Implement Secure Boot in loader.
AbandonedPublic
Actions

Authored by kd on Jan 9 2019, 6:16 PM.

Details

Reviewers

trasz
cem
sjg
mw
wma

Group Reviewers

secteam

Summary

This patch adds signature verification routines to the loader. It uses the newly added secureboot library. The trusted/revoked certificates are obtained from UEFI db/dbx variables. Support for authorized timestampts stored in dbt are not implemented. Headers with definitions of UEFI standardized structures were copied from edk2

Diff Detail

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

kd created this revision.Jan 9 2019, 6:16 PM

kd created this object with visibility "Custom Policy".

Herald added a subscriber: Contributor Reviews (base). · View Herald TranscriptJan 9 2019, 6:16 PM

kd added a parent revision: D18797: Introduce new Secure Boot library.Jan 9 2019, 6:20 PM

kd added reviewers: secteam, trasz, cem, sjg.Jan 9 2019, 6:28 PM

kd added reviewers: mw, wma.Jan 9 2019, 6:31 PM

kd changed the visibility from "Custom Policy" to "Public (No Login Required)".

Herald added a subscriber: imp. · View Herald TranscriptJan 9 2019, 6:31 PM

mst_semihalf.com added a subscriber: mst_semihalf.com.Jan 9 2019, 6:39 PM

There is potentially a lot of overlap with D16335 libsecureboot could be a better name for that than libve.
It would be good to leverage both.

For example D16335 contains an api which can verify hash of file as side effect of reading (reduces boot overhead),
it isn't used yet due to the considerable churn on loader module reading logic.
Also D16335 can work without UEFI - but the combination would be better.

Phab is a horrible way to conduct a discussion though - perhaps an email exchange would be useful.

Abandoned in favor of https://reviews.freebsd.org/D19093