From 56cd7de907ef26ae27909a5d468768bb6e1e7f6f Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 26 Aug 2024 20:20:41 +0200 Subject: T861: add dependency to enable UEFI secure boot support --- debian/control | 5 ++++- python/vyos/system/grub.py | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/debian/control b/debian/control index 890100fd8..d1d1602ae 100644 --- a/debian/control +++ b/debian/control @@ -113,8 +113,11 @@ Depends: efibootmgr, libefivar1, dosfstools, - grub-efi-amd64-bin [amd64], + grub-efi-amd64-signed [amd64], grub-efi-arm64-bin [arm64], + mokutil [amd64], + shim-signed [amd64], + sbsigntool [amd64], # Image signature verification tool minisign, # Live filesystem tools diff --git a/python/vyos/system/grub.py b/python/vyos/system/grub.py index daddb799a..de8303ee2 100644 --- a/python/vyos/system/grub.py +++ b/python/vyos/system/grub.py @@ -82,7 +82,7 @@ def install(drive_path: str, boot_dir: str, efi_dir: str, id: str = 'VyOS', chro f'{chroot_cmd} grub-install --no-floppy --recheck --target={efi_installation_arch}-efi \ --force-extra-removable --boot-directory={boot_dir} \ --efi-directory={efi_dir} --bootloader-id="{id}" \ - --no-uefi-secure-boot' + --uefi-secure-boot' ) -- cgit v1.2.3 From b78cc96cc4c4d506b7e959ec6ec9c3e7fc09fc33 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 26 Aug 2024 20:23:32 +0200 Subject: T861: op-mode: "show version" will display secure boot state vyos@vyos:~$ show ver ... Architecture: x86_64 Boot via: installed image System type: KVM guest Secure Boot: enabled ... --- python/vyos/utils/boot.py | 6 +++++- python/vyos/utils/system.py | 8 ++++++++ src/etc/sudoers.d/vyos | 3 +++ src/op_mode/version.py | 9 +++++++++ 4 files changed, 25 insertions(+), 1 deletion(-) diff --git a/python/vyos/utils/boot.py b/python/vyos/utils/boot.py index 3aecbec64..708bef14d 100644 --- a/python/vyos/utils/boot.py +++ b/python/vyos/utils/boot.py @@ -1,4 +1,4 @@ -# Copyright 2023 VyOS maintainers and contributors +# Copyright 2023-2024 VyOS maintainers and contributors # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public @@ -33,3 +33,7 @@ def boot_configuration_success() -> bool: if int(res) == 0: return True return False + +def is_uefi_system() -> bool: + efi_fw_dir = '/sys/firmware/efi' + return os.path.exists(efi_fw_dir) and os.path.isdir(efi_fw_dir) diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py index fca93d118..7b12efb14 100644 --- a/python/vyos/utils/system.py +++ b/python/vyos/utils/system.py @@ -139,3 +139,11 @@ def get_load_averages(): res[15] = float(matches["fifteen"]) / core_count return res + +def get_secure_boot_state() -> bool: + from vyos.utils.process import cmd + from vyos.utils.boot import is_uefi_system + if not is_uefi_system(): + return False + tmp = cmd('mokutil --sb-state') + return bool('enabled' in tmp) diff --git a/src/etc/sudoers.d/vyos b/src/etc/sudoers.d/vyos index 63a944f41..67d7babc4 100644 --- a/src/etc/sudoers.d/vyos +++ b/src/etc/sudoers.d/vyos @@ -57,4 +57,7 @@ Cmnd_Alias KEA_IP6_ROUTES = /sbin/ip -6 route replace *,\ # Allow members of group sudo to execute any command %sudo ALL=NOPASSWD: ALL +# Allow any user to query Machine Owner Key status +%sudo ALL=NOPASSWD: /usr/bin/mokutil + _kea ALL=NOPASSWD: KEA_IP6_ROUTES diff --git a/src/op_mode/version.py b/src/op_mode/version.py index 09d69ad1d..71a40dd50 100755 --- a/src/op_mode/version.py +++ b/src/op_mode/version.py @@ -25,6 +25,9 @@ import vyos.opmode import vyos.version import vyos.limericks +from vyos.utils.boot import is_uefi_system +from vyos.utils.system import get_secure_boot_state + from jinja2 import Template version_output_tmpl = """ @@ -43,6 +46,7 @@ Build comment: {{build_comment}} Architecture: {{system_arch}} Boot via: {{boot_via}} System type: {{system_type}} +Secure Boot: {{secure_boot}} Hardware vendor: {{hardware_vendor}} Hardware model: {{hardware_model}} @@ -57,6 +61,11 @@ Copyright: VyOS maintainers and contributors def _get_raw_data(funny=False): version_data = vyos.version.get_full_version_data() + version_data["secure_boot"] = "n/a (BIOS)" + if is_uefi_system(): + version_data["secure_boot"] = "disabled" + if get_secure_boot_state(): + version_data["secure_boot"] = "enabled" if funny: version_data["limerick"] = vyos.limericks.get_random() -- cgit v1.2.3 From 9dfcea3c874d81b03244f40a346694b62637dc5a Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 26 Aug 2024 20:24:54 +0200 Subject: T861: op-mode: add "show secure-boot [keys]" CLI command Support getting current system secure boot state. In addition add optional suppor tto list all enrolled MOK (Machine Owner Keys) in the UEFI variable store. --- op-mode-definitions/show-secure-boot.xml.in | 21 ++++++++++++ src/op_mode/secure_boot.py | 50 +++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+) create mode 100644 op-mode-definitions/show-secure-boot.xml.in create mode 100755 src/op_mode/secure_boot.py diff --git a/op-mode-definitions/show-secure-boot.xml.in b/op-mode-definitions/show-secure-boot.xml.in new file mode 100644 index 000000000..ff731bac9 --- /dev/null +++ b/op-mode-definitions/show-secure-boot.xml.in @@ -0,0 +1,21 @@ + + + + + + + Show Secure Boot state + + ${vyos_op_scripts_dir}/secure_boot.py show + + + + Show enrolled certificates + + mokutil --list-enrolled + + + + + + diff --git a/src/op_mode/secure_boot.py b/src/op_mode/secure_boot.py new file mode 100755 index 000000000..5f6390a15 --- /dev/null +++ b/src/op_mode/secure_boot.py @@ -0,0 +1,50 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2024 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import sys +import vyos.opmode + +from vyos.utils.boot import is_uefi_system +from vyos.utils.system import get_secure_boot_state + +def _get_raw_data(name=None): + sb_data = { + 'state' : get_secure_boot_state(), + 'uefi' : is_uefi_system() + } + return sb_data + +def _get_formatted_output(raw_data): + if not raw_data['uefi']: + print('System run in legacy BIOS mode!') + state = 'enabled' if raw_data['state'] else 'disabled' + return f'SecureBoot {state}' + +def show(raw: bool): + sb_data = _get_raw_data() + if raw: + return sb_data + else: + return _get_formatted_output(sb_data) + +if __name__ == "__main__": + try: + res = vyos.opmode.run(sys.modules[__name__]) + if res: + print(res) + except (ValueError, vyos.opmode.Error) as e: + print(e) + sys.exit(1) -- cgit v1.2.3 From 07c4fe9ba4511f06bdd302cf37b3059ea86df8c6 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 26 Aug 2024 20:26:18 +0200 Subject: T861: op-mode: add "install mok" CLI command Deploy VyOS Secure Boot CA MOK (Machine Owner Key) into UEFI variables of the running machine. --- op-mode-definitions/install-mok.xml.in | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 op-mode-definitions/install-mok.xml.in diff --git a/op-mode-definitions/install-mok.xml.in b/op-mode-definitions/install-mok.xml.in new file mode 100644 index 000000000..18526a354 --- /dev/null +++ b/op-mode-definitions/install-mok.xml.in @@ -0,0 +1,13 @@ + + + + + + + Install Secure Boot MOK (Machine Owner Key) + + if test -f /var/lib/shim-signed/mok/MOK.der; then sudo mokutil --ignore-keyring --import /var/lib/shim-signed/mok/MOK.der; else echo "Secure Boot Machine Owner Key not found"; fi + + + + -- cgit v1.2.3