Traditional edk2 behavior is to require a self-signed platform key when
enrolling secure boot certificates in setup mode. In 2023 a config
option has been added (PcdRequireSelfSignedPk) which allows to relax
that requirement, see edk2 commit 566cdfc675fa ("SecurityPkg: limit
verification of enrolled PK in setup mode").
This patch adds a similar config option to the qemu uefi variable
driver.
No functional change, the default value for the new config option
maintains existing behavior.
Signed-off-by: Gerd Hoffmann <[email protected]>
---
include/hw/uefi/var-service.h | 1 +
hw/uefi/var-service-auth.c | 25 +++++++++++++++----------
hw/uefi/var-service-sysbus.c | 2 ++
3 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/include/hw/uefi/var-service.h b/include/hw/uefi/var-service.h
index 7d84025cd58d..7f74b4423381 100644
--- a/include/hw/uefi/var-service.h
+++ b/include/hw/uefi/var-service.h
@@ -76,6 +76,7 @@ struct uefi_vars_state {
int jsonfd;
bool force_secure_boot;
bool disable_custom_mode;
+ bool require_self_signed_pk;
bool use_pio;
/* request + reply capture */
diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c
index 899444af12df..21fc50f904d5 100644
--- a/hw/uefi/var-service-auth.c
+++ b/hw/uefi/var-service-auth.c
@@ -201,16 +201,21 @@ static efi_status
uefi_vars_check_auth_2_sb(uefi_vars_state *uv,
siglist = uefi_vars_find_siglist(uv, var);
if (!siglist && setup_mode_is_active(uv) && uefi_vars_is_sb_pk(var)) {
- /* check PK is self-signed */
- uefi_variable tmp = {
- .guid = EfiGlobalVariable,
- .name = (uint16_t *)name_pk,
- .name_size = sizeof(name_pk),
- .attributes = sigdb_attrs,
- .data = data + data_offset,
- .data_size = va->data_size - data_offset,
- };
- return uefi_vars_check_pkcs7_2(&tmp, NULL, NULL, va, data);
+ /* edk2 config option is PcdRequireSelfSignedPk */
+ if (uv->require_self_signed_pk) {
+ /* check PK is self-signed */
+ uefi_variable tmp = {
+ .guid = EfiGlobalVariable,
+ .name = (uint16_t *)name_pk,
+ .name_size = sizeof(name_pk),
+ .attributes = sigdb_attrs,
+ .data = data + data_offset,
+ .data_size = va->data_size - data_offset,
+ };
+ return uefi_vars_check_pkcs7_2(&tmp, NULL, NULL, va, data);
+ } else {
+ return true;
+ }
}
return uefi_vars_check_pkcs7_2(siglist, NULL, NULL, va, data);
diff --git a/hw/uefi/var-service-sysbus.c b/hw/uefi/var-service-sysbus.c
index 97a96cae6a2b..c4acdea275ad 100644
--- a/hw/uefi/var-service-sysbus.c
+++ b/hw/uefi/var-service-sysbus.c
@@ -38,6 +38,8 @@ static const Property uefi_vars_sysbus_properties[] = {
state.force_secure_boot, false),
DEFINE_PROP_BOOL("disable-custom-mode", uefi_vars_sysbus_state,
state.disable_custom_mode, false),
+ DEFINE_PROP_BOOL("require-self-signed-pk", uefi_vars_sysbus_state,
+ state.require_self_signed_pk, true),
DEFINE_PROP_BOOL("use-pio", uefi_vars_sysbus_state,
state.use_pio, false),
};
--
2.55.0
