From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.web08.1288.1622655608090635425 for ; Wed, 02 Jun 2021 10:40:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@akeo-ie.20150623.gappssmtp.com header.s=20150623 header.b=XPdIhbZk; spf=pass (domain: akeo.ie, ip: 209.85.128.52, mailfrom: pete@akeo.ie) Received: by mail-wm1-f52.google.com with SMTP id o2-20020a05600c4fc2b029019a0a8f959dso2160239wmq.1 for ; Wed, 02 Jun 2021 10:40:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akeo-ie.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=Qu+eANSjPEoVw1kBGvBw2ky5zSVYu79qIurDnGPJMEo=; b=XPdIhbZkS55tlIF8QfkLpDDJnKP0k7c4S7SF5yvPG27l8BELgc28Zm2Y8SBHEGanVU b2TAv9QESfqIYYSAOAlKbAeVi7qJ7ZV4Bs/UwVEo3OyKyJywYOHdiLx8kpAnKn1ueVv9 ToeyaeGmUCcJnImPIVE5UOwx4UQoLeu6usRJuabJ7kF46YQD0ZhUb68HZ4BviX1b0tJR d6/StkQfz7u2UQ72ff2RY5tavzrZJYDJIKztZ6B3ZS0m7TCmFlzeMoXDYUbPne/fFmOs BOrpmmi6s7vQLqtRl4CMAJlXzB0vN9cco9sbEDqyiwr0bKWl2ZPcNviSsrfxN1bE6dI5 fSQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Qu+eANSjPEoVw1kBGvBw2ky5zSVYu79qIurDnGPJMEo=; b=M0rjzYl0xqC6TYORJr9/nItCfe1bgLxntEVT2xDwN25DCQXKXJE1eKjNr8r2INeTuc caHkJD7QN+zfLHiGoBf92Acokin8KJR+gbeERtEIpbSViqf0IfnzSxXvFaZboN1CH+V5 KK+UHJv5F73qgjxDZRM7UH4Kokde9/JcC9c3TWJ6pepwaxIKY9AVvJR9c7UKR5WL+CMQ MeeINx9Pdiayn5cRR/CjUC5Uj+JKBQRGVAgBiS1MNzxo1PNCHlTKL7MDrGX/d5i6H9+S rPncdpr2HfJyYhXnh23lBqAMFvguTzUBeepTMwuEPl/NC9IFLa8djB+Aj0CwB8vIG/At PHNQ== X-Gm-Message-State: AOAM530BvbzekiRKju/OwWy5mi9Zkkojf4t5MqaffUpomzdGBO87ptXb XZZfleIJs89EEA8WEq0ao1iX5w== X-Google-Smtp-Source: ABdhPJyuzrYmzJGynjatX7pBDGeUDQ1MxHAX0gDina9bt8+uV2u0F9+djiP+0J1I17AUd+Y611JoEw== X-Received: by 2002:a1c:3183:: with SMTP id x125mr6269840wmx.80.1622655606614; Wed, 02 Jun 2021 10:40:06 -0700 (PDT) Return-Path: Received: from [10.0.0.122] ([84.203.86.196]) by smtp.googlemail.com with ESMTPSA id 89sm651975wri.94.2021.06.02.10.40.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 02 Jun 2021 10:40:06 -0700 (PDT) Subject: Re: [edk2-devel] [PATCH v2 4/6] SecurityPkg: Add EnrollFromDefaultKeys application. To: devel@edk2.groups.io, gjb@semihalf.com Cc: leif@nuviainc.com, ardb+tianocore@kernel.org, Samer.El-Haj-Mahmoud@arm.com, sunny.Wang@arm.com, mw@semihalf.com, upstream@semihalf.com, jiewen.yao@intel.com, jian.j.wang@intel.com, min.m.xu@intel.com, lersek@redhat.com References: <20210601131229.630611-1-gjb@semihalf.com> <20210601131229.630611-6-gjb@semihalf.com> From: "Pete Batard" Message-ID: Date: Wed, 2 Jun 2021 18:40:05 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.10.2 MIME-Version: 1.0 In-Reply-To: <20210601131229.630611-6-gjb@semihalf.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit On 2021.06.01 14:12, Grzegorz Bernacki wrote: > This application allows user to force key enrollment from > Secure Boot default variables. > > Signed-off-by: Grzegorz Bernacki > --- > SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf | 47 +++++++++ > SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c | 107 ++++++++++++++++++++ > 2 files changed, 154 insertions(+) > create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf > create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c > > diff --git a/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf > new file mode 100644 > index 0000000000..4d79ca3844 > --- /dev/null > +++ b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf > @@ -0,0 +1,47 @@ > +## @file > +# Enroll PK, KEK, db, dbx from Default variables > +# > +# Copyright (c) 2021, ARM Ltd. All rights reserved.
