* [PATCH v7 1/4] arm/optee: Add optee udev rules
2024-09-26 15:47 [PATCH v7 0/4] UEFI secureboot Jon Mason
@ 2024-09-26 15:47 ` Jon Mason
2024-09-26 15:47 ` [PATCH v7 2/4] arm/optee-client: fix systemd service dependencies Jon Mason
` (4 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Jon Mason @ 2024-09-26 15:47 UTC (permalink / raw)
To: meta-arm; +Cc: Javier Tia
From: Javier Tia <javier.tia@linaro.org>
If a /dev/teepriv[0-9]* device is detected, start an instance of
tee-supplicant.service with the device name as parameter.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
---
meta-arm/recipes-security/optee/optee-client.inc | 8 +++++++-
.../recipes-security/optee/optee-client/optee-udev.rules | 6 ++++++
2 files changed, 13 insertions(+), 1 deletion(-)
create mode 100644 meta-arm/recipes-security/optee/optee-client/optee-udev.rules
diff --git a/meta-arm/recipes-security/optee/optee-client.inc b/meta-arm/recipes-security/optee/optee-client.inc
index ddda2d1a3ae9..f387c80574b0 100644
--- a/meta-arm/recipes-security/optee/optee-client.inc
+++ b/meta-arm/recipes-security/optee/optee-client.inc
@@ -5,12 +5,13 @@ HOMEPAGE = "https://www.op-tee.org/"
LICENSE = "BSD-2-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b"
-inherit systemd update-rc.d cmake
+inherit systemd update-rc.d cmake useradd
SRC_URI = " \
git://github.com/OP-TEE/optee_client.git;branch=master;protocol=https \
file://tee-supplicant@.service \
file://tee-supplicant.sh \
+ file://optee-udev.rules \
"
UPSTREAM_CHECK_GITTAGREGEX = "^(?P<pver>\d+(\.\d+)+)$"
@@ -26,6 +27,8 @@ EXTRA_OECMAKE:append:toolchain-clang = " -DCFG_WERROR=0"
do_install:append() {
install -D -p -m0644 ${UNPACKDIR}/tee-supplicant@.service ${D}${systemd_system_unitdir}/tee-supplicant@.service
install -D -p -m0755 ${UNPACKDIR}/tee-supplicant.sh ${D}${sysconfdir}/init.d/tee-supplicant
+ install -d ${D}${sysconfdir}/udev/rules.d
+ install -m 0644 ${UNPACKDIR}/optee-udev.rules ${D}${sysconfdir}/udev/rules.d/optee.rules
sed -i -e s:@sysconfdir@:${sysconfdir}:g \
-e s:@sbindir@:${sbindir}:g \
@@ -38,3 +41,6 @@ SYSTEMD_SERVICE:${PN} = "tee-supplicant@.service"
INITSCRIPT_PACKAGES = "${PN}"
INITSCRIPT_NAME:${PN} = "tee-supplicant"
INITSCRIPT_PARAMS:${PN} = "start 10 1 2 3 4 5 . stop 90 0 6 ."
+
+USERADD_PACKAGES = "${PN}"
+GROUPADD_PARAM:${PN} = "--system teeclnt"
diff --git a/meta-arm/recipes-security/optee/optee-client/optee-udev.rules b/meta-arm/recipes-security/optee/optee-client/optee-udev.rules
new file mode 100644
index 000000000000..075f469c04e9
--- /dev/null
+++ b/meta-arm/recipes-security/optee/optee-client/optee-udev.rules
@@ -0,0 +1,6 @@
+KERNEL=="tee[0-9]*", MODE="0660", OWNER="root", GROUP="teeclnt", TAG+="systemd"
+
+# If a /dev/teepriv[0-9]* device is detected, start an instance of
+# tee-supplicant.service with the device name as parameter
+KERNEL=="teepriv[0-9]*", MODE="0660", OWNER="root", GROUP="teeclnt", \
+ TAG+="systemd", ENV{SYSTEMD_WANTS}+="tee-supplicant@%k.service"
--
2.39.5
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v7 2/4] arm/optee-client: fix systemd service dependencies
2024-09-26 15:47 [PATCH v7 0/4] UEFI secureboot Jon Mason
2024-09-26 15:47 ` [PATCH v7 1/4] arm/optee: Add optee udev rules Jon Mason
@ 2024-09-26 15:47 ` Jon Mason
2024-09-26 15:47 ` [PATCH v7 3/4] arm: Enable Secure Boot in all required recipes Jon Mason
` (3 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Jon Mason @ 2024-09-26 15:47 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli
From: Mikko Rapeli <mikko.rapeli@linaro.org>
udev starts tee-supplicant once optee has been found.
