mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-22 07:12:39 +00:00
powerpc/ieee1275: Read the db and dbx secure boot variables
Enhancing the infrastructure to enable the Platform Keystore (PKS) feature,
which provides access to the SB_VERSION, db, and dbx secure boot variables
from PKS.
If PKS is enabled, it will read secure boot variables such as db and dbx
from PKS and extract EFI Signature List (ESL) from it. The ESLs would be
saved in the Platform Keystore buffer, and the appendedsig module would
read it later to extract the certificate's details from ESL.
In the following scenarios, static key management mode will be activated:
1. When Secure Boot is enabled with static key management mode
2. When SB_VERSION is unavailable but Secure Boot is enabled
3. When PKS support is unavailable but Secure Boot is enabled
Note:
SB_VERSION: Key Management Mode
1 - Enable dynamic key management mode. Read the db and dbx variables from PKS,
and use them for signature verification.
0 - Enable static key management mode. Read keys from the GRUB ELF Note and
use it for signature verification.
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
1 parent
069f3614e6
commit
76158ed1ad
9 files changed
+640
-1
No files matched your search
@@ -51,6 +51,8 @@
|
||||
#endif
|
||||
#if defined(__powerpc__)
|
||||
#include <grub/lockdown.h>
|
||||
#include <grub/powerpc/ieee1275/ieee1275.h>
|
||||
#include <grub/powerpc/ieee1275/platform_keystore.h>
|
||||
#endif
|
||||
|
||||
#ifdef __powerpc__
|
||||
@@ -1043,6 +1045,8 @@ grub_ieee1275_get_secure_boot (void)
|
||||
}
|
||||
else
|
||||
grub_dprintf ("ieee1275", "Secure Boot Disabled\n");
|
||||
|
||||
grub_pks_keystore_init ();
|
||||
}
|
||||
#endif /* __powerpc__ */
|
||||
grub_addr_t grub_modbase;
|
||||
|
||||
Reference in new issue
Block a user