[edk2-devel] [PATCH 1/1] OvmfPkg/EnrollDefaultKeys: import the non-default key into db

[Gary Lin]

For QA test and development, we may need to test Secure Boot with a
devel key instead of UEFI CA.

This commit adds an argument, "--no-default", to EnrollDefaultKeys.efi.
With the argument, the key from SMBIOS Type 11 will also be enrolled
into db. Besides, the keys in AuthData.c, i.e. Microsoft KEK CA,
Microsoft PCA, and Microsoft UEFI CA will be excluded, so the developer
can easily create a varstore template for a specific key.

Cc: Laszlo Ersek <lersek at redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel at linaro.org>
Cc: Jordan Justen <jordan.l.justen at intel.com>
Signed-off-by: Gary Lin <glin at suse.com>
---
 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 53 ++++++++++++++-----
 1 file changed, 39 insertions(+), 14 deletions(-)

diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
index 75f2749dc84a..f45cb799f726 100644
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
@@ -538,6 +538,13 @@ ShellAppMain (
   SETTINGS   Settings;
   UINT8      *PkKek1;
   UINTN      SizeOfPkKek1;
+  BOOLEAN    NoDefault;
+
+  if (Argc == 2 && StrCmp (Argv[1], L"--no-default") == 0) {
+    NoDefault = TRUE;
+  } else {
+    NoDefault = FALSE;
+  }
 
   //
   // Prepare for failure.
@@ -594,13 +601,22 @@ ShellAppMain (
   //
   // Enroll db.
   //
-  Status = EnrollListOfCerts (
-             EFI_IMAGE_SECURITY_DATABASE,
-             &gEfiImageSecurityDatabaseGuid,
-             &gEfiCertX509Guid,
-             mMicrosoftPca,    mSizeOfMicrosoftPca,    &gMicrosoftVendorGuid,
-             mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
-             NULL);
+  if (NoDefault) {
+    Status = EnrollListOfCerts (
+               EFI_IMAGE_SECURITY_DATABASE,
+               &gEfiImageSecurityDatabaseGuid,
+               &gEfiCertX509Guid,
+               PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+               NULL);
+  } else {
+    Status = EnrollListOfCerts (
+               EFI_IMAGE_SECURITY_DATABASE,
+               &gEfiImageSecurityDatabaseGuid,
+               &gEfiCertX509Guid,
+               mMicrosoftPca,    mSizeOfMicrosoftPca,    &gMicrosoftVendorGuid,
+               mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
+               NULL);
+  }
   if (EFI_ERROR (Status)) {
     goto FreePkKek1;
   }
@@ -621,13 +637,22 @@ ShellAppMain (
   //
   // Enroll KEK.
   //
-  Status = EnrollListOfCerts (
-             EFI_KEY_EXCHANGE_KEY_NAME,
-             &gEfiGlobalVariableGuid,
-             &gEfiCertX509Guid,
-             PkKek1,        SizeOfPkKek1,        &gEfiCallerIdGuid,
-             mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
-             NULL);
+  if (NoDefault) {
+    Status = EnrollListOfCerts (
+               EFI_KEY_EXCHANGE_KEY_NAME,
+               &gEfiGlobalVariableGuid,
+               &gEfiCertX509Guid,
+               PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+               NULL);
+  } else {
+    Status = EnrollListOfCerts (
+               EFI_KEY_EXCHANGE_KEY_NAME,
+               &gEfiGlobalVariableGuid,
+               &gEfiCertX509Guid,
+               PkKek1,        SizeOfPkKek1,        &gEfiCallerIdGuid,
+               mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
+               NULL);
+  }
   if (EFI_ERROR (Status)) {
     goto FreePkKek1;
   }
-- 
2.21.0


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#40755): https://edk2.groups.io/g/devel/message/40755
Mute This Topic: https://groups.io/mt/31637219/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-