doc/efi: rework secure boot description
Ensure a uniform formatting. Some rephrasing. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This commit is contained in:
Heinrich Schuchardt
parent
11078bb262
commit
788bd90bf8
|
|
@ -100,79 +100,93 @@ See doc/uImage.FIT/howto.txt for an introduction to FIT images.
|
|||
Configuring UEFI secure boot
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
UEFI specification[1] defines a secure way of executing UEFI images
|
||||
The UEFI specification[1] defines a secure way of executing UEFI images
|
||||
by verifying a signature (or message digest) of image with certificates.
|
||||
This feature on U-Boot is enabled with::
|
||||
|
||||
CONFIG_UEFI_SECURE_BOOT=y
|
||||
|
||||
To make the boot sequence safe, you need to establish a chain of trust;
|
||||
In UEFI secure boot, you can make it with the UEFI variables, "PK"
|
||||
(Platform Key), "KEK" (Key Exchange Keys), "db" (white list database)
|
||||
and "dbx" (black list database).
|
||||
In UEFI secure boot the chain trust is defined by the following UEFI variables
|
||||
|
||||
There are many online documents that describe what UEFI secure boot is
|
||||
and how it works. Please consult some of them for details.
|
||||
* PK - Platform Key
|
||||
* KEK - Key Exchange Keys
|
||||
* db - white list database
|
||||
* dbx - black list database
|
||||
|
||||
Here is a simple example that you can follow for your initial attempt
|
||||
(Please note that the actual steps would absolutely depend on your system
|
||||
and environment.):
|
||||
An in depth description of UEFI secure boot is beyond the scope of this
|
||||
document. Please, refer to the UEFI specification and available online
|
||||
documentation. Here is a simple example that you can follow for your initial
|
||||
attempt (Please note that the actual steps will depend on your system and
|
||||
environment.):
|
||||
|
||||
1. Install utility commands on your host
|
||||
* openssl
|
||||
* efitools
|
||||
* sbsigntool
|
||||
Install the required tools on your host
|
||||
|
||||
2. Create signing keys and key database files on your host
|
||||
for PK::
|
||||
* openssl
|
||||
* efitools
|
||||
* sbsigntool
|
||||
|
||||
$ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ \
|
||||
-keyout PK.key -out PK.crt -nodes -days 365
|
||||
$ cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
|
||||
PK.crt PK.esl;
|
||||
$ sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth
|
||||
Create signing keys and the key database on your host:
|
||||
|
||||
for KEK::
|
||||
The platform key
|
||||
|
||||
$ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ \
|
||||
-keyout KEK.key -out KEK.crt -nodes -days 365
|
||||
$ cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
|
||||
KEK.crt KEK.esl
|
||||
$ sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth
|
||||
.. code-block:: bash
|
||||
|
||||
for db::
|
||||
openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ \
|
||||
-keyout PK.key -out PK.crt -nodes -days 365
|
||||
cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
|
||||
PK.crt PK.esl;
|
||||
sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth
|
||||
|
||||
$ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ \
|
||||
-keyout db.key -out db.crt -nodes -days 365
|
||||
$ cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
|
||||
db.crt db.esl
|
||||
$ sign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth
|
||||
The key exchange keys
|
||||
|
||||
Copy \*.auth to media, say mmc, that is accessible from U-Boot.
|
||||
.. code-block:: bash
|
||||
|
||||
3. Sign an image with one key in "db" on your host::
|
||||
openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ \
|
||||
-keyout KEK.key -out KEK.crt -nodes -days 365
|
||||
cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
|
||||
KEK.crt KEK.esl
|
||||
sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth
|
||||
|
||||
$ sbsign --key db.key --cert db.crt helloworld.efi
|
||||
The whitelist database
|
||||
|
||||
4. Install keys on your board::
|
||||
.. code-block:: bash
|
||||
|
||||
==> fatload mmc 0:1 <tmpaddr> PK.auth
|
||||
==> setenv -e -nv -bs -rt -at -i <tmpaddr>,$filesize PK
|
||||
==> fatload mmc 0:1 <tmpaddr> KEK.auth
|
||||
==> setenv -e -nv -bs -rt -at -i <tmpaddr>,$filesize KEK
|
||||
==> fatload mmc 0:1 <tmpaddr> db.auth
|
||||
==> setenv -e -nv -bs -rt -at -i <tmpaddr>,$filesize db
|
||||
$ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ \
|
||||
-keyout db.key -out db.crt -nodes -days 365
|
||||
$ cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
|
||||
db.crt db.esl
|
||||
$ sign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth
|
||||
|
||||
5. Set up boot parameters on your board::
|
||||
Copy the \*.auth files to media, say mmc, that is accessible from U-Boot.
|
||||
|
||||
==> efidebug boot add 1 HELLO mmc 0:1 /helloworld.efi.signed ""
|
||||
Sign an image with one of the keys in "db" on your host
|
||||
|
||||
Then your board runs that image from Boot manager (See below).
|
||||
.. code-block:: bash
|
||||
|
||||
sbsign --key db.key --cert db.crt helloworld.efi
|
||||
|
||||
Now in U-Boot install the keys on your board::
|
||||
|
||||
fatload mmc 0:1 <tmpaddr> PK.auth
|
||||
setenv -e -nv -bs -rt -at -i <tmpaddr>,$filesize PK
|
||||
fatload mmc 0:1 <tmpaddr> KEK.auth
|
||||
setenv -e -nv -bs -rt -at -i <tmpaddr>,$filesize KEK
|
||||
fatload mmc 0:1 <tmpaddr> db.auth
|
||||
setenv -e -nv -bs -rt -at -i <tmpaddr>,$filesize db
|
||||
|
||||
Set up boot parameters on your board::
|
||||
|
||||
efidebug boot add 1 HELLO mmc 0:1 /helloworld.efi.signed ""
|
||||
|
||||
Now your board can run the signed image via the boot manager (see below).
|
||||
You can also try this sequence by running Pytest, test_efi_secboot,
|
||||
on sandbox::
|
||||
on the sandbox
|
||||
|
||||
$ cd <U-Boot source directory>
|
||||
$ pytest.py test/py/tests/test_efi_secboot/test_signed.py --bd sandbox
|
||||
.. code-block:: bash
|
||||
|
||||
cd <U-Boot source directory>
|
||||
pytest.py test/py/tests/test_efi_secboot/test_signed.py --bd sandbox
|
||||
|
||||
Executing the boot manager
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
|
|
|||
Loading…
Reference in New Issue