Fix dependencies in systemd service so that starting it in
initrd is possible. Stopping requires that ftpm
kernel module is disabled or any TPM related actions will fail until
the next reboot so working around these in the service file. These
are limitations of current kernel optee and ftpm drivers.
tpm2.target requires systemd 256 or newer. With older system version
there is no simple way to queue in service before TPM device is
available.
https://www.freedesktop.org/software/systemd/man/devel/systemd.special.html#tpm2.target
Note that
https://www.freedesktop.org/software/systemd/man/devel/systemd-tpm2-generator.html
detects TPM support from either existing kernel driver (built in or
loaded really early in initrd and rootfs boot) or ACPI table entry for
TPM device. If firmware used a TPM device but doesn't provide ACPI table
entry for it, then a kernel patch has been proposed to expose this to
userspace:
https://lore.kernel.org/lkml/20240422112711.362779-1-mikko.rapeli@linaro.org/
and matching change proposal for systemd:
https://github.com/systemd/systemd/pull/32400
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
---
.../optee/optee-client/tee-supplicant@.service | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/meta-arm/recipes-security/optee/optee-client/tee-supplicant@.service b/meta-arm/recipes-security/optee/optee-client/tee-supplicant@.service
index 72c0b9aa57ec..8325b6be5174 100644
--- a/meta-arm/recipes-security/optee/optee-client/tee-supplicant@.service
+++ b/meta-arm/recipes-security/optee/optee-client/tee-supplicant@.service
@@ -1,10 +1,12 @@
[Unit]
Description=TEE Supplicant on %i
+DefaultDependencies=no
+After=dev-%i.device
+Wants=dev-%i.device
+Conflicts=shutdown.target
+Before=tpm2.target sysinit.target shutdown.target
[Service]
-User=root
EnvironmentFile=-@sysconfdir@/default/tee-supplicant
ExecStart=@sbindir@/tee-supplicant $OPTARGS
-
-[Install]
-WantedBy=basic.target
+ExecStop=-/bin/sh -c "/sbin/modprobe -v -r tpm_ftpm_tee ; /bin/kill $MAINPID"
--
2.39.5
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v7 3/4] arm: Enable Secure Boot in all required recipes
2024-09-26 15:47 [PATCH v7 0/4] UEFI secureboot Jon Mason
2024-09-26 15:47 ` [PATCH v7 1/4] arm/optee: Add optee udev rules Jon Mason
2024-09-26 15:47 ` [PATCH v7 2/4] arm/optee-client: fix systemd service dependencies Jon Mason
@ 2024-09-26 15:47 ` Jon Mason
2024-09-26 15:47 ` [PATCH v7 4/4] arm/qemuarm64-secureboot: Enable UEFI Secure Boot Jon Mason
` (2 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Jon Mason @ 2024-09-26 15:47 UTC (permalink / raw)
To: meta-arm; +Cc: Javier Tia
From: Javier Tia <javier.tia@linaro.org>
In the target, Secure Boot starts from the firmware (u-boot), adds the
signing keys, and verifies the bootloader (systemd-boot) and kernel
(Linux).
The gen-sbkeys recipe generates keys in the host during build time. If
keys are found, it will skip the keys generation. As long as the keys
are the same, it will guarantee build reproducibility.
sbsign bbclass is used to sign the binaries. sbsign is the name of the
tool used to sign these binaries. Hence the name of this class to sbsign
and variables with SBSIGN prefix.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
---
meta-arm/classes/sbsign.bbclass | 31 +++++++++++
.../u-boot/u-boot-uefi-secureboot.inc | 17 ++++++
.../u-boot/u-boot/uefi-secureboot.cfg | 10 ++++
meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend | 2 +
meta-arm/recipes-bsp/uefi/gen-sbkeys.bb | 48 +++++++++++++++++
.../recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh | 52 +++++++++++++++++++
.../systemd/systemd-boot-uefi-secureboot.inc | 7 +++
.../systemd/systemd-boot_%.bbappend | 1 +
meta-arm/recipes-core/systemd/systemd-efi.inc | 1 +
.../recipes-core/systemd/systemd_%.bbappend | 1 +
.../linux/linux-yocto%.bbappend | 2 +
.../linux/linux-yocto-uefi-secureboot.inc | 14 +++++
12 files changed, 186 insertions(+)
create mode 100644 meta-arm/classes/sbsign.bbclass
create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
create mode 100644 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
create mode 100755 meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
diff --git a/meta-arm/classes/sbsign.bbclass b/meta-arm/classes/sbsign.bbclass
new file mode 100644
index 000000000000..551b951dc2b4
--- /dev/null
+++ b/meta-arm/classes/sbsign.bbclass
@@ -0,0 +1,31 @@
+# Sign binaries for UEFI Secure Boot
+#
+# Usage in recipes:
+#
+# Set binary to sign per recipe:
+# SBSIGN_TARGET_BINARY = "${B}/binary_to_sign"
+#
+# Then call do_sbsign() in correct stage of the build
+# do_compile:append() {
+# do_sbsign
+# }
+
+DEPENDS += 'gen-sbkeys'
+DEPENDS += "sbsigntool-native"
+
+SBSIGN_KEY = "${SBSIGN_KEYS_DIR}/db.key"
+SBSIGN_CERT = "${SBSIGN_KEYS_DIR}/db.crt"
+SBSIGN_TARGET_BINARY ?= "binary_to_sign"
