Recent UEFI spec versions do not require a self-signed PK any more.
There is no good reason to stick to this requirement, but there is one
reason to remove it: It is not needed to enable CustomMode then to
enroll secure boot keys which are not self-signed.
This commit changes the uefi-vars default configuration to remove the
self signed platform key requirement and to disable CustomMode.
Little background on CustomMode:
This is a special edk2 mode which allows to freely update secure boot
variables. This is used by the firmware setup utility to allow the user
change the secure boot certificates. The EnrollDefaultKeys.efi utility
used to depend on CustomMode too.
Typically enabling CustomMode requires the user being physically
present. Implementing such a check in a sensible way for a virtual
machine is not really possible though. So OVMF doesn't do that and
CustomMode can be enabled without that physical presence check.
Therefore disabling CustomMode (by the qemu variable service blocking
updates of the EFI variable with EFI_WRITE_PROTECTED) is a nice security
improvement for secure boot support in virtual machines.
User-visible change: Updating secure boot configuration via firmware
setup utility does not work by default. Setting the
"disable-custom-mode=off" property will re-enable this if needed.
Alternatively the variable store can be prepared on the host machine
instead of doing it inside the guest.
Related edk2 commits:
- 3c01a11daae2 ("OvmfPkg: set PcdRequireSelfSignedPk to FALSE").
- 0a7ed7ed3457 ("OvmfPkg/EnrollDefaultKeys: do not require CustomMode")
Signed-off-by: Gerd Hoffmann <[email protected]>
---
hw/uefi/var-service-sysbus.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/uefi/var-service-sysbus.c b/hw/uefi/var-service-sysbus.c
index c4acdea275ad..e5e0441e16f7 100644
--- a/hw/uefi/var-service-sysbus.c
+++ b/hw/uefi/var-service-sysbus.c
@@ -37,9 +37,9 @@ static const Property uefi_vars_sysbus_properties[] = {
DEFINE_PROP_BOOL("force-secure-boot", uefi_vars_sysbus_state,
state.force_secure_boot, false),
DEFINE_PROP_BOOL("disable-custom-mode", uefi_vars_sysbus_state,
- state.disable_custom_mode, false),
+ state.disable_custom_mode, true),
DEFINE_PROP_BOOL("require-self-signed-pk", uefi_vars_sysbus_state,
- state.require_self_signed_pk, true),
+ state.require_self_signed_pk, false),
DEFINE_PROP_BOOL("use-pio", uefi_vars_sysbus_state,
state.use_pio, false),
};
--
2.55.0
