<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="#954F72" style="word-wrap:break-word"> <div class="WordSection1"> > +#define FAIL(fmt...) AsciiPrint("EnrollFromDefaultKeysApp: " fmt) <o:p> </o:p> I don’t think this sort of implied concatenation works on all compilers. <o:p> </o:p> - Bret <o:p></o:p> <o:p> </o:p> <div style="mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:pete=akeo.ie@groups.io">Pete Batard via groups.io</a> Sent: Wednesday, June 2, 2021 10:40 AM To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>; <a href="mailto:gjb@semihalf.com"> gjb@semihalf.com</a> Cc: <a href="mailto:leif@nuviainc.com">Lindholm, Leif</a>; <a href="mailto:ardb+tianocore@kernel.org"> ardb+tianocore@kernel.org</a>; <a href="mailto:Samer.El-Haj-Mahmoud@arm.com">Samer El-Haj-Mahmoud</a>; <a href="mailto:sunny.Wang@arm.com">sunny.Wang@arm.com</a>; <a href="mailto:mw@semihalf.com"> mw@semihalf.com</a>; <a href="mailto:upstream@semihalf.com">upstream@semihalf.com</a>; <a href="mailto:jiewen.yao@intel.com">Yao, Jiewen</a>; <a href="mailto:jian.j.wang@intel.com"> jian.j.wang@intel.com</a>; <a href="mailto:min.m.xu@intel.com">min.m.xu@intel.com</a>; <a href="mailto:lersek@redhat.com">lersek@redhat.com</a> Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 4/6] SecurityPkg: Add EnrollFromDefaultKeys application. </div> <o:p> </o:p> On 2021.06.01 14:12, Grzegorz Bernacki wrote: > This application allows user to force key enrollment from > Secure Boot default variables. > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com> > --- > SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf | 47 +++++++++ > SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c | 107 ++++++++++++++++++++ > 2 files changed, 154 insertions(+) > create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf > create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c > > diff --git a/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf > new file mode 100644 > index 0000000000..4d79ca3844 > --- /dev/null > +++ b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf > @@ -0,0 +1,47 @@ > +## @file > +# Enroll PK, KEK, db, dbx from Default variables > +# > +# Copyright (c) 2021, ARM Ltd. All rights reserved. > +# Copyright (c) 2021, Semihalf All rights reserved. > +# SPDX-License-Identifier: BSD-2-Clause-Patent > +## > + > +[Defines] > + INF_VERSION = 1.28 > + BASE_NAME = EnrollFromDefaultKeysApp > + FILE_GUID = 6F18CB2F-1293-4BC1-ABB8-35F84C71812E > + MODULE_TYPE = UEFI_APPLICATION > + VERSION_STRING = 0.1 > + ENTRY_POINT = UefiMain > + > +[Sources] > + EnrollFromDefaultKeysApp.c > + > +[Packages] > + MdeModulePkg/MdeModulePkg.dec > + MdePkg/MdePkg.dec > + SecurityPkg/SecurityPkg.dec > + > +[Guids] > + gEfiCertPkcs7Guid > + gEfiCertSha256Guid > + gEfiCertX509Guid > + gEfiCustomModeEnableGuid > + gEfiGlobalVariableGuid > + gEfiImageSecurityDatabaseGuid > + gEfiSecureBootEnableDisableGuid > + > +[Protocols] > + gEfiSmbiosProtocolGuid ## CONSUMES > + > +[LibraryClasses] > + BaseLib > + BaseMemoryLib > + DebugLib > + MemoryAllocationLib > + PrintLib > + UefiApplicationEntryPoint > + UefiBootServicesTableLib > + UefiLib > + UefiRuntimeServicesTableLib > + SecureBootVariableLib > diff --git a/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c > new file mode 100644 > index 0000000000..1907ce1d4e > --- /dev/null > +++ b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c > @@ -0,0 +1,107 @@ > +/** @file > + Enroll default PK, KEK, db, dbx. > + > +Copyright (c) 2021, ARM Ltd. All rights reserved. > +Copyright (c) 2021, Semihalf All rights reserved. > + > +SPDX-License-Identifier: BSD-2-Clause-Patent > +**/ > + > +#include <Guid/AuthenticatedVariableFormat.h> // gEfiCustomModeEnableGuid > +#include <Guid/GlobalVariable.h> // EFI_SETUP_MODE_NAME > +#include <Guid/ImageAuthentication.h> // EFI_IMAGE_SECURITY_DATABASE > +#include <Library/BaseLib.h> // GUID_STRING_LENGTH > +#include <Library/BaseMemoryLib.h> // CopyGuid() > +#include <Library/DebugLib.h> // ASSERT() > +#include <Library/MemoryAllocationLib.h> // FreePool() > +#include <Library/PrintLib.h> // AsciiSPrint() > +#include <Library/UefiBootServicesTableLib.h> // gBS > +#include <Library/UefiLib.h> // AsciiPrint() > +#include <Library/UefiRuntimeServicesTableLib.h> // gRT > +#include <Uefi/UefiMultiPhase.h> > +#include <Library/SecureBootVariableLib.h> > + > +#define FAIL(fmt...) AsciiPrint("EnrollFromDefaultKeysApp: " fmt) > + > +/** > + Entry point function of this shell application. > +**/ > +EFI_STATUS > +EFIAPI > +UefiMain ( > + IN EFI_HANDLE ImageHandle, > + IN EFI_SYSTEM_TABLE *SystemTable > + ) > +{ > + EFI_STATUS Status; > + UINT8 SetupMode; > + > + Status = GetSetupMode (&SetupMode); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot get SetupMode variable: %r\n", Status); > + return 1; > + } > + > + if (SetupMode == USER_MODE) { > + FAIL ("Skipped - USER_MODE\n"); > + return 1; > + } > + > + Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CUSTOM_SECURE_BOOT_MODE: %r\n", Status); > + return 1; > + } > + > + Status = EnrollDbFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll db: %r\n", Status); > + goto error; > + } > + > + Status = EnrollDbxFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll dbt: %r\n", Status); > + } > + > + Status = EnrollDbtFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll dbx: %r\n", Status); > + } > + > + Status = EnrollKEKFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll KEK: %r\n", Status); > + goto cleardbs; > + } > + > + Status = EnrollPKFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll PK: %r\n", Status); > + goto clearKEK; > + } > + > + Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n" > + "Please do it manually, otherwise system can be easily compromised\n"); > + } > + return 0; > + > +clearKEK: > + DeleteKEK (); > + > +cleardbs: > + DeleteDbt (); > + DeleteDbx (); > + DeleteDb (); > + > +error: > + Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n" > + "Please do it manually, otherwise system can be easily compromised\n"); > + } > + > + return 1; > +} > Reviewed-by: Pete Batard <pete@akeo.ie> Tested-by: Pete Batard <pete@akeo.ie> on Raspberry Pi 4 <o:p></o:p> <o:p> </o:p> </div> </body> </html> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/75997">View/Reply Online (#75997)</a> | | <a target="_blank" href="https://groups.io/mt/83267548/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>