+
+# Not adding as task since recipes may need to sign binaries at different
+# stages. Instead they can call this function when needed by calling this function
+do_sbsign() {
+ bbnote "Signing ${PN} binary ${SBSIGN_TARGET_BINARY} with ${SBSIGN_KEY} and ${SBSIGN_CERT}"
+ ${STAGING_BINDIR_NATIVE}/sbsign \
+ --key "${SBSIGN_KEY}" \
+ --cert "${SBSIGN_CERT}" \
+ --output "${SBSIGN_TARGET_BINARY}.signed" \
+ "${SBSIGN_TARGET_BINARY}"
+ cp "${SBSIGN_TARGET_BINARY}" "${SBSIGN_TARGET_BINARY}.unsigned"
+ cp "${SBSIGN_TARGET_BINARY}.signed" "${SBSIGN_TARGET_BINARY}"
+}
diff --git a/meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc b/meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
new file mode 100644
index 000000000000..e58035a9c236
--- /dev/null
+++ b/meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
@@ -0,0 +1,17 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+SRC_URI += "file://uefi-secureboot.cfg"
+
+inherit sbsign
+
+DEPENDS += 'python3-pyopenssl-native'
+
+do_compile:prepend() {
+ export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1
+
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n pk -d "${SBSIGN_KEYS_DIR}"/PK.esl -t file
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n kek -d "${SBSIGN_KEYS_DIR}"/KEK.esl -t file
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n db -d "${SBSIGN_KEYS_DIR}"/db.esl -t file
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n dbx -d "${SBSIGN_KEYS_DIR}"/dbx.esl -t file
+ "${S}"/tools/efivar.py print -i "${S}"/ubootefi.var
+}
diff --git a/meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg b/meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
new file mode 100644
index 000000000000..acdcfdddf3c2
--- /dev/null
+++ b/meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
@@ -0,0 +1,10 @@
+CONFIG_CMD_BOOTMENU=y
+CONFIG_USE_BOOTCOMMAND=y
+CONFIG_BOOTCOMMAND="bootmenu"
+CONFIG_USE_PREBOOT=y
+CONFIG_EFI_VAR_BUF_SIZE=65536
+CONFIG_FIT_SIGNATURE=y
+CONFIG_EFI_SECURE_BOOT=y
+CONFIG_EFI_VARIABLES_PRESEED=y
+CONFIG_PREBOOT="setenv bootmenu_0 UEFI Boot Manager=bootefi bootmgr; setenv bootmenu_1 UEFI Maintenance Menu=eficonfig"
+CONFIG_PREBOOT_DEFINED=y
diff --git a/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend b/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend
index 0683a783891f..8542ccfc9084 100644
--- a/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend
+++ b/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend
@@ -2,3 +2,5 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
SRC_URI:append:qemuarm64-secureboot = " file://qemuarm64.cfg"
SRC_URI:append:qemuarm-secureboot = " file://qemuarm.cfg"
+
+require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-secureboot', 'u-boot-uefi-secureboot.inc', '', d)}
diff --git a/meta-arm/recipes-bsp/uefi/gen-sbkeys.bb b/meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
new file mode 100644
index 000000000000..30c3aced55ea
--- /dev/null
+++ b/meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: MIT
+
+SUMMARY = "Generate Signing UEFI keys for Secure Boot"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+DEPENDS += "bash-native"
+DEPENDS += "coreutils-native"
+DEPENDS += "efitools-native"
+DEPENDS += "openssl-native"
+
+SRC_URI = "file://gen_sbkeys.sh"
+
+UNPACKDIR = "${S}"
+
+do_patch[noexec] = "1"
+do_compile[noexec] = "1"
+do_configure[noexec] = "1"
+do_install[nostamp] = "1"
+
+python do_install() {
+ keys_dir = d.getVar('SBSIGN_KEYS_DIR', True)
+
+ keys_to_check = [
+ keys_dir + "/PK.esl",
+ keys_dir + "/KEK.esl",
+ keys_dir + "/db.esl",
+ keys_dir + "/dbx.esl",
+ keys_dir + "/db.key",
+ keys_dir + "/db.crt",
+ ]
+
+ missing_keys = [f for f in keys_to_check if not os.path.exists(f)]
+
+ if not missing_keys:
+ bb.debug(2, "All UEFI keys found in '%s' to sign binaries'" % keys_dir)
+ return
+
+ gen_sbkeys = d.getVar('UNPACKDIR', True) + "/gen_sbkeys.sh"
+
+ import subprocess
+ bb.debug(2, "Calling '%s' to generate UEFI keys in path: '%s'" % (gen_sbkeys, keys_dir))
+ cmd = "%s %s" % (gen_sbkeys, keys_dir)
+ subprocess.Popen(cmd, shell=True)
+}
+
+FILES:${PN} += "${SBSIGN_KEYS_DIR}/db.key"
+FILES:${PN} += "${SBSIGN_KEYS_DIR}/db.crt"
diff --git a/meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh b/meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
new file mode 100755
index 000000000000..6ad74a315a59
--- /dev/null
+++ b/meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: MIT
+#
+#
+# Set up UEFI Secure Boot keys. Generate keys and certificates, convert them
+# into EFI Signature Lists, and sign them. By managing these keys, you can
+# control what is considered trusted on your system.
+
+set -eux
+
+KEYS_PATH=${1:-./}
+SUBJECT="/CN=OpenEmbedded/"
+
+# The number used is just a GUID random number that has not special meaning.
