1. Patchew
  2. EDK2
  3. [edk2-devel] [PATCH v2 0/6] Secure Boot default keys
  4. View patch

[edk2-devel] [PATCH v2 5/6] SecurityPkg: Add new modules to Security package.

Grzegorz Bernacki posted 6 patches 4 years, 8 months ago
There is a newer version of this series
[edk2-devel] [PATCH v2 5/6] SecurityPkg: Add new modules to Security package.
Posted by Grzegorz Bernacki 4 years, 8 months ago 
This commits adds modules related to initialization and
usage of default Secure Boot key variables to SecurityPkg.

Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
 SecurityPkg/SecurityPkg.dec | 14 ++++++++++++++
 SecurityPkg/SecurityPkg.dsc |  4 ++++
 2 files changed, 18 insertions(+)

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 4001650fa2..dad3cae0ba 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -190,6 +190,20 @@
   ## GUID used to enforce loading order between Tcg2Acpi and Tcg2Smm
   gTcg2MmSwSmiRegisteredGuid         = { 0x9d4548b9, 0xa48d, 0x4db4, { 0x9a, 0x68, 0x32, 0xc5, 0x13, 0x9e, 0x20, 0x18 } }
 
+  ## GUID used to specify section with default PK content
+  gDefaultPKFileGuid                 = { 0x85254ea7, 0x4759, 0x4fc4, { 0x82, 0xd4, 0x5e, 0xed, 0x5f, 0xb0, 0xa4, 0xa0 } }
+
+  ## GUID used to specify section with default KEK content
+  gDefaultKEKFileGuid                = { 0x6f64916e, 0x9f7a, 0x4c35, { 0xb9, 0x52, 0xcd, 0x04, 0x1e, 0xfb, 0x05, 0xa3 } }
+
+  ## GUID used to specify section with default db content
+  gDefaultdbFileGuid                 = { 0xc491d352, 0x7623, 0x4843, { 0xac, 0xcc, 0x27, 0x91, 0xa7, 0x57, 0x44, 0x21 } }
+
+  ## GUID used to specify section with default dbt content
+  gDefaultdbxFileGuid                = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35, 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
+
+  ## GUID used to specify section with default dbx content
+  gDefaultdbtFileGuid                = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb, 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }
 
 [Ppis]
   ## The PPI GUID for that TPM physical presence should be locked.
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 854f250625..e031775ca8 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -259,6 +259,10 @@
 
 [Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
   SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+  SecurityPkg/EnrollFromDefaultKeys/EnrollFromDefaultKeys.inf
+  SecurityPkg/VariableAuthenticated/SecureBootDefaultKeys/SecureBootDefaultKeys.inf
+
 
 [Components.IA32, Components.X64, Components.AARCH64]
   #
-- 
2.25.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#75906): https://edk2.groups.io/g/devel/message/75906
Mute This Topic: https://groups.io/mt/83232301/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v2 5/6] SecurityPkg: Add new modules to Security package.
Posted by Pete Batard 4 years, 8 months ago 
One very minor remark:

On 2021.06.01 14:12, Grzegorz Bernacki wrote:
> This commits adds modules related to initialization and
> usage of default Secure Boot key variables to SecurityPkg.
> 
> Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> ---
>   SecurityPkg/SecurityPkg.dec | 14 ++++++++++++++
>   SecurityPkg/SecurityPkg.dsc |  4 ++++
>   2 files changed, 18 insertions(+)
> 
> diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
> index 4001650fa2..dad3cae0ba 100644
> --- a/SecurityPkg/SecurityPkg.dec
> +++ b/SecurityPkg/SecurityPkg.dec
> @@ -190,6 +190,20 @@
>     ## GUID used to enforce loading order between Tcg2Acpi and Tcg2Smm
>     gTcg2MmSwSmiRegisteredGuid         = { 0x9d4548b9, 0xa48d, 0x4db4, { 0x9a, 0x68, 0x32, 0xc5, 0x13, 0x9e, 0x20, 0x18 } }
>   
> +  ## GUID used to specify section with default PK content
> +  gDefaultPKFileGuid                 = { 0x85254ea7, 0x4759, 0x4fc4, { 0x82, 0xd4, 0x5e, 0xed, 0x5f, 0xb0, 0xa4, 0xa0 } }
> +
> +  ## GUID used to specify section with default KEK content
> +  gDefaultKEKFileGuid                = { 0x6f64916e, 0x9f7a, 0x4c35, { 0xb9, 0x52, 0xcd, 0x04, 0x1e, 0xfb, 0x05, 0xa3 } }
> +
> +  ## GUID used to specify section with default db content
> +  gDefaultdbFileGuid                 = { 0xc491d352, 0x7623, 0x4843, { 0xac, 0xcc, 0x27, 0x91, 0xa7, 0x57, 0x44, 0x21 } }
> +
> +  ## GUID used to specify section with default dbt content
> +  gDefaultdbxFileGuid                = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35, 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
> +
> +  ## GUID used to specify section with default dbx content
> +  gDefaultdbtFileGuid                = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb, 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }
>   
>   [Ppis]
>     ## The PPI GUID for that TPM physical presence should be locked.
> diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
> index 854f250625..e031775ca8 100644
> --- a/SecurityPkg/SecurityPkg.dsc
> +++ b/SecurityPkg/SecurityPkg.dsc
> @@ -259,6 +259,10 @@
>   
>   [Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
>     SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> +  SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> +  SecurityPkg/EnrollFromDefaultKeys/EnrollFromDefaultKeys.inf
> +  SecurityPkg/VariableAuthenticated/SecureBootDefaultKeys/SecureBootDefaultKeys.inf
> +

I don't think we need the extra line here.

>   
>   [Components.IA32, Components.X64, Components.AARCH64]
>     #
> 

Reviewed-by: Pete Batard <pete@akeo.ie>
Tested-by: Pete Batard <pete@akeo.ie> on Raspberry Pi 4


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#75991): https://edk2.groups.io/g/devel/message/75991
Mute This Topic: https://groups.io/mt/83232301/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v2 5/6] SecurityPkg: Add new modules to Security package.
Posted by Min Xu 4 years, 8 months ago 
On June 1, 2021 9:12 PM, Grzegorz Bernacki Wrote:
> This commits adds modules related to initialization and usage of default
> Secure Boot key variables to SecurityPkg.
> 
> Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> ---
>  SecurityPkg/SecurityPkg.dec | 14 ++++++++++++++
> SecurityPkg/SecurityPkg.dsc |  4 ++++
>  2 files changed, 18 insertions(+)
> 
> diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index
> 4001650fa2..dad3cae0ba 100644
> --- a/SecurityPkg/SecurityPkg.dec
> +++ b/SecurityPkg/SecurityPkg.dec
> @@ -190,6 +190,20 @@
>    ## GUID used to enforce loading order between Tcg2Acpi and Tcg2Smm
>    gTcg2MmSwSmiRegisteredGuid         = { 0x9d4548b9, 0xa48d, 0x4db4,
> { 0x9a, 0x68, 0x32, 0xc5, 0x13, 0x9e, 0x20, 0x18 } }
> 
> +  ## GUID used to specify section with default PK content
> +  gDefaultPKFileGuid                 = { 0x85254ea7, 0x4759, 0x4fc4, { 0x82, 0xd4,
> 0x5e, 0xed, 0x5f, 0xb0, 0xa4, 0xa0 } }
> +
> +  ## GUID used to specify section with default KEK content
> +  gDefaultKEKFileGuid                = { 0x6f64916e, 0x9f7a, 0x4c35, { 0xb9, 0x52,
> 0xcd, 0x04, 0x1e, 0xfb, 0x05, 0xa3 } }
> +
> +  ## GUID used to specify section with default db content
> +  gDefaultdbFileGuid                 = { 0xc491d352, 0x7623, 0x4843, { 0xac, 0xcc,
> 0x27, 0x91, 0xa7, 0x57, 0x44, 0x21 } }
> +
> +  ## GUID used to specify section with default dbt content
> +  gDefaultdbxFileGuid                = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35,
> 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
> +
> +  ## GUID used to specify section with default dbx content
> +  gDefaultdbtFileGuid                = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb,
> 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }
> 
>  [Ppis]
>    ## The PPI GUID for that TPM physical presence should be locked.
> diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc index
> 854f250625..e031775ca8 100644
> --- a/SecurityPkg/SecurityPkg.dsc
> +++ b/SecurityPkg/SecurityPkg.dsc
> @@ -259,6 +259,10 @@
> 
>  [Components.IA32, Components.X64, Components.ARM,
> Components.AARCH64]
>    SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> +  SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> +  SecurityPkg/EnrollFromDefaultKeys/EnrollFromDefaultKeys.inf
> +
> +
> SecurityPkg/VariableAuthenticated/SecureBootDefaultKeys/SecureBootDefa
> + ultKeys.inf
> +
> 
>  [Components.IA32, Components.X64, Components.AARCH64]
>    #
> --
> 2.25.1

