[v1,0/7] qemuarm64-secureboot: Enable UEFI Secure Boot

Hi all,

Addressing your comments from first patch [0].

A backport from meta-ts with the minimal changes to add UEFI Secure Boot
into qemuarm64-secureboot machine.

Requirements:

  - Create a UEFI disk partition to copy EFI apps.

  - Add UEFI settings to U-Boot, Grub, and Linux kernel.

  - UEFI keys to be storaged in U-Boot and used to sign Grub and Linux
    kernel images.

  - A Grub patch has been implemented to prevent an error from being
    returned for a deferred image. It is still pending acceptance
    upstream.

Optional:

  - Add systemd as Init manager to auto-mount efivarfs.

Introduces uefi-secureboot machine feature.

Ideally, these changes would be submitted to meta-secure-core, but the
code currently doesn't support ARM.

UEFI keys must be provided in order to be added in U-Boot, sign Grub EFI
app and Linux kernel image. A script is provided to generate UEFI keys.

Build and verification steps:

$ kas build ci/qemuarm64-secureboot.yml

$ kas shell ci/qemuarm64-secureboot.yml -c 'runqemu nographic novga slirp'

Log in as root/toor:

$ efivar -d -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot
1

[0] https://lists.yoctoproject.org/g/meta-arm/message/5891

---

Changes since the v0:
- Remove u-boot recipe.
- Split the change in several commits.
- Remove sample UEFI keys.
- Validate UEFI keys exist before building.
- Insolate most of changes under uefi-secureboot machine feature.

Javier Tia (7):
  qemuarm64-secureboot: Add poky machine UEFI settings
  qemuarm64-secureboot: Introduce UEFI_SB_KEYS_DIR
  qemuarm64-secureboot: Validate UEFI keys exist
  qemuarm64-secureboot: Setup UEFI and Secure Boot in u-boot
  qemuarm64-secureboot: Setup UEFI grub and sign EFI grub binary
  qemuarm64-secureboot: Setup UEFI linux-yocto and sign kernel image
  qemuarm64-secureboot: Add UEFI systemd support

 ci/qemuarm64-secureboot.yml                   | 12 +++--
 .../core-image-base-uefi-secureboot.inc       | 23 +++++++++
 .../images/core-image-base.bbappend           |  1 +
 .../u-boot/u-boot-qemuarm64-secureboot.inc    | 18 +++++++
 .../qemuarm64-secureboot.cfg                  | 10 ++++
 .../recipes-bsp/u-boot/u-boot_%.bbappend      |  1 +
 meta-arm/classes/uefi-sb-keys.bbclass         | 24 ++++++++++
 meta-arm/conf/layer.conf                      |  2 +
 .../conf/machine/qemuarm64-secureboot.conf    |  3 ++
 ...on-t-return-error-for-deferred-image.patch | 48 +++++++++++++++++++
 .../recipes-bsp/grub/files/grub-initial.cfg   |  8 ++++
 .../grub/grub-efi-uefi-secureboot.inc         | 40 ++++++++++++++++
 meta-arm/recipes-bsp/grub/grub-efi_%.bbappend |  1 +
 .../systemd/systemd-uefi-secureboot.inc       |  1 +
 .../recipes-core/systemd/systemd_%.bbappend   |  1 +
 .../linux/linux-yocto%.bbappend               |  2 +
 .../linux/linux-yocto-uefi-secureboot.inc     | 18 +++++++
 meta-arm/uefi-sb-keys/gen_uefi_keys.sh        | 35 ++++++++++++++
 18 files changed, 243 insertions(+), 5 deletions(-)
 create mode 100644 meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
 create mode 100644 meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend
 create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot-qemuarm64-secureboot.inc
 create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot/qemuarm64-secureboot/qemuarm64-secureboot.cfg
 create mode 100644 meta-arm/classes/uefi-sb-keys.bbclass
 create mode 100644 meta-arm/recipes-bsp/grub/files/0001-verifiers-Don-t-return-error-for-deferred-image.patch
 create mode 100644 meta-arm/recipes-bsp/grub/files/grub-initial.cfg
 create mode 100644 meta-arm/recipes-bsp/grub/grub-efi-uefi-secureboot.inc
 create mode 100644 meta-arm/recipes-bsp/grub/grub-efi_%.bbappend
 create mode 100644 meta-arm/recipes-core/systemd/systemd-uefi-secureboot.inc
 create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
 create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
 create mode 100755 meta-arm/uefi-sb-keys/gen_uefi_keys.sh

Hi,

Could you prefix each patch subject with recipe it actually changes?

That's the pattern in poky and meta-arm. Then if possible, keep
changes separate to each recipe and main config file (machine,
kas etc).

Thanks,

-Mikko

Hi,

Is there some way to test this in oeqa runtime with ssh that
the boot was really done with secure binaries?

I think this is quite brittle and test should verify that
boot was secure.

Cheers,

-Mikko