Re: [isar-cip-core][PATCH 3/7] cip-core-initramfs: Automatically deploy secure boot keys on first boot

[Jan Kiszka <jan.kiszka@siemens.com>]

On 26.08.26 10:17, Heinisch, Alexander (FT RPD CED SES-AT) wrote:
> 
> 
> Am 26.08.2026 um 07:41 schrieb Jan Kiszka:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> This both simplifies the initial deployment of secure boot to a device
>> as well as makes sure that we will always seal the disk encryption key
>> against the right state.
>>
>> We only deploy if secure boot is off and the db is found empty. So this
>> hook is not intended to be used for key exchange or key db extensions.
>> The former will be once handled via SWUpdate packages, the latter might
>> be considered given a concrete use case.
>>
>> Note that due to the primitive implementation of efivarfs detection in
>> efitools, we need to deploy a horrible hack to make it work against the
>> mount implementation of busybox in the initramfs. A patch to improve
>> that issue is pending upstream.
>>
>> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
>> ---
>>   .../cip-core-initramfs/cip-core-initramfs.bb  |  1 +
>>   .../initramfs-sbkeys-hook/files/hook          | 16 +++++++++
>>   .../initramfs-sbkeys-hook/files/local-top     | 34 +++++++++++++++++++
>>   .../initramfs-sbkeys-hook/files/mount-stub    | 13 +++++++
>>   .../initramfs-sbkeys-hook_0.1.bb              | 32 +++++++++++++++++
>>   5 files changed, 96 insertions(+)
>>   create mode 100644 recipes-initramfs/initramfs-sbkeys-hook/files/hook
>>   create mode 100644 recipes-initramfs/initramfs-sbkeys-hook/files/
>> local-top
>>   create mode 100755 recipes-initramfs/initramfs-sbkeys-hook/files/
>> mount-stub
>>   create mode 100644 recipes-initramfs/initramfs-sbkeys-hook/
>> initramfs-sbkeys-hook_0.1.bb
>>
>> diff --git a/recipes-initramfs/cip-core-initramfs/cip-core-
>> initramfs.bb b/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
>> index b686185c..241e6af6 100644
>> --- a/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
>> +++ b/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
>> @@ -22,6 +22,7 @@ INITRAMFS_INSTALL:append:factory-reset = "
>> initramfs-factory-reset-hook"
>>   INITRAMFS_INSTALL:append:ftpm-stmm = " initramfs-tee-ftpm-hook"
>>   INITRAMFS_INSTALL:append:swupdate = " initramfs-abrootfs-hook"
>>   INITRAMFS_INSTALL:append:swupdate = " initramfs-${RO_ROOTFS_TYPE}-hook"
>> +INITRAMFS_INSTALL:append:secureboot = " initramfs-sbkeys-hook"
>>   INITRAMFS_INSTALL:append:secureboot = " initramfs-verity-hook"
>>   # abrootfs cannot be installed together with verity
>>   INITRAMFS_INSTALL:remove:secureboot = "initramfs-abrootfs-hook"
>> diff --git a/recipes-initramfs/initramfs-sbkeys-hook/files/hook b/
>> recipes-initramfs/initramfs-sbkeys-hook/files/hook
>> new file mode 100644
>> index 00000000..770d4454
>> --- /dev/null
>> +++ b/recipes-initramfs/initramfs-sbkeys-hook/files/hook
>> @@ -0,0 +1,16 @@
>> +#
>> +# CIP Core, generic profile
>> +#
>> +# Copyright (c) Siemens AG, 2026
>> +#
>> +# Authors:
>> +#  Jan Kiszka <jan.kiszka@siemens.com>
>> +#
>> +# SPDX-License-Identifier: MIT
>> +#
>> +
>> +copy_file binary /usr/share/secure-boot-efi-keys/db.auth
>> +copy_file binary /usr/share/secure-boot-efi-keys/KEK.auth
>> +copy_file binary /usr/share/secure-boot-efi-keys/PK.auth
>> +
>> +copy_file binary /usr/share/initramfs-sbkeys-hook/mount
>> diff --git a/recipes-initramfs/initramfs-sbkeys-hook/files/local-top
>> b/recipes-initramfs/initramfs-sbkeys-hook/files/local-top
>> new file mode 100644
>> index 00000000..48fe45d4
>> --- /dev/null
>> +++ b/recipes-initramfs/initramfs-sbkeys-hook/files/local-top
>> @@ -0,0 +1,34 @@
>> +#
>> +# CIP Core, generic profile
>> +#
>> +# Copyright (c) Siemens AG, 2026
>> +#
>> +# Authors:
>> +#  Jan Kiszka <jan.kiszka@siemens.com>
>> +#
>> +# SPDX-License-Identifier: MIT
>> +#
>> +
>> +. /scripts/cip-initramfs-functions
>> +
>> +if secure_boot_enabled; then
>> +    exit 0
>> +fi
>> +
>> +ORIG_PATH="$PATH"
>> +export PATH="/usr/share/initramfs-sbkeys-hook:$PATH"
>> +
>> +if ! efi-readvar -v db | grep -q "has no entries"; then
>> +    export PATH="$ORIG_PATH"
>> +    log_warning_msg "Not securely booting, but keys already deployed"
>> +    exit 0
>> +fi
>> +
>> +log_begin_msg "Deploying EFI secure boot keys"
>> +efi-updatevar -f /usr/share/secure-boot-efi-keys/db.auth db
>> +efi-updatevar -f /usr/share/secure-boot-efi-keys/KEK.auth KEK
>> +efi-updatevar -f /usr/share/secure-boot-efi-keys/PK.auth PK
>> +log_end_msg
>> +
>> +log_success_msg "Rebooting after key deployment..."
>> +reboot
>> diff --git a/recipes-initramfs/initramfs-sbkeys-hook/files/mount-stub
>> b/recipes-initramfs/initramfs-sbkeys-hook/files/mount-stub
>> new file mode 100755
>> index 00000000..408b584e
>> --- /dev/null
>> +++ b/recipes-initramfs/initramfs-sbkeys-hook/files/mount-stub
>> @@ -0,0 +1,13 @@
>> +#!/bin/sh
>> +#
>> +# CIP Core, generic profile
>> +#
>> +# Copyright (c) Siemens AG, 2026
>> +#
>> +# Authors:
>> +#  Jan Kiszka <jan.kiszka@siemens.com>
>> +#
>> +# SPDX-License-Identifier: MIT
>> +#
>> +
>> +echo "none on /sys/firmware/efi/efivars type efivarfs"
> what about "cat /proc/mounts" to get the actual systems mount points
> instead of mocking expected behaviour?
> 

https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git/tree/lib/kernel_efivars.c#n69

Was my first try as well, before reading that.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center