+# GUID (Globally Unique Identifier) is associated with the signature list. GUIDs
+# in this context are used to uniquely identify the owner or the purpose of the
+# keys within the EFI environment. This GUID can be used to distinguish
+# different lists or purposes within the UEFI firmware settings
+GUID="11111111-2222-3333-4444-123456789abc"
+
+if [ ! -d "${KEYS_PATH}" ]; then
+ mkdir -p "${KEYS_PATH}"
+fi
+
+if [ -f "${KEYS_PATH}"/PK.crt ]; then
+ exit 0
+fi
+
+# Platform Key (PK): The root key in Secure Boot, which authorizes changes to
+# the KEK
+openssl req -x509 -sha256 -newkey rsa:2048 -subj "${SUBJECT}" \
+ -keyout "${KEYS_PATH}"/PK.key -out "${KEYS_PATH}"/PK.crt \
+ -nodes -days 3650
+cert-to-efi-sig-list -g ${GUID} \
+ "${KEYS_PATH}"/PK.crt "${KEYS_PATH}"/PK.esl
+sign-efi-sig-list -c "${KEYS_PATH}"/PK.crt -k "${KEYS_PATH}"/PK.key \
+ "${KEYS_PATH}"/PK "${KEYS_PATH}"/PK.esl "${KEYS_PATH}"/PK.auth
+
+# Key Exchange Key (KEK): Allows for updates to the db and dbx lists
+#
+# db and dbx: Control lists for allowed and disallowed executable files and
+# drivers
+for key in KEK db dbx; do
+ openssl req -x509 -sha256 -newkey rsa:2048 -subj "${SUBJECT}" \
+ -keyout "${KEYS_PATH}"/${key}.key -out "${KEYS_PATH}"/${key}.crt \
+ -nodes -days 3650
+ cert-to-efi-sig-list -g ${GUID} \
+ "${KEYS_PATH}"/${key}.crt "${KEYS_PATH}"/${key}.esl
+ sign-efi-sig-list -c "${KEYS_PATH}"/PK.crt -k "${KEYS_PATH}"/PK.key \
+ "${KEYS_PATH}"/${key} "${KEYS_PATH}"/${key}.esl "${KEYS_PATH}"/${key}.auth
+done
diff --git a/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc b/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
new file mode 100644
index 000000000000..84196a681e06
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
@@ -0,0 +1,7 @@
+inherit sbsign
+
+SBSIGN_TARGET_BINARY = "${B}/src/boot/efi/systemd-boot${EFI_ARCH}.efi"
+
+do_compile:append() {
+ do_sbsign
+}
diff --git a/meta-arm/recipes-core/systemd/systemd-boot_%.bbappend b/meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
new file mode 100644
index 000000000000..9850bbf9a663
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
@@ -0,0 +1 @@
+require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-secureboot', 'systemd-boot-uefi-secureboot.inc', '', d)}
diff --git a/meta-arm/recipes-core/systemd/systemd-efi.inc b/meta-arm/recipes-core/systemd/systemd-efi.inc
new file mode 100644
index 000000000000..5572e51ae917
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd-efi.inc
@@ -0,0 +1 @@
+PACKAGECONFIG:append = " efi"
diff --git a/meta-arm/recipes-core/systemd/systemd_%.bbappend b/meta-arm/recipes-core/systemd/systemd_%.bbappend
new file mode 100644
index 000000000000..660358c29b9d
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd_%.bbappend
@@ -0,0 +1 @@
+require ${@bb.utils.contains('MACHINE_FEATURES', 'efi', 'systemd-efi.inc', '', d)}
diff --git a/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend b/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend
index a287d0e1814a..71e643a95496 100644
--- a/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend
+++ b/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend
@@ -25,3 +25,5 @@ SRC_URI:append:qemuarm = " \
FFA_TRANSPORT_INCLUDE = "${@bb.utils.contains('MACHINE_FEATURES', 'arm-ffa', 'arm-ffa-transport.inc', '' , d)}"
require ${FFA_TRANSPORT_INCLUDE}
+
+require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-secureboot', 'linux-yocto-uefi-secureboot.inc', '', d)}
diff --git a/meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc b/meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
new file mode 100644
index 000000000000..5c1f4de7a0ad
--- /dev/null
+++ b/meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
@@ -0,0 +1,14 @@
+KERNEL_FEATURES += "cfg/efi-ext.scc"
+
+inherit sbsign
+
+# shell variable set inside do_compile task
+SBSIGN_TARGET_BINARY = "$KERNEL_IMAGE"
+
+do_compile:append() {
+ KERNEL_IMAGE=$(find ${B} -name ${KERNEL_IMAGETYPE} -print -quit)
+ do_sbsign
+}
+
+RRECOMMENDS:${PN} += "kernel-module-efivarfs"
+RRECOMMENDS:${PN} += "kernel-module-efivars"
--
2.39.5
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v7 4/4] arm/qemuarm64-secureboot: Enable UEFI Secure Boot
2024-09-26 15:47 [PATCH v7 0/4] UEFI secureboot Jon Mason
` (2 preceding siblings ...)
