-
Notifications
You must be signed in to change notification settings - Fork 284
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New API methods for status about SecureBoot and UEFI certs #5566
Conversation
a0e8fa2
to
2efb70f
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks ok otherwise.
2efb70f
to
62b8a61
Compare
Can this be changed from the CLI? It looks like it can't but I think it should be observable and update-able from the CLI. |
Working on it as we speak. We will need the CLI implem for our tests. :) Edit: Done 👍 |
afc5343
to
41cd758
Compare
f9180a8
to
1f84bd0
Compare
Hi! Any update on this? It's really important for us to have in our next XCP-ng release and we'd like to start implementing the tests and clients side once we're assured the API won't move too much. Thx |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Aside from the comments that need to be addressed, you should rebase the PR on top of the latest master, it will make the strange python errors go away
5a0e802
to
9746d6d
Compare
c1fc346
to
1c111b0
Compare
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
Calls `varstore-sb-state` to edit the uefi mode of a VM Takes in input the uuid of a VM and a mode (`setup` or `user`) Returns the output of the script calls Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
Codecov ReportAll modified and coverable lines are covered by tests ✅ Additional details and impacted files@@ Coverage Diff @@
## master #5566 +/- ##
========================================
- Coverage 51.3% 44.7% -6.6%
========================================
Files 13 16 +3
Lines 1927 2206 +279
========================================
- Hits 990 988 -2
- Misses 937 1218 +281 see 5 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. |
Comments addressed, commits squashed, rebased on master! 👍 |
Returns the SecureBoot status of a VM: - `not_supported`: VM's firmware is not UEFI - `disabled`: Secureboot is disabled on this VM - `first_boot`: Secured boot is enabled on this VM and its NVRAM.EFI-variables is empty - `ready`: Secured boot is enabled on this VM and PK, KEK, db and dbx are defined in its EFI variables - `ready_no_dbx`: Secured boot is enabled on this VM and PK, KEK, db but not dbx are defined in its EFI variables - `setup_mode`: Secured boot is enabled on this VM and PK is not defined in its EFI variables - `certs_incomplete`: Secured boot is enabled on this VM and the certificates defines in its EFI variables are incomplete Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
Returns a pool's state for guest SecureBoot: - `ready`: the active pool UEFI certificates (custom ones first, default ones if no custom ones) contain PK, KEK, db and dbx - `ready_no_dbx`: the active pool UEFI certificates contain PK, KEK and db but not dbx - `not_ready`: otherwise Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
See: xapi-project/xen-api#5566 Signed-off-by: Benjamin Reis <benjamin.reis@vates.tech>
Implement what's discussed here: #5548
New API calls:
VM.set_uefi_mode
: callsvarstore-sb-state
to edit the uefi mode of a VMTakes in input the uuid of a VM and a mode (
setup
oruser
)Returns the output of the script calls
VM.get_secureboot_readiness
API callReturns the SecureBoot status of a VM:
not_supported
: VM's firmware is not UEFIdisabled
: Secureboot is disabled on this VMfirst_boot
: Secured boot is enabled on this VM and its NVRAM.EFI-variables is emptyready
: Secured boot is enabled on this VM and PK, KEK, db and dbx are defined in its EFI variablesready_no_dbx
: Secured boot is enabled on this VM and PK, KEK, db but not dbx are defined in its EFI variablessetup_mode
: Secured boot is enabled on this VM and PK is not defined in its EFI variablescerts_incomplete
: Secured boot is enabled on this VM and the certificates defines in its EFI variables are incompletePool.get_guest_secureboot_readiness
API callReturns a pool's state for guest SecureBoot:
ready
: the active pool UEFI certificates (custom ones first, default ones if no custom ones) contain PK, KEK, db and dbxready_no_dbx
: the active pool UEFI certificates contain PK, KEK and db but not dbxnot_ready
: otherwise