff into the image.
> Alternatively, you can use "guestfish",  or even just loop-mount the FAT
> image on Linux. (If you create the image in the first place, then it's
> trustworthy; no need to worry about filesystem driver attacks.)
>
> (2) Once you have the FAT image, let's call it "fat.img", use
> "genisoimage" to generate an ISO image that has "fat.img" as its
> ElTorito boot image.
>
>   genisoimage -input-charset ASCII -efi-boot fat.img -no-emul-boot \
>     -o stuff.iso -- fat.img
>
> (3) Serve "stuff.iso" over HTTP.
>
>
> I really hope you are doing this on a trusted, local network!
>
> Secure Boot wouldn't be of much help here; the UEFI shell binary is not
> signed. (And, signing it would be dumb, given that the shell does not
> check signatures on shell scripts, so the scripts can cause the shell to
> do basically anything at all.) HTTPS would likely count as an improvement.
>
> HTH
> Laszlo
>