op-mode: T861: add "show secure-boot detail" command

"show secure-boot" only reported whether Secure Boot is enabled, not who
signed the running Linux Kernel. An image signed by the VyOS CA could not be
told apart from one signed with a custom Machine Owner Key.

"show secure-boot detail" now lists issuer and subject of the Kernel image
signature certificates. The same information is added to the raw
"show version" data as "secure_boot_detail", issuer and subject delimited by
",". The key is only present when Secure Boot is enabled and a signature
could be read.

1 files changed, 30 insertions, 0 deletions

diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py
index 7cc6919a4..90ab74ea6 100644
--- a/python/vyos/utils/system.py
+++ b/python/vyos/utils/system.py
@@ -157,3 +157,33 @@ def get_secure_boot_state() -> bool:
         return False
     tmp = cmdl(['mokutil', '--sb-state'], expect=[0, 255])
     return bool('enabled' in tmp)
+
+def get_secure_boot_certificates(kernel: str='/boot/vmlinuz') -> list:
+    """
+    Return the signature certificates of the given Linux Kernel image as a
+    list of dictionaries with the keys "issuer" and "subject". Returns an
+    empty list if the image is unsigned or the signature could not be read.
+    """
+    from vyos.utils.process import cmdl
+    try:
+        tmp = cmdl(['sbverify', '--list', kernel])
+    except OSError:
+        return []
+
+    certificates = []
+    subject = None
+    in_certificates = False
+    for line in tmp.splitlines():
+        line = line.strip()
+        if line.startswith('signature '):
+            in_certificates = False
+        elif line == 'image signature certificates:':
+            in_certificates = True
+        elif in_certificates and line.startswith('- subject:'):
+            subject = line.removeprefix('- subject:').strip()
+        elif in_certificates and line.startswith('issuer:') and subject:
+            issuer = line.removeprefix('issuer:').strip()
+            certificates.append({'issuer': issuer, 'subject': subject})
+            subject = None
+
+    return certificates