Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secure boot #5282

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Secure boot #5282

wants to merge 10 commits into from

Conversation

kelly-yeh-ms
Copy link

  • Why I did it
    To make SONiC boot with signed shim and grub when secure boot is enabled
    Allow secure boot key signing and secure boot verification

  • How I did it
    Added signed grub and shim binary packages
    Boot with shim instead of grub
    Added efitools and mokutil

  • How to verify it
    Use sbsign to sign binaries and mokutil to check secure boot state
    Check if the following exists:
    /usr/lib/shim/shimx64.efi.signed
    /usr/lib/grub/x86_64-efi-signed/grubx64.efi.signed

@@ -412,7 +412,7 @@ demo_install_uefi_grub()
efibootmgr --quiet --create \
--label "$demo_volume_label" \
--disk $blk_dev --part $uefi_part \
--loader "/EFI/$demo_volume_label/grubx64.efi" || {
--loader "/EFI/$demo_volume_label/shimx64.efi" || {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this affect non secure boot?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, but not if we add shimx64.efi to the EFI partition. Still working on this.

@jleveque
Copy link
Contributor

Please add more detail to the PR title

build_debian.sh Outdated
sudo apt-get -y install efitools
sudo openssl req -new -x509 -newkey rsa:2048 -subj "/CN=db/" -keyout kernel_db.key -out kernel_db.crt -days 365 -nodes -sha256
sudo openssl x509 -in kernel_db.crt -outform der -out kernel_db.der
sudo sbsign --key kernel_db.key --cert kernel_db.crt --output fsroot/boot/vmlinuz-4.19.0-9-2-amd64 fsroot/boot/vmlinuz-4.19.0-9-2-amd64
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use LINUX_KERNEL_VERSION

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants