Hi I have not reviewed all patches. Just a quick comment: I don't think we allow ShellPkg dependency in SecuritytPkg.
You may refer to https://github.com/tianocore/edk2/blob/master/MdeModulePkg/Application/CapsuleApp/CapsuleApp.inf Thank you Yao Jiewen > -----Original Message----- > From: Grzegorz Bernacki <g...@semihalf.com> > Sent: Wednesday, May 26, 2021 5:42 PM > To: devel@edk2.groups.io > Cc: l...@nuviainc.com; ardb+tianoc...@kernel.org; Samer.El-Haj- > mahm...@arm.com; sunny.w...@arm.com; g...@semihalf.com; > upstr...@semihalf.com; Yao, Jiewen <jiewen....@intel.com>; Wang, Jian J > <jian.j.w...@intel.com>; Xu, Min M <min.m...@intel.com>; > ler...@redhat.com > Subject: [PATCH 4/6] SecurityPkg: Add SecEnrollDefaultKeys application. > > This application allows user to force key enrollment from > Secure Boot default variables. > > Signed-off-by: Grzegorz Bernacki <g...@semihalf.com> > --- > SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.inf | 48 > +++++++++ > SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.c | 108 > ++++++++++++++++++++ > 2 files changed, 156 insertions(+) > create mode 100644 > SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.inf > create mode 100644 > SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.c > > diff --git a/SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.inf > b/SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.inf > new file mode 100644 > index 0000000000..9d575ae0ac > --- /dev/null > +++ b/SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.inf > @@ -0,0 +1,48 @@ > +## @file > +# Enroll PK, KEK, db, dbx from Default variables > +# > +# Copyright (c) 2021, ARM Ltd. All rights reserved.<BR> > +# Copyright (c) 2021, Semihalf All rights reserved.<BR> > +# SPDX-License-Identifier: BSD-2-Clause-Patent > +## > + > +[Defines] > + INF_VERSION = 1.28 > + BASE_NAME = SecEnrollDefaultKeysApp > + FILE_GUID = 6F18CB2F-1293-4BC1-ABB8-35F84C71812E > + MODULE_TYPE = UEFI_APPLICATION > + VERSION_STRING = 0.1 > + ENTRY_POINT = ShellCEntryLib > + > +[Sources] > + SecEnrollDefaultKeysApp.c > + > +[Packages] > + MdeModulePkg/MdeModulePkg.dec > + MdePkg/MdePkg.dec > + SecurityPkg/SecurityPkg.dec > + ShellPkg/ShellPkg.dec > + > +[Guids] > + gEfiCertPkcs7Guid > + gEfiCertSha256Guid > + gEfiCertX509Guid > + gEfiCustomModeEnableGuid > + gEfiGlobalVariableGuid > + gEfiImageSecurityDatabaseGuid > + gEfiSecureBootEnableDisableGuid > + > +[Protocols] > + gEfiSmbiosProtocolGuid ## CONSUMES > + > +[LibraryClasses] > + BaseLib > + BaseMemoryLib > + DebugLib > + MemoryAllocationLib > + PrintLib > + ShellCEntryLib > + UefiBootServicesTableLib > + UefiLib > + UefiRuntimeServicesTableLib > + SecBootVariableLib > diff --git a/SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.c > b/SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.c > new file mode 100644 > index 0000000000..b66dd93a7a > --- /dev/null > +++ b/SecurityPkg/SecEnrollDefaultKeysApp/SecEnrollDefaultKeysApp.c > @@ -0,0 +1,108 @@ > +/** @file > + Enroll default PK, KEK, db, dbx. > + > +Copyright (c) 2021, ARM Ltd. All rights reserved.<BR> > +Copyright (c) 2021, Semihalf All rights reserved.<BR> > + > +SPDX-License-Identifier: BSD-2-Clause-Patent > +**/ > + > +#include <Guid/AuthenticatedVariableFormat.h> // > gEfiCustomModeEnableGuid > +#include <Guid/GlobalVariable.h> // EFI_SETUP_MODE_NAME > +#include <Guid/ImageAuthentication.h> // > EFI_IMAGE_SECURITY_DATABASE > +#include <Library/BaseLib.h> // GUID_STRING_LENGTH > +#include <Library/BaseMemoryLib.h> // CopyGuid() > +#include <Library/DebugLib.h> // ASSERT() > +#include <Library/MemoryAllocationLib.h> // FreePool() > +#include <Library/PrintLib.h> // AsciiSPrint() > +#include <Library/ShellCEntryLib.h> // ShellAppMain() > +#include <Library/UefiBootServicesTableLib.h> // gBS > +#include <Library/UefiLib.h> // AsciiPrint() > +#include <Library/UefiRuntimeServicesTableLib.h> // gRT > +#include <Uefi/UefiMultiPhase.h> > +#include <Library/SecBootVariableLib.h> > + > +#define FAIL(fmt...) AsciiPrint("SecEnrollDefaultKeysApp: " fmt) > + > +/** > + Entry point function of this shell application. > +**/ > +INTN > +EFIAPI > +ShellAppMain ( > + IN UINTN Argc, > + IN CHAR16 **Argv > + ) > +{ > + EFI_STATUS Status; > + UINT8 SetupMode; > + > + Status = CheckSetupMode (&SetupMode); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot get SetupMode variable: %r\n", Status); > + return 1; > + } > + > + if (SetupMode == USER_MODE) { > + FAIL ("Skipped - USER_MODE\n"); > + return 1; > + } > + > + Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CUSTOM_SECURE_BOOT_MODE: %r\n", Status); > + return 1; > + } > + > + Status = EnrollDbFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll db: %r\n", Status); > + goto error; > + } > + > + Status = EnrollDbxFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll dbt: %r\n", Status); > + } > + > + Status = EnrollDbtFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll dbx: %r\n", Status); > + } > + > + Status = EnrollKEKFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll KEK: %r\n", Status); > + goto cleardbs; > + } > + > + Status = EnrollPKFromDefault (); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot enroll PK: %r\n", Status); > + goto clearKEK; > + } > + > + Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + FAIL ("Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n" > + "Please do it manually, otherwise system can be easily compromised\n"); > + } > + return 0; > + > +clearKEK: > + DeleteKEK (); > + > +cleardbs: > + DeleteDbt (); > + DeleteDbx (); > + DeleteDb (); > + > +error: > + Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE); > + if (EFI_ERROR (Status)) { > + AsciiPrint ("SecEnrollDefaultKeysApp: Cannot set CustomMode to > STANDARD_SECURE_BOOT_MODE\n" > + "Please do it manually, otherwise system can be easily compromised\n"); > + } > + > + return 1; > +} > -- > 2.25.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#75658): https://edk2.groups.io/g/devel/message/75658 Mute This Topic: https://groups.io/mt/83098886/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
