tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/EnrollDefaultKeys: import the non-default key into db 

For QA test and development, we may need to test Secure Boot with a
devel key instead of UEFI CA.

This commit adds an argument, "--no-default", to EnrollDefaultKeys.efi.
With the argument, the key from SMBIOS Type 11 will also be enrolled
into db. Besides, the keys in AuthData.c, i.e. Microsoft KEK CA,
Microsoft PCA, and Microsoft UEFI CA will be excluded, so the developer
can easily create a varstore template for a specific key.

Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Signed-off-by: Gary Lin <glin@suse.com>
Message-Id: <20190516030834.12203-1-glin@suse.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
This commit is contained in:
Gary Lin 2019-05-16 11:08:34 +08:00 committed by Laszlo Ersek
parent bf502ae449
commit 89d7c543cf
1 changed files with 39 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
View File

@ -538,6 +538,13 @@ ShellAppMain (
SETTINGS Settings;
UINT8 *PkKek1;
UINTN SizeOfPkKek1;
BOOLEAN NoDefault;
if (Argc == 2 && StrCmp (Argv[1], L"--no-default") == 0) {
NoDefault = TRUE;
} else {
NoDefault = FALSE;
}
//
// Prepare for failure.
@ -594,6 +601,14 @@ ShellAppMain (
//
// Enroll db.
//
if (NoDefault) {
Status = EnrollListOfCerts (
EFI_IMAGE_SECURITY_DATABASE,
&gEfiImageSecurityDatabaseGuid,
&gEfiCertX509Guid,
PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
NULL);
} else {
Status = EnrollListOfCerts (
EFI_IMAGE_SECURITY_DATABASE,
&gEfiImageSecurityDatabaseGuid,
@ -601,6 +616,7 @@ ShellAppMain (
mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid,
mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
NULL);
}
if (EFI_ERROR (Status)) {
goto FreePkKek1;
}
@ -621,6 +637,14 @@ ShellAppMain (
//
// Enroll KEK.
//
if (NoDefault) {
Status = EnrollListOfCerts (
EFI_KEY_EXCHANGE_KEY_NAME,
&gEfiGlobalVariableGuid,
&gEfiCertX509Guid,
PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
NULL);
} else {
Status = EnrollListOfCerts (
EFI_KEY_EXCHANGE_KEY_NAME,
&gEfiGlobalVariableGuid,
@ -628,6 +652,7 @@ ShellAppMain (
PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
NULL);
}
if (EFI_ERROR (Status)) {
goto FreePkKek1;
}