Can we use UEFI signing to validate additional partitions?

[Shamino0]

I know that, if I define TEGRA_UEFI_DB_KEY and TEGRA_UEFI_DB_CERT, that meta-tegra will sign the kernel and a few other files that are written to file system partitions.

I would like to be able to use this mechanism to validate some other partitions (e.g., a read-only root file system or an application-specific partition).

I know I can sign files, including those that will be written to partitions, via the tegra_uefi_attach_sign function in the tegra-uefi-signing bbclass.

But I don't know how I can add the partition to the list of those that will be verified by UEFI at boot time. Where can I find this list? Is it modifiable? I'm hoping it's not hard-coded into some boot-loader file somewhere but is in an XML or DTS file somewhere that I can modify.

[ichergui]

Hi @Shamino0
I think you should ask this question into the NVIDIA dev forums.
UEFI/L4T launcher is responsible to verify signature of Linux kernel, DTB and Initrd image. But not memory block. We need a different mechanism to handle that.

[Shamino0]

Thanks. So we won't get this for free. I do see that the signing is done via openssl commands. So we can validate a signature with a custom script that also calls openssl.

Of course, for validating the root file system, we'd have to do that in the initramdisk image.

The public key/certificate is enrolled in the UEFI database. Do you know (or maybe have a pointer to a document) how we could read that certificate from the database? I've started reading some UEFI documentation, but that's drinking from a firehose.