> +# Copyright (c) 2021, Semihalf All rights reserved.
> +# SPDX-License-Identifier: BSD-2-Clause-Patent > +## > + > +[Defines] > + INF_VERSION = 1.28 > + BASE_NAME = EnrollFromDefaultKeysApp > + FILE_GUID = 6F18CB2F-1293-4BC1-ABB8-35F84C71812E > + MODULE_TYPE = UEFI_APPLICATION > + VERSION_STRING = 0.1 > + ENTRY_POINT = UefiMain > + > +[Sources] > + EnrollFromDefaultKeysApp.c > + > +[Packages] > + MdeModulePkg/MdeModulePkg.dec > + MdePkg/MdePkg.dec > + SecurityPkg/SecurityPkg.dec > + > +[Guids] > + gEfiCertPkcs7Guid > + gEfiCertSha256Guid > + gEfiCertX509Guid > + gEfiCustomModeEnableGuid > + gEfiGlobalVariableGuid > + gEfiImageSecurityDatabaseGuid > + gEfiSecureBootEnableDisableGuid > + > +[Protocols] > + gEfiSmbiosProtocolGuid ## CONSUMES > + > +[LibraryClasses] > + BaseLib > + BaseMemoryLib > + DebugLib > + MemoryAllocationLib > + PrintLib > + UefiApplicationEntryPoint > + UefiBootServicesTableLib > + UefiLib > + UefiRuntimeServicesTableLib > + SecureBootVariableLib > diff --git a/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c > new file mode 100644 > index 0000000000..1907ce1d4e > --- /dev/null > +++ b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c > @@ -0,0 +1,107 @@ > +/** @file > + Enroll default PK, KEK, db, dbx. > + > +Copyright (c) 2021, ARM Ltd. All rights reserved.
> +Copyright (c) 2021, Semihalf All rights reserved.
> + > +SPDX-License-Identifier: BSD-2-Clause-Patent > +**/ > + > +#include // gEfiCustomModeEnableGuid > +#include // EFI_SETUP_MODE_NAME > +#include // EFI_IMAGE_SECURITY_DATABASE > +#include // GUID_STRING_LENGTH > +#include // CopyGuid() > +#include // ASSERT() > +#include // FreePool() > +#include // AsciiSPrint() > +#include // gBS > +#include // AsciiPrint() > +#include // gRT > +#include > +#include > + > +#define FAIL(fmt...) AsciiPrint("EnrollFromDefaultKeysApp: " fmt) > + > +/** > + Entry point function of this shell application. > +**/ > +EFI_STATUS > +EFIAPI > +UefiMain ( > + IN EFI_HANDLE ImageHandle, > + IN EFI_SYSTEM_TABLE *SystemTable > + ) > +{ > + EFI_STATUS Status; > + UINT8 SetupMode; > + > + Status = GetSetupMode (&SetupMode); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot get SetupMode variable: %r\n", Status); > + return 1; > + } > + > + if (SetupMode == USER_MODE) { > + FAIL ("Skipped - USER_MODE\n"); > + return 1; > + } > + > + Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CUSTOM_SECURE_BOOT_MODE: %r\n", Status); > + return 1; > + } > + > + Status = EnrollDbFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll db: %r\n", Status); > + goto error; > + } > + > + Status = EnrollDbxFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll dbt: %r\n", Status); > + } > + > + Status = EnrollDbtFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll dbx: %r\n", Status); > + } > + > + Status = EnrollKEKFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll KEK: %r\n", Status); > + goto cleardbs; > + } > + > + Status = EnrollPKFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll PK: %r\n", Status); > + goto clearKEK; > + } > + > + Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n" > + "Please do it manually, otherwise system can be easily compromised\n"); > + } > + return 0; > + > +clearKEK: > + DeleteKEK (); > + > +cleardbs: > + DeleteDbt (); > + DeleteDbx (); > + DeleteDb (); > + > +error: > + Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n" > + "Please do it manually, otherwise system can be easily compromised\n"); > + } > + > + return 1; > +} > Reviewed-by: Pete Batard Tested-by: Pete Batard on Raspberry Pi 4