Skip to content
This repository has been archived by the owner on Feb 23, 2021. It is now read-only.

Build OVMF with support for secure boot #38

Open
mfleming opened this issue Nov 8, 2014 · 3 comments
Open

Build OVMF with support for secure boot #38

mfleming opened this issue Nov 8, 2014 · 3 comments
Assignees
@prakhya
Labels
buildbot feature
Milestone
Secure boot

Comments

@mfleming
Copy link
Contributor

mfleming commented Nov 8, 2014

There are configuration options that need to be enabled to build a secure boot ready version of OVMF. As part of our plans to support secure boot we should enable them for the purposes of development with Qemu.

It will also be required to generate and install some keys to be use in validating the binaries that we run.
@mfleming mfleming added this to the Secure boot milestone Nov 12, 2014
@pohly
Copy link
Contributor

pohly commented Dec 7, 2016

Instructions for enabling SecureBoot are here: https://wiki.ubuntu.com/UEFI/EDK2#Building_OvmfPkg_with_Secure_Boot_support

@pohly
Copy link
Contributor

pohly commented Dec 22, 2016

Patch series implementing this was submitted to OE-core: https://patchwork.openembedded.org/series/4506/

meghadey pushed a commit that referenced this issue Mar 1, 2018
@akuster
libdbi-perl: upgrade 1.636 -> 1.639
f05ba6b 
Changes in DBI 1.638:

Fix UTF-8 support for warn/croak calls within DBI internals,
    thanks to pali #53
Fix dependency on Storable for perl older than 5.8.9,
    thanks to H.Merijn Brand.

Add DBD::Mem driver, a pure-perl in-memory driver using DBI::DBD::SqlEngine,
    thanks to Jens Rehsack #42

Corrected missing semicolon in example in documentation,
    thanks to pali #55

Changes in DBI 1.637 - 16th August 2017:

Fix use of externally controlled format string (CWE-134) thanks to pali #44
    This could cause a crash if, for example, a db error contained a %.
    https://cwe.mitre.org/data/definitions/134.html
Fix extension detection for DBD::File related drivers
Fix tests for perl without dot in @inc RT#120443
Fix loss of error message on parent handle, thanks to charsbar #34
Fix disappearing $_ inside callbacks, thanks to robschaber #47
Fix dependency on Storable for perl older than 5.8.9

Allow objects to be used as passwords without throwing an error, thanks to demerphq #40
Allow $sth NAME_* attributes to be set from Perl code, re #45
Added support for DBD::XMLSimple thanks to nigelhorne #38

Documentation updates:
Improve examples using eval to be more correct, thanks to pali #39
Add cautionary note to prepare_cached docs re refs in %attr #46
Small POD changes (Getting Help -> Online) thanks to openstrike #33
Adds links to more module names and fix typo, thanks to oalders #43
Typo fix thanks to bor #37

Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
@km13park
Copy link

Here's the step that I followed to test luv test suites in secureboot mode. I used the EnrollDefaultKeys.efi to enroll keys (PK/KEK/DB) signed by Microsoft.

1. git clone https://github.com/intel/luv-yocto.git
2. Build OVMF 
	○ Add this line in local.conf ==> PACKAGECONFIG_append_pn-ovmf = " secureboot" 
	○ Add this line in ./meta-luv/recipe-core/images/luv-live-image.bb 
	==> DEPENDS = "python-native parted-native ovmf" 
3. bitbake luv-live-image
	○ This will generate EnrollDefaultKeys.efi in ./build/tmp/work/core2-64-oe-linux/ovmf/git-r0/
4. Copy EnrollDefaultKeys.efi in the EFI/BOOT partition after mouting the image
5. Run qemu with the ovmf firmware (ovmf.vars.fd, ovmf.secboot.fd, ovmf.fd) from ./build/tmp/work/core2-64-oe-linux/ovmf/git-r0/
6. Execute EnrollDefaultKeys.efi in efishell
	○ fs0:EnrollDefaultKeys.efi
	○ This will enroll the keys signed by Microsoft
7. Execute bootx64.efi
	○ In Shim UEFI key management menu, choose "Enroll key from disk"
	○ In Select an X509 certificate to enroll, choose "LUV.cer"

The link for reference:
http://lists.openembedded.org/pipermail/openembedded-core/2017-January/130945.html

@km13park km13park mentioned this issue Jan 17, 2019
Open
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@prakhya prakhya

Labels
buildbot feature
Projects
None yet
Milestone
Secure boot
Development

No branches or pull requests
5 participants
@pohly @mfleming @prakhya @meghadey @km13park