From f54ae33e49ef3e283906df692ce242367799982f Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Thu, 29 Oct 2026 21:20:06 +0100 Subject: op-mode: T9496: verify secure-boot signature when using "add system image" On a system running with Secure Boot enabled, "add system image" installed the Linux Kernel of the new image without checking its signature. A Kernel not signed by an enrolled Machine Owner Key is rejected by shim, so the new image failed to boot. The Kernel of the new image is now verified against the enrolled MOK keys before anything is copied. If verification fails, the installation is aborted. The existing --force option overrides the check. --- python/vyos/utils/system.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'python') diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py index fc6507328..63b8e0828 100644 --- a/python/vyos/utils/system.py +++ b/python/vyos/utils/system.py @@ -213,3 +213,24 @@ def get_secure_boot_certificates(kernel: str='/boot/vmlinuz') -> list: subject = None return certificates + +def verify_secure_boot_signature(kernel: str) -> bool: + """ + Return True if the given Linux Kernel image is signed by one of the + Machine Owner Keys (MOK) enrolled in the UEFI firmware, which is what + shim checks before the Kernel is booted. + """ + from glob import glob + from tempfile import TemporaryDirectory + with TemporaryDirectory() as tmp_dir: + # mokutil always exports into the current working directory + run(['mokutil', '--export'], cwd=tmp_dir, capture_output=True) + for der in sorted(glob(f'{tmp_dir}/MOK-*.der')): + pem = f'{der}.pem' + if run(['openssl', 'x509', '-inform', 'DER', '-in', der, '-out', pem], + capture_output=True).returncode != 0: + continue + if run(['sbverify', '--cert', pem, kernel], + capture_output=True).returncode == 0: + return True + return False -- cgit v1.2.3