It looks good to me.


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#76045): https://edk2.groups.io/g/devel/message/76045
Mute This Topic: https://groups.io/mt/83232301/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v2 5/6] SecurityPkg: Add new modules to Security package.
Posted by Sunny Wang 4 years, 8 months ago 
Internally reviewed this patch before sending the edk2 mailing list and It looks good to me. Please also address Pete's good catches/comments.
Reviewed-by: Sunny Wang <sunny.wang@arm.com>

-----Original Message-----
From: Grzegorz Bernacki <gjb@semihalf.com>
Sent: Tuesday, June 1, 2021 9:12 PM
To: devel@edk2.groups.io
Cc: leif@nuviainc.com; ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang <Sunny.Wang@arm.com>; mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com; jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com; Grzegorz Bernacki <gjb@semihalf.com>
Subject: [PATCH v2 5/6] SecurityPkg: Add new modules to Security package.

This commits adds modules related to initialization and
usage of default Secure Boot key variables to SecurityPkg.

Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
 SecurityPkg/SecurityPkg.dec | 14 ++++++++++++++
 SecurityPkg/SecurityPkg.dsc |  4 ++++
 2 files changed, 18 insertions(+)

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 4001650fa2..dad3cae0ba 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -190,6 +190,20 @@
   ## GUID used to enforce loading order between Tcg2Acpi and Tcg2Smm
   gTcg2MmSwSmiRegisteredGuid         = { 0x9d4548b9, 0xa48d, 0x4db4, { 0x9a, 0x68, 0x32, 0xc5, 0x13, 0x9e, 0x20, 0x18 } }

+  ## GUID used to specify section with default PK content
+  gDefaultPKFileGuid                 = { 0x85254ea7, 0x4759, 0x4fc4, { 0x82, 0xd4, 0x5e, 0xed, 0x5f, 0xb0, 0xa4, 0xa0 } }
+
+  ## GUID used to specify section with default KEK content
+  gDefaultKEKFileGuid                = { 0x6f64916e, 0x9f7a, 0x4c35, { 0xb9, 0x52, 0xcd, 0x04, 0x1e, 0xfb, 0x05, 0xa3 } }
+
+  ## GUID used to specify section with default db content
+  gDefaultdbFileGuid                 = { 0xc491d352, 0x7623, 0x4843, { 0xac, 0xcc, 0x27, 0x91, 0xa7, 0x57, 0x44, 0x21 } }
+
+  ## GUID used to specify section with default dbt content
+  gDefaultdbxFileGuid                = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35, 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
+
+  ## GUID used to specify section with default dbx content
+  gDefaultdbtFileGuid                = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb, 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }

 [Ppis]
   ## The PPI GUID for that TPM physical presence should be locked.
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 854f250625..e031775ca8 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -259,6 +259,10 @@

 [Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
   SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+  SecurityPkg/EnrollFromDefaultKeys/EnrollFromDefaultKeys.inf
+  SecurityPkg/VariableAuthenticated/SecureBootDefaultKeys/SecureBootDefaultKeys.inf
+

 [Components.IA32, Components.X64, Components.AARCH64]
   #
--
2.25.1

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#76050): https://edk2.groups.io/g/devel/message/76050
Mute This Topic: https://groups.io/mt/83232301/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.