op-mode: T9496: verify secure-boot signature when using "add system image"

On a system running with Secure Boot enabled, "add system image" installed
the Linux Kernel of the new image without checking its signature. A Kernel
not signed by an enrolled Machine Owner Key is rejected by shim, so the new
image failed to boot.

The Kernel of the new image is now verified against the enrolled MOK keys
before anything is copied. If verification fails, the installation is
aborted. The existing --force option overrides the check.

1 files changed, 21 insertions, 0 deletions

diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py
index fc6507328..63b8e0828 100644
--- a/python/vyos/utils/system.py
+++ b/python/vyos/utils/system.py
@@ -213,3 +213,24 @@ def get_secure_boot_certificates(kernel: str='/boot/vmlinuz') -> list:
             subject = None
 
     return certificates
+
+def verify_secure_boot_signature(kernel: str) -> bool:
+    """
+    Return True if the given Linux Kernel image is signed by one of the
+    Machine Owner Keys (MOK) enrolled in the UEFI firmware, which is what
+    shim checks before the Kernel is booted.
+    """
+    from glob import glob
+    from tempfile import TemporaryDirectory
+    with TemporaryDirectory() as tmp_dir:
+        # mokutil always exports into the current working directory
+        run(['mokutil', '--export'], cwd=tmp_dir, capture_output=True)
+        for der in sorted(glob(f'{tmp_dir}/MOK-*.der')):
+            pem = f'{der}.pem'
+            if run(['openssl', 'x509', '-inform', 'DER', '-in', der, '-out', pem],
+                   capture_output=True).returncode != 0:
+                continue
+            if run(['sbverify', '--cert', pem, kernel],
+                   capture_output=True).returncode == 0:
+                return True
+    return False