From mboxrd@z Thu Jan  1 00:00:00 1970
Authentication-Results: mx.groups.io;
 dkim=missing; spf=pass (domain: redhat.com, ip: 209.132.183.28, mailfrom: lersek@redhat.com)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
 by groups.io with SMTP; Thu, 16 May 2019 06:48:02 -0700
Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id CB05E12B43;
	Thu, 16 May 2019 13:48:01 +0000 (UTC)
Received: from lacos-laptop-7.usersys.redhat.com (ovpn-121-88.rdu2.redhat.com [10.10.121.88])
	by smtp.corp.redhat.com (Postfix) with ESMTP id 4030D6C33B;
	Thu, 16 May 2019 13:48:00 +0000 (UTC)
Subject: Re: [edk2-devel] [PATCH 1/1] OvmfPkg/EnrollDefaultKeys: import the non-default key into db
To: devel@edk2.groups.io, glin@suse.com
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>,
 Jordan Justen <jordan.l.justen@intel.com>
References: <20190516030834.12203-1-glin@suse.com>
From: "Laszlo Ersek" <lersek@redhat.com>
Message-ID: <bf1a39bd-e57e-d475-1a89-9860bf16237a@redhat.com>
Date: Thu, 16 May 2019 15:47:57 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <20190516030834.12203-1-glin@suse.com>
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 16 May 2019 13:48:01 +0000 (UTC)
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit

On 05/16/19 05:08, Gary Lin wrote:
> For QA test and development, we may need to test Secure Boot with a
> devel key instead of UEFI CA.
> 
> This commit adds an argument, "--no-default", to EnrollDefaultKeys.efi.
> With the argument, the key from SMBIOS Type 11 will also be enrolled
> into db. Besides, the keys in AuthData.c, i.e. Microsoft KEK CA,
> Microsoft PCA, and Microsoft UEFI CA will be excluded, so the developer
> can easily create a varstore template for a specific key.
> 
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Signed-off-by: Gary Lin <glin@suse.com>
> ---
>  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 53 ++++++++++++++-----
>  1 file changed, 39 insertions(+), 14 deletions(-)
> 
> diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
> index 75f2749dc84a..f45cb799f726 100644
> --- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
> +++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
> @@ -538,6 +538,13 @@ ShellAppMain (
>    SETTINGS   Settings;
>    UINT8      *PkKek1;
>    UINTN      SizeOfPkKek1;
> +  BOOLEAN    NoDefault;
> +
> +  if (Argc == 2 && StrCmp (Argv[1], L"--no-default") == 0) {
> +    NoDefault = TRUE;
> +  } else {
> +    NoDefault = FALSE;
> +  }
>  
>    //
>    // Prepare for failure.
> @@ -594,13 +601,22 @@ ShellAppMain (
>    //
>    // Enroll db.
>    //
> -  Status = EnrollListOfCerts (
> -             EFI_IMAGE_SECURITY_DATABASE,
> -             &gEfiImageSecurityDatabaseGuid,
> -             &gEfiCertX509Guid,
> -             mMicrosoftPca,    mSizeOfMicrosoftPca,    &gMicrosoftVendorGuid,
> -             mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
> -             NULL);
> +  if (NoDefault) {
> +    Status = EnrollListOfCerts (
> +               EFI_IMAGE_SECURITY_DATABASE,
> +               &gEfiImageSecurityDatabaseGuid,
> +               &gEfiCertX509Guid,
> +               PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
> +               NULL);
> +  } else {
> +    Status = EnrollListOfCerts (
> +               EFI_IMAGE_SECURITY_DATABASE,
> +               &gEfiImageSecurityDatabaseGuid,
> +               &gEfiCertX509Guid,
> +               mMicrosoftPca,    mSizeOfMicrosoftPca,    &gMicrosoftVendorGuid,
> +               mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
> +               NULL);
> +  }
>    if (EFI_ERROR (Status)) {
>      goto FreePkKek1;
>    }
> @@ -621,13 +637,22 @@ ShellAppMain (
>    //
>    // Enroll KEK.
>    //
> -  Status = EnrollListOfCerts (
> -             EFI_KEY_EXCHANGE_KEY_NAME,
> -             &gEfiGlobalVariableGuid,
> -             &gEfiCertX509Guid,
> -             PkKek1,        SizeOfPkKek1,        &gEfiCallerIdGuid,
> -             mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
> -             NULL);
> +  if (NoDefault) {
> +    Status = EnrollListOfCerts (
> +               EFI_KEY_EXCHANGE_KEY_NAME,
> +               &gEfiGlobalVariableGuid,
> +               &gEfiCertX509Guid,
> +               PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
> +               NULL);
> +  } else {
> +    Status = EnrollListOfCerts (
> +               EFI_KEY_EXCHANGE_KEY_NAME,
> +               &gEfiGlobalVariableGuid,
> +               &gEfiCertX509Guid,
> +               PkKek1,        SizeOfPkKek1,        &gEfiCallerIdGuid,
> +               mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
> +               NULL);
> +  }
>    if (EFI_ERROR (Status)) {
>      goto FreePkKek1;
>    }
> 

Reviewed-by: Laszlo Ersek <lersek@redhat.com>

Pushed as commit 89d7c543cf71.

Thanks,
Laszlo