diff options
| author | Gary Lin <glin@suse.com> | 2019-05-16 11:08:34 +0800 |
|---|---|---|
| committer | Laszlo Ersek <lersek@redhat.com> | 2019-05-16 15:36:04 +0200 |
| commit | 89d7c543cf719c2b81b930eb477c22da4c721134 (patch) | |
| tree | 6b7c6e4fab5388e2f8880f8bbe8af72be6048d34 /OvmfPkg/EnrollDefaultKeys | |
| parent | bf502ae44919a564d5a51d1b7b000cd9496c7ecf (diff) | |
| download | edk2-89d7c543cf719c2b81b930eb477c22da4c721134.tar.gz edk2-89d7c543cf719c2b81b930eb477c22da4c721134.tar.bz2 edk2-89d7c543cf719c2b81b930eb477c22da4c721134.zip | |
OvmfPkg/EnrollDefaultKeys: import the non-default key into db
For QA test and development, we may need to test Secure Boot with a
devel key instead of UEFI CA.
This commit adds an argument, "--no-default", to EnrollDefaultKeys.efi.
With the argument, the key from SMBIOS Type 11 will also be enrolled
into db. Besides, the keys in AuthData.c, i.e. Microsoft KEK CA,
Microsoft PCA, and Microsoft UEFI CA will be excluded, so the developer
can easily create a varstore template for a specific key.
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Signed-off-by: Gary Lin <glin@suse.com>
Message-Id: <20190516030834.12203-1-glin@suse.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Diffstat (limited to 'OvmfPkg/EnrollDefaultKeys')
| -rw-r--r-- | OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 53 |
1 files changed, 39 insertions, 14 deletions
diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c index 75f2749dc8..f45cb799f7 100644 --- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c +++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c @@ -538,6 +538,13 @@ ShellAppMain ( SETTINGS Settings;
UINT8 *PkKek1;
UINTN SizeOfPkKek1;
+ BOOLEAN NoDefault;
+
+ if (Argc == 2 && StrCmp (Argv[1], L"--no-default") == 0) {
+ NoDefault = TRUE;
+ } else {
+ NoDefault = FALSE;
+ }
//
// Prepare for failure.
@@ -594,13 +601,22 @@ ShellAppMain ( //
// Enroll db.
//
- Status = EnrollListOfCerts (
- EFI_IMAGE_SECURITY_DATABASE,
- &gEfiImageSecurityDatabaseGuid,
- &gEfiCertX509Guid,
- mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid,
- mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
- NULL);
+ if (NoDefault) {
+ Status = EnrollListOfCerts (
+ EFI_IMAGE_SECURITY_DATABASE,
+ &gEfiImageSecurityDatabaseGuid,
+ &gEfiCertX509Guid,
+ PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+ NULL);
+ } else {
+ Status = EnrollListOfCerts (
+ EFI_IMAGE_SECURITY_DATABASE,
+ &gEfiImageSecurityDatabaseGuid,
+ &gEfiCertX509Guid,
+ mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid,
+ mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,
+ NULL);
+ }
if (EFI_ERROR (Status)) {
goto FreePkKek1;
}
@@ -621,13 +637,22 @@ ShellAppMain ( //
// Enroll KEK.
//
- Status = EnrollListOfCerts (
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &gEfiCertX509Guid,
- PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
- mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
- NULL);
+ if (NoDefault) {
+ Status = EnrollListOfCerts (
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &gEfiCertX509Guid,
+ PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+ NULL);
+ } else {
+ Status = EnrollListOfCerts (
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &gEfiCertX509Guid,
+ PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid,
+ mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,
+ NULL);
+ }
if (EFI_ERROR (Status)) {
goto FreePkKek1;
}
|