[oe-commits] [openembedded-core] 11/11: runqemu: Add support to handle EnrollDefaultKeys PK/KEK1 certificate

[git at git.openembedded.org]

This is an automated email from the git hooks/post-receive script.

rpurdie pushed a commit to branch master-next
in repository openembedded-core.

commit 5e47316ae62f7632fb62bc3b8093ac42f9e3541c
Author: Ricardo Neri <ricardo.neri-calderon at linux.intel.com>
AuthorDate: Mon Aug 5 18:18:23 2019 -0400

    runqemu: Add support to handle EnrollDefaultKeys PK/KEK1 certificate
    
    The EnrollDefaultKeys.efi application (distributed in ovmf-shell-image)
    expects the hypervisor to provide a Platform Key and first Key Exchange
    Key certificate.
    
    For QEMU, this is done by adding an OEM string in the Type 11 SMBIOS
    table. The string contains the EnrollDefaultKeys application GUID followed
    by the certificate string. For now, the string is passed in the command
    line until QEMU understands OEM strings from regular files (please see
    https://bugs.launchpad.net/qemu/+bug/1826200).
    
    If runqemu detects it is given an OVMF binary with support for Secure Boot
    (i.e., ovmf.secboot* binaries), extract the certificate string from the
    OvmfPkKek1.pem certificate and modify the command-line parameters to
    provide the key. Such certificate is created when building OVMF with
    support for Secure Boot.
    
    Cc: Ross Burton <ross.burton at intel.com>
    Cc: Patrick Ohly <patrick.ohly at intel.com>
    Signed-off-by: Ricardo Neri <ricardo.neri-calderon at linux.intel.com>
---
 scripts/runqemu | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/scripts/runqemu b/scripts/runqemu
index 9d6a2e8..df3c8aa 100755
--- a/scripts/runqemu
+++ b/scripts/runqemu
@@ -148,6 +148,10 @@ class BaseConfig(object):
         # Setting one also adds "-vga std" because that is all that
         # OVMF supports.
         self.ovmf_bios = []
+        # When enrolling default Secure Boot keys, the hypervisor
+        # must provide the Platform Key and the first Key Exchange Key
+        # certificate in the Type 11 SMBIOS table.
+        self.ovmf_secboot_pkkek1 = ''
         self.qemuboot = ''
         self.qbconfload = False
         self.kernel = ''
@@ -638,6 +642,23 @@ class BaseConfig(object):
         if not os.path.exists(self.rootfs):
             raise RunQemuError("Can't find rootfs: %s" % self.rootfs)
 
+    def setup_pkkek1(self):
+        """
+        Extract from PEM certificate the Platform Key and first Key
+        Exchange Key certificate string. The hypervisor needs to provide
+        it in the Type 11 SMBIOS table
+        """
+        pemcert = '%s/%s' % (self.get('DEPLOY_DIR_IMAGE'), 'OvmfPkKek1.pem')
+        try:
+            with open(pemcert, 'r') as pemfile:
+                key = pemfile.read().replace('\n', ''). \
+                      replace('-----BEGIN CERTIFICATE-----', ''). \
+                      replace('-----END CERTIFICATE-----', '')
+                self.ovmf_secboot_pkkek1 = key
+
+        except FileNotFoundError:
+            raise RunQemuError("Can't open PEM certificate %s " % pemcert)
+
     def check_ovmf(self):
         """Check and set full path for OVMF firmware and variable file(s)."""
 
@@ -648,6 +669,8 @@ class BaseConfig(object):
                 path = '%s/%s.%s' % (self.get('DEPLOY_DIR_IMAGE'), ovmf, suffix)
                 if os.path.exists(path):
                     self.ovmf_bios[index] = path
+                    if ovmf.endswith('secboot'):
+                        self.setup_pkkek1()
                     break
             else:
                 raise RunQemuError("Can't find OVMF firmware: %s" % ovmf)
@@ -914,6 +937,8 @@ class BaseConfig(object):
             print('ROOTFS: [%s]' % self.rootfs)
         if self.ovmf_bios:
             print('OVMF: %s' % self.ovmf_bios)
+        if (self.ovmf_secboot_pkkek1):
+            print('SECBOOT PKKEK1: [%s...]' % self.ovmf_secboot_pkkek1[0:100])
         print('CONFFILE: [%s]' % self.qemuboot)
         print('')
 
@@ -1262,6 +1287,13 @@ class BaseConfig(object):
 
         self.qemu_opt += ' ' + self.qemu_opt_script
 
+        if self.ovmf_secboot_pkkek1:
+			# Provide the Platform Key and first Key Exchange Key certificate as an
+			# OEM string in the SMBIOS Type 11 table. Prepend the certificate string
+			# with "application prefix" of the EnrollDefaultKeys.efi application
+            self.qemu_opt += ' -smbios type=11,value=4e32566d-8e9e-4f52-81d3-5bb9715f9727:' \
+                             + self.ovmf_secboot_pkkek1
+
         # Append qemuparams to override previous settings
         if self.qemuparams:
             self.qemu_opt += ' ' + self.qemuparams

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.