From da6941e2a80697e31c0f62c0f62c52f570ebb7e9 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 5 Oct 2026 22:41:37 +0200 Subject: op-mode: T861: add "show secure-boot detail" command "show secure-boot" only reported whether Secure Boot is enabled, not who signed the running Linux Kernel. An image signed by the VyOS CA could not be told apart from one signed with a custom Machine Owner Key. "show secure-boot detail" now lists issuer and subject of the Kernel image signature certificates. The same information is added to the raw "show version" data as "secure_boot_detail", issuer and subject delimited by ",". The key is only present when Secure Boot is enabled and a signature could be read. --- python/vyos/utils/system.py | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'python') diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py index 7cc6919a4..90ab74ea6 100644 --- a/python/vyos/utils/system.py +++ b/python/vyos/utils/system.py @@ -157,3 +157,33 @@ def get_secure_boot_state() -> bool: return False tmp = cmdl(['mokutil', '--sb-state'], expect=[0, 255]) return bool('enabled' in tmp) + +def get_secure_boot_certificates(kernel: str='/boot/vmlinuz') -> list: + """ + Return the signature certificates of the given Linux Kernel image as a + list of dictionaries with the keys "issuer" and "subject". Returns an + empty list if the image is unsigned or the signature could not be read. + """ + from vyos.utils.process import cmdl + try: + tmp = cmdl(['sbverify', '--list', kernel]) + except OSError: + return [] + + certificates = [] + subject = None + in_certificates = False + for line in tmp.splitlines(): + line = line.strip() + if line.startswith('signature '): + in_certificates = False + elif line == 'image signature certificates:': + in_certificates = True + elif in_certificates and line.startswith('- subject:'): + subject = line.removeprefix('- subject:').strip() + elif in_certificates and line.startswith('issuer:') and subject: + issuer = line.removeprefix('issuer:').strip() + certificates.append({'issuer': issuer, 'subject': subject}) + subject = None + + return certificates -- cgit v1.2.3