Skip to content

Commit c25dc5b

Browse files
miczyg1miczyg1
committed
dasharo-security/secure-boot.robot: Add OS Secure Boot PK enrollment test
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
1 parent 2abce92 commit c25dc5b

File tree

2 files changed

+258
-9
lines changed

2 files changed

+258
-9
lines changed

‎dasharo-security/secure-boot.robot‎

Lines changed: 118 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ SBO001.001 Check Secure Boot default state (firmware)
4343
[Documentation] This test aims to verify that Secure Boot state after
4444
... flashing the platform with the Dasharo firmware is
4545
... correct.
46-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO001.001 not supported
4746
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO001.001 not supported
4847
Power On
4948
${setup_menu}= Enter Setup Menu Tianocore And Return Construction
@@ -60,7 +59,6 @@ SBO002.001 UEFI Secure Boot (Ubuntu)
6059
[Documentation] This test verifies that Secure Boot can be enabled from
6160
... boot menu and, after the DUT reset, it is seen from
6261
... the OS.
63-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO002.001 not supported
6462
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO002.001 not supported
6563

6664
# 1. Make sure that SB is enabled
@@ -97,7 +95,6 @@ SBO002.002 UEFI Secure Boot (Windows)
9795
[Documentation] This test verifies that Secure Boot can be enabled from
9896
... boot menu and, after the DUT reset, it is seen from
9997
... the OS.
100-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO002.002 not supported
10198
Skip If not ${TESTS_IN_WINDOWS_SUPPORT} SBO002.002 not supported
10299

103100
# 1. Make sure that SB is enabled
@@ -133,7 +130,6 @@ SBO002.002 UEFI Secure Boot (Windows)
133130
SBO003.001 Attempt to boot file with the correct key from Boot Maintenance Manager (firmware)
134131
[Documentation] This test verifies that Secure Boot allows booting a
135132
... signed file with a correct key.
136-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO004.001 not supported
137133
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO004.001 not supported
138134
Power On
139135
${sb_menu}= Enter Secure Boot Menu And Return Construction
@@ -158,7 +154,6 @@ SBO003.001 Attempt to boot file with the correct key from Boot Maintenance Manag
158154
SBO004.001 Attempt to boot file without the key from Boot Maintenance Manager (firmware)
159155
[Documentation] This test verifies that Secure Boot blocks booting a file
160156
... without a key.
161-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO004.001 not supported
162157
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO004.001 not supported
163158
# 1. Make sure that SB is enabled
164159
Power On
@@ -176,7 +171,6 @@ SBO004.001 Attempt to boot file without the key from Boot Maintenance Manager (f
176171
SBO005.001 Attempt to boot file with the wrong-signed key from Boot Maintenance Manager (firmware)
177172
[Documentation] This test verifies that Secure Boot disallows booting
178173
... a signed file with a wrong-signed key.
179-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO005.001 not supported
180174
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO005.001 not supported
181175
# 1. Make sure that SB is enabled
182176
Power On
@@ -194,7 +188,6 @@ SBO005.001 Attempt to boot file with the wrong-signed key from Boot Maintenance
194188
SBO006.001 Reset Secure Boot Keys option availability (firmware)
195189
[Documentation] This test verifies that the Reset Secure Boot Keys
196190
... option is available
197-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO006.001 not supported
198191
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO006.001 not supported
199192
Power On
200193
${setup_menu}= Enter Setup Menu Tianocore And Return Construction
@@ -210,7 +203,6 @@ SBO006.001 Reset Secure Boot Keys option availability (firmware)
210203
SBO007.001 Attempt to boot the file after restoring keys to default (firmware)
211204
[Documentation] This test verifies that restoring the keys to default
212205
... removes any custom added certificates.
213-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO007.001 not supported
214206
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO007.001 not supported
215207
Power On
216208
${sb_menu}= Enter Secure Boot Menu And Return Construction
@@ -249,7 +241,6 @@ SBO007.001 Attempt to boot the file after restoring keys to default (firmware)
249241
SBO008.001 Attempt to enroll the key in the incorrect format (firmware)
250242
[Documentation] This test verifies that it is impossible to load
251243
... a certificate in the wrong file format.
252-
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SBO008.001 not supported
253244
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO008.001 not supported
254245
# 1. Make sure that SB is enabled
255246
Power On
@@ -264,6 +255,124 @@ SBO008.001 Attempt to enroll the key in the incorrect format (firmware)
264255
Select File In File Explorer cert_fake.der
265256
Read From Terminal Until ERROR: Unsupported file type!
266257