2024-09-26 15:47 ` [PATCH v7 3/4] arm: Enable Secure Boot in all required recipes Jon Mason
@ 2024-09-26 15:47 ` Jon Mason
2024-09-26 15:55 ` [meta-arm] [PATCH v7 0/4] UEFI secureboot Javier Tia
2024-09-26 15:58 ` Mikko Rapeli
5 siblings, 0 replies; 9+ messages in thread
From: Jon Mason @ 2024-09-26 15:47 UTC (permalink / raw)
To: meta-arm; +Cc: Javier Tia
From: Javier Tia <javier.tia@linaro.org>
Encapsulate all UEFI Secure Boot required settings in one Kas
configuration file.
Introduce SBSIGN_KEYS_DIR variable where UEFI keys will be generated
to sign UEFI binaries.
Introduce uefi-secureboot machine feature, which is being used to
conditionally set the proper UEFI settings in recipes.
Replace Grub bootloader with systemd-boot, which it makes easier to
enable Secure Boot.
Advantages using systemd as Init Manager:
- Extending secure boot to userspace is a lot easier with systemd than
with sysvinit where custom scripts will need to be written for all use
cases.
- systemd supports dm-verity and TPM devices for encryption usecases out
of the box. Enabling them is a lot easier than writing custom scripts
for sysvinit.
- systemd also supports EUFI signing the UKI binaries which merge kernel,
command line and initrd which helps in bringing secure boot towards
rootfs.
- systemd offers a modular structure with unit files that are more
predictable and easier to manage than the complex and varied scripts
used by SysVinit. This modularity allows for better control and
customization of the boot process, which is beneficial in Secure Boot
environments.
- Add CI settings to build and test UEFI Secure Boot.
Add one test to verify Secure Boot using OE Testing infraestructure:
$ kas build ci/qemuarm64-secureboot.yml:ci/uefi-secureboot.yml:ci/testimage.yml
...
RESULTS - uefi_secureboot.UEFI_SB_TestSuite.test_uefi_secureboot: PASSED (0.62s)
...
SUMMARY:
core-image-base () - Ran 73 tests in 28.281s
core-image-base - OK - All required tests passed (successes=19, skipped=54, failures=0, errors=0)
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
---
.gitlab-ci.yml | 1 +
ci/uefi-secureboot.yml | 37 +++++++++++++++++++
.../lib/oeqa/runtime/cases/uefi_secureboot.py | 29 +++++++++++++++
3 files changed, 67 insertions(+)
create mode 100644 ci/uefi-secureboot.yml
create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e8627731e244..1ea167c63d8e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -272,6 +272,7 @@ qemuarm64-secureboot:
TOOLCHAINS: [gcc, clang]
TCLIBC: [glibc, musl]
TS: [none, qemuarm64-secureboot-ts]
+ UEFISB: [none, uefi-secureboot]
TESTING: testimage
- KERNEL: linux-yocto-dev
TESTING: testimage
diff --git a/ci/uefi-secureboot.yml b/ci/uefi-secureboot.yml
new file mode 100644
index 000000000000..fd95b876943c
--- /dev/null
+++ b/ci/uefi-secureboot.yml
@@ -0,0 +1,37 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
+
+# UEFI Secure Boot: A mechanism to ensure that only trusted software is executed
+# during the boot process.
+
+header:
+ version: 14
+ includes:
+ - ci/meta-openembedded.yml
+ - ci/meta-secure-core.yml
+
+local_conf_header:
+ uefi_secureboot: |
+ SBSIGN_KEYS_DIR = "${TOPDIR}/sbkeys"
+ BB_ENV_PASSTHROUGH_ADDITIONS = "SBSIGN_KEYS_DIR"
+
+ # Detected by passing kernel parameter
+ QB_KERNEL_ROOT = ""
+
+ # kernel is in the image, should not be loaded separately
+ QB_DEFAULT_KERNEL = "none"
+
+ WKS_FILE = "efi-disk.wks.in"
+ KERNEL_IMAGETYPE = "Image"
+
+ MACHINE_FEATURES:append = " efi uefi-secureboot"
+
+ EFI_PROVIDER = "systemd-boot"
+
+ # Use systemd as the init system
+ INIT_MANAGER = "systemd"
+ DISTRO_FEATURES:append = " systemd"
+ DISTRO_FEATURES_NATIVE:append = " systemd"
+
+ IMAGE_INSTALL:append = " systemd systemd-boot util-linux coreutils efivar"
+
+ TEST_SUITES:append = " uefi_secureboot"
diff --git a/meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py b/meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
new file mode 100644
index 000000000000..9e47ea8dfecd
--- /dev/null
+++ b/meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
@@ -0,0 +1,29 @@
+#
+# SPDX-License-Identifier: MIT
+#
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.oetimeout import OETimeout
+
+
+class UEFI_SB_TestSuite(OERuntimeTestCase):
+ """
+ Validate Secure Boot is Enabled
+ """
+
+ @OETimeout(1300)
+ def test_uefi_secureboot(self):
+ # Validate Secure Boot is enabled by checking
+ # 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot.
