be9470b3c9
Disconnect the certificate that is enrolled as both Platform Key and first
Key Exchange Key from Red Hat: expect the hypervisor to specify it, as
part of SMBIOS.
Example usage with QEMU:
* Generate self-signed X509 certificate:
openssl req \
-x509 \
-newkey rsa:2048 \
-outform PEM \
-keyout PkKek1.private.key \
-out PkKek1.pem
(where "PEM" simply means "DER + base64 + header + footer").
* Strip the header, footer, and newline characters; prepend the
application prefix:
sed \
-e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \
-e '/^-----END CERTIFICATE-----$/d' \
PkKek1.pem \
| tr -d '\n' \
> PkKek1.oemstr
* Pass the certificate to EnrollDefaultKeys with the following QEMU
option:
-smbios type=11,value="$(< PkKek1.oemstr)"
(Note: for the above option to work correctly, a QEMU version is needed
that includes commit 950c4e6c94b1 ("opts: don't silently truncate long
option values", 2018-05-09). The first upstream release with that commit
was v3.0.0.
Once <https://bugs.launchpad.net/qemu/+bug/1826200> is fixed, QEMU will
learn to read the file directly; passing the blob on the command will be
necessary no more.)
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Julien Grall <julien.grall@arm.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Gary Lin <glin@suse.com>
53 lines
1.2 KiB
INI
53 lines
1.2 KiB
INI
## @file
|
|
# Enroll default PK, KEK, db, dbx.
|
|
#
|
|
# Copyright (C) 2014-2019, Red Hat, Inc.
|
|
#
|
|
# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
##
|
|
|
|
[Defines]
|
|
INF_VERSION = 1.28
|
|
BASE_NAME = EnrollDefaultKeys
|
|
FILE_GUID = A0BAA8A3-041D-48A8-BC87-C36D121B5E3D
|
|
MODULE_TYPE = UEFI_APPLICATION
|
|
VERSION_STRING = 0.1
|
|
ENTRY_POINT = ShellCEntryLib
|
|
|
|
[Sources]
|
|
AuthData.c
|
|
EnrollDefaultKeys.c
|
|
EnrollDefaultKeys.h
|
|
|
|
[Packages]
|
|
MdeModulePkg/MdeModulePkg.dec
|
|
MdePkg/MdePkg.dec
|
|
OvmfPkg/OvmfPkg.dec
|
|
SecurityPkg/SecurityPkg.dec
|
|
ShellPkg/ShellPkg.dec
|
|
|
|
[Guids]
|
|
gEfiCertPkcs7Guid
|
|
gEfiCertSha256Guid
|
|
gEfiCertX509Guid
|
|
gEfiCustomModeEnableGuid
|
|
gEfiGlobalVariableGuid
|
|
gEfiImageSecurityDatabaseGuid
|
|
gEfiSecureBootEnableDisableGuid
|
|
gMicrosoftVendorGuid
|
|
gOvmfPkKek1AppPrefixGuid
|
|
|
|
[Protocols]
|
|
gEfiSmbiosProtocolGuid ## CONSUMES
|
|
|
|
[LibraryClasses]
|
|
BaseLib
|
|
BaseMemoryLib
|
|
DebugLib
|
|
MemoryAllocationLib
|
|
PrintLib
|
|
ShellCEntryLib
|
|
UefiBootServicesTableLib
|
|
UefiLib
|
|
UefiRuntimeServicesTableLib
|