258+
SBO009.001 Attempt to enroll and delete new PK key in OS (Ubuntu)
259+
[Documentation] This test verifies that it is impossible to load
260+
... a certificate in the wrong file format.
261+
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO009.001 not supported
262+
# 1. Make sure that SB is enabled and default keys enrolled.
263+
Power On
264+
${sb_menu}= Enter Secure Boot Menu And Return Construction
265+
${advanced_menu}= Enter Advanced Secure Boot Keys Management And Return Construction ${sb_menu}
266+
Reset To Default Secure Boot Keys ${advanced_menu}
267+
# 2. Delete PK so that we can enroll a new one in OS
268+
Enter PK Options And Delete PK ${advanced_menu}
269+
# Let the flash operation be finished before resetting
270+
Sleep 1
271+
Tianocore Reset System
272+
# Now boot to the OS
273+
Boot System Or From Connected Disk ${ENV_ID_UBUNTU}
274+
Login To Linux
275+
Switch To Root User
276+
# The magic starts here...
277+
# Check if we are in SetupMode
278+
${out}= Read Secure Boot Variable SetupMode
279+
${setup_mode}= Convert To Integer ${out}
280+
IF ${setup_mode} != 1 Fail Secure Boot not in setup mode
281+
# Generate a new PK key and enroll the new PK. Setup mode should be cleared
282+
Generate New PK Key Set
283+
${status}= Enroll New PK From OS
284+
IF ${status} != 0 Fail Could not enroll new PK from OS
285+
${out}= Read Secure Boot Variable SetupMode
286+
${setup_mode}= Convert To Integer ${out}
287+
IF ${setup_mode} != 0 Fail Secure Boot not in user mode
288+
# Attempt to delete PK. We should get back to Setup Mode
289+
${status}= Enroll New PK From OS noPK.auth
290+
IF ${status} != 0 Fail Could not delete PK from OS
291+
${out}= Read Secure Boot Variable SetupMode
292+
${setup_mode}= Convert To Integer ${out}
293+
IF ${setup_mode} != 1 Fail Secure Boot not in setup mode
294+
295+
SBO009.002 Attempt to change existing PK key in OS (Ubuntu)
296+
[Documentation] This test verifies that it is impossible to load
297+
... a certificate in the wrong file format.
298+
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO009.002 not supported
299+
# 1. Make sure that SB is enabled and default keys enrolled.
300+
Power On
301+
${sb_menu}= Enter Secure Boot Menu And Return Construction
302+
${advanced_menu}= Enter Advanced Secure Boot Keys Management And Return Construction ${sb_menu}
303+
Reset To Default Secure Boot Keys ${advanced_menu}
304+
# 2. Delete PK so that we can enroll a new one in OS
305+
Enter PK Options And Delete PK ${advanced_menu}
306+
# Let the flash operation be finished before resetting
307+
Sleep 1
308+
Tianocore Reset System
309+
# Now boot to the OS
310+
Boot System Or From Connected Disk ${ENV_ID_UBUNTU}
311+
Login To Linux
312+
Switch To Root User
313+
# The magic starts here...
314+
# Check if we are in SetupMode
315+
${out}= Read Secure Boot Variable SetupMode
316+
${setup_mode}= Convert