+ # The GUID '8be4df61-93ca-11d2-aa0d-00e098032b8c' is a well-known
+ # identifier for the Secure Boot UEFI variable. By checking the value of
+ # this variable, specifically
+ # '8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot', we can determine
+ # whether Secure Boot is enabled or not. This variable is set by the
+ # UEFI firmware to indicate the current Secure Boot state. If the
+ # variable is set to a value of '0x1' (or '1'), it indicates that Secure
+ # Boot is enabled. If the variable is set to a value of '0x0' (or '0'),
+ # it indicates that Secure Boot is disabled.
+ cmd = "efivar -d -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot"
+ status, output = self.target.run(cmd, timeout=120)
+ self.assertEqual(output, "1", msg="\n".join([cmd, output]))
--
2.39.5
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [meta-arm] [PATCH v7 0/4] UEFI secureboot
2024-09-26 15:47 [PATCH v7 0/4] UEFI secureboot Jon Mason
` (3 preceding siblings ...)
2024-09-26 15:47 ` [PATCH v7 4/4] arm/qemuarm64-secureboot: Enable UEFI Secure Boot Jon Mason
@ 2024-09-26 15:55 ` Javier Tia
2024-09-26 16:35 ` Jon Mason
2024-09-26 15:58 ` Mikko Rapeli
5 siblings, 1 reply; 9+ messages in thread
From: Javier Tia @ 2024-09-26 15:55 UTC (permalink / raw)
To: jdmason, meta-arm
Hi Jon,
On 9/26/24 9:47 AM, Jon Mason via lists.yoctoproject.org wrote:
> Sending a modified version of Javier's patches, combined with a subset
> of the patches sent out by Mikko recently. This was done to expedite
> the acceptance of this series (given the code freeze tomorrow). Also,
> the optee update that Mikko's series included cannot be included (given
> the code freeze). 2 of that series are needed for this one. So,
> combining everything into this and sending it out publicly for Javier,
> Mikko, and anyone else to ack/nack.
Thank you for sending them ahead of me, as I was just preparing the cover letter to send them out as v7.
> Thanks,
> Jon
>
>
> Javier Tia (3):
> arm/optee: Add optee udev rules
> arm: Enable Secure Boot in all required recipes
> arm/qemuarm64-secureboot: Enable UEFI Secure Boot
>
> Mikko Rapeli (1):
> arm/optee-client: fix systemd service dependencies
>
> .gitlab-ci.yml | 1 +
> ci/uefi-secureboot.yml | 37 +++++++++++++
> meta-arm/classes/sbsign.bbclass | 31 +++++++++++
> .../lib/oeqa/runtime/cases/uefi_secureboot.py | 29 +++++++++++
> .../u-boot/u-boot-uefi-secureboot.inc | 17 ++++++
> .../u-boot/u-boot/uefi-secureboot.cfg | 10 ++++
> meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend | 2 +
> meta-arm/recipes-bsp/uefi/gen-sbkeys.bb | 48 +++++++++++++++++
> .../recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh | 52 +++++++++++++++++++
> .../systemd/systemd-boot-uefi-secureboot.inc | 7 +++
> .../systemd/systemd-boot_%.bbappend | 1 +
> meta-arm/recipes-core/systemd/systemd-efi.inc | 1 +
> .../recipes-core/systemd/systemd_%.bbappend | 1 +
> .../linux/linux-yocto%.bbappend | 2 +
> .../linux/linux-yocto-uefi-secureboot.inc | 14 +++++
> .../recipes-security/optee/optee-client.inc | 8 ++-
> .../optee/optee-client/optee-udev.rules | 6 +++
> .../optee-client/tee-supplicant@.service | 10 ++--
> 18 files changed, 272 insertions(+), 5 deletions(-)
> create mode 100644 ci/uefi-secureboot.yml
> create mode 100644 meta-arm/classes/sbsign.bbclass
> create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
> create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
> create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
> create mode 100644 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
> create mode 100755 meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
> create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
> create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
> create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
> create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
> create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
> create mode 100644 meta-arm/recipes-security/optee/optee-client/optee-udev.rules
>
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#6117): https://lists.yoctoproject.org/g/meta-arm/message/6117
> Mute This Topic: https://lists.yoctoproject.org/mt/108670112/7165667
> Group Owner: meta-arm+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-arm/unsub [javier.tia@linaro.org]
> -=-=-=-=-=-=-=-=-=-=-=-
>
» Javier Tia 🖋
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [meta-arm] [PATCH v7 0/4] UEFI secureboot
2024-09-26 15:55 ` [meta-arm] [PATCH v7 0/4] UEFI secureboot Javier Tia
@ 2024-09-26 16:35 ` Jon Mason
0 siblings, 0 replies; 9+ messages in thread
From: Jon Mason @ 2024-09-26 16:35 UTC (permalink / raw)
To: Javier Tia; +Cc: meta-arm
On Thu, Sep 26, 2024 at 11:55 AM Javier Tia <javier.tia@linaro.org> wrote:
>
> Hi Jon,
>
> On 9/26/24 9:47 AM, Jon Mason via lists.yoctoproject.org wrote:
> > Sending a modified version of Javier's patches, combined with a subset
> > of the patches sent out by Mikko recently. This was done to expedite
> > the acceptance of this series (given the code freeze tomorrow). Also,
> > the optee update that Mikko's series included cannot be included (given
> > the code freeze). 2 of that series are needed for this one. So,
> > combining everything into this and sending it out publicly for Javier,
> > Mikko, and anyone else to ack/nack.
>
> Thank you for sending them ahead of me, as I was just preparing the cover letter to send them out as v7.
Sorry about that. I'm very eager to get this in (as I'm sure you are
too). It's in master-next now
>
> > Thanks,
> > Jon
> >
> >
> > Javier Tia (3):
> > arm/optee: Add optee udev rules
> > arm: Enable Secure Boot in all required recipes
> > arm/qemuarm64-secureboot: Enable UEFI Secure Boot
> >
> > Mikko Rapeli (1):
> > arm/optee-client: fix systemd service dependencies
> >
> > .gitlab-ci.yml | 1 +
> > ci/uefi-secureboot.yml | 37 +++++++++++++
> > meta-arm/classes/sbsign.bbclass | 31 +++++++++++
> > .../lib/oeqa/runtime/cases/uefi_secureboot.py | 29 +++++++++++
> > .../u-boot/u-boot-uefi-secureboot.inc | 17 ++++++
> > .../u-boot/u-boot/uefi-secureboot.cfg | 10 ++++
> > meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend | 2 +
> > meta-arm/recipes-bsp/uefi/gen-sbkeys.bb | 48 +++++++++++++++++
> > .../recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh | 52 +++++++++++++++++++
> > .../systemd/systemd-boot-uefi-secureboot.inc | 7 +++
> > .../systemd/systemd-boot_%.bbappend | 1 +
> > meta-arm/recipes-core/systemd/systemd-efi.inc | 1 +
> > .../recipes-core/systemd/systemd_%.bbappend | 1 +
> > .../linux/linux-yocto%.bbappend | 2 +
> > .../linux/linux-yocto-uefi-secureboot.inc | 14 +++++
> > .../recipes-security/optee/optee-client.inc | 8 ++-
> > .../optee/optee-client/optee-udev.rules | 6 +++
> > .../optee-client/tee-supplicant@.service | 10 ++--
> > 18 files changed, 272 insertions(+), 5 deletions(-)
> > create mode 100644 ci/uefi-secureboot.yml
> > create mode 100644 meta-arm/classes/sbsign.bbclass
> > create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
> > create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
> > create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
> > create mode 100644 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
> > create mode 100755 meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
> > create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
> > create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
> > create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
> > create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
> > create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
> > create mode 100644 meta-arm/recipes-security/optee/optee-client/optee-udev.rules
> >
> >
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#6117): https://lists.yoctoproject.org/g/meta-arm/message/6117
> > Mute This Topic: https://lists.yoctoproject.org/mt/108670112/7165667
> > Group Owner: meta-arm+owner@lists.yoctoproject.org
> > Unsubscribe: https://lists.yoctoproject.org/g/meta-arm/unsub [javier.tia@linaro.org]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
>
>
> » Javier Tia 🖋
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [meta-arm] [PATCH v7 0/4] UEFI secureboot
2024-09-26 15:47 [PATCH v7 0/4] UEFI secureboot Jon Mason
` (4 preceding siblings ...)
2024-09-26 15:55 ` [meta-arm] [PATCH v7 0/4] UEFI secureboot Javier Tia
@ 2024-09-26 15:58 ` Mikko Rapeli
2024-09-26 16:37 ` Jon Mason
5 siblings, 1 reply; 9+ messages in thread
From: Mikko Rapeli @ 2024-09-26 15:58 UTC (permalink / raw)
To: jdmason; +Cc: meta-arm
Hi,
On Thu, Sep 26, 2024 at 11:47:35AM -0400, Jon Mason via lists.yoctoproject.org wrote:
> Sending a modified version of Javier's patches, combined with a subset
> of the patches sent out by Mikko recently. This was done to expedite
> the acceptance of this series (given the code freeze tomorrow). Also,
> the optee update that Mikko's series included cannot be included (given
> the code freeze). 2 of that series are needed for this one. So,
> combining everything into this and sending it out publicly for Javier,
> Mikko, and anyone else to ack/nack.
ACK, optee 4.3 stuff later then.
Cheers,
-Mikko
> Thanks,
> Jon
>
>
> Javier Tia (3):
> arm/optee: Add optee udev rules
> arm: Enable Secure Boot in all required recipes
> arm/qemuarm64-secureboot: Enable UEFI Secure Boot
>
> Mikko Rapeli (1):
> arm/optee-client: fix systemd service dependencies
>
> .gitlab-ci.yml | 1 +
> ci/uefi-secureboot.yml | 37 +++++++++++++
> meta-arm/classes/sbsign.bbclass | 31 +++++++++++
> .../lib/oeqa/runtime/cases/uefi_secureboot.py | 29 +++++++++++
> .../u-boot/u-boot-uefi-secureboot.inc | 17 ++++++
> .../u-boot/u-boot/uefi-secureboot.cfg | 10 ++++
> meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend | 2 +
> meta-arm/recipes-bsp/uefi/gen-sbkeys.bb | 48 +++++++++++++++++
> .../recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh | 52 +++++++++++++++++++
> .../systemd/systemd-boot-uefi-secureboot.inc | 7 +++
> .../systemd/systemd-boot_%.bbappend | 1 +
> meta-arm/recipes-core/systemd/systemd-efi.inc | 1 +
> .../recipes-core/systemd/systemd_%.bbappend | 1 +
> .../linux/linux-yocto%.bbappend | 2 +
> .../linux/linux-yocto-uefi-secureboot.inc | 14 +++++
> .../recipes-security/optee/optee-client.inc | 8 ++-
> .../optee/optee-client/optee-udev.rules | 6 +++
> .../optee-client/tee-supplicant@.service | 10 ++--
> 18 files changed, 272 insertions(+), 5 deletions(-)
> create mode 100644 ci/uefi-secureboot.yml
> create mode 100644 meta-arm/classes/sbsign.bbclass
> create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
> create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
> create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
> create mode 100644 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
> create mode 100755 meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
> create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
> create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
> create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
> create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
> create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
> create mode 100644 meta-arm/recipes-security/optee/optee-client/optee-udev.rules
>
> --
> 2.39.5
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#6117): https://lists.yoctoproject.org/g/meta-arm/message/6117
> Mute This Topic: https://lists.yoctoproject.org/mt/108670112/7159507
> Group Owner: meta-arm+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-arm/unsub [mikko.rapeli@linaro.org]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [meta-arm] [PATCH v7 0/4] UEFI secureboot
2024-09-26 15:58 ` Mikko Rapeli
@ 2024-09-26 16:37 ` Jon Mason
0 siblings, 0 replies; 9+ messages in thread
From: Jon Mason @ 2024-09-26 16:37 UTC (permalink / raw)
To: Mikko Rapeli; +Cc: meta-arm
On Thu, Sep 26, 2024 at 11:58 AM Mikko Rapeli <mikko.rapeli@linaro.org> wrote:
>
> Hi,
>
> On Thu, Sep 26, 2024 at 11:47:35AM -0400, Jon Mason via lists.yoctoproject.org wrote:
> > Sending a modified version of Javier's patches, combined with a subset
> > of the patches sent out by Mikko recently. This was done to expedite
> > the acceptance of this series (given the code freeze tomorrow). Also,
> > the optee update that Mikko's series included cannot be included (given
> > the code freeze). 2 of that series are needed for this one. So,
> > combining everything into this and sending it out publicly for Javier,
> > Mikko, and anyone else to ack/nack.
>
> ACK, optee 4.3 stuff later then.
We'll probably create a styhead branch soon(-ish). Once that happens,
I can apply the other patches from that series to master-next.
>
> Cheers,
>
> -Mikko
>
> > Thanks,
> > Jon
> >
> >
> > Javier Tia (3):
> > arm/optee: Add optee udev rules
> > arm: Enable Secure Boot in all required recipes
> > arm/qemuarm64-secureboot: Enable UEFI Secure Boot
> >
> > Mikko Rapeli (1):
> > arm/optee-client: fix systemd service dependencies
> >
> > .gitlab-ci.yml | 1 +
> > ci/uefi-secureboot.yml | 37 +++++++++++++
> > meta-arm/classes/sbsign.bbclass | 31 +++++++++++
> > .../lib/oeqa/runtime/cases/uefi_secureboot.py | 29 +++++++++++
> > .../u-boot/u-boot-uefi-secureboot.inc | 17 ++++++
> > .../u-boot/u-boot/uefi-secureboot.cfg | 10 ++++
> > meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend | 2 +
> > meta-arm/recipes-bsp/uefi/gen-sbkeys.bb | 48 +++++++++++++++++
> > .../recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh | 52 +++++++++++++++++++
> > .../systemd/systemd-boot-uefi-secureboot.inc | 7 +++
> > .../systemd/systemd-boot_%.bbappend | 1 +
> > meta-arm/recipes-core/systemd/systemd-efi.inc | 1 +
> > .../recipes-core/systemd/systemd_%.bbappend | 1 +
> > .../linux/linux-yocto%.bbappend | 2 +
> > .../linux/linux-yocto-uefi-secureboot.inc | 14 +++++
> > .../recipes-security/optee/optee-client.inc | 8 ++-
> > .../optee/optee-client/optee-udev.rules | 6 +++
> > .../optee-client/tee-supplicant@.service | 10 ++--
> > 18 files changed, 272 insertions(+), 5 deletions(-)
> > create mode 100644 ci/uefi-secureboot.yml
> > create mode 100644 meta-arm/classes/sbsign.bbclass
> > create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
> > create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
> > create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
> > create mode 100644 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
> > create mode 100755 meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
> > create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
> > create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
> > create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
> > create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
> > create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
> > create mode 100644 meta-arm/recipes-security/optee/optee-client/optee-udev.rules
> >
> > --
> > 2.39.5
> >
>
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#6117): https://lists.yoctoproject.org/g/meta-arm/message/6117
> > Mute This Topic: https://lists.yoctoproject.org/mt/108670112/7159507
> > Group Owner: meta-arm+owner@lists.yoctoproject.org
> > Unsubscribe: https://lists.yoctoproject.org/g/meta-arm/unsub [mikko.rapeli@linaro.org]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
>
^ permalink raw reply [flat|nested] 9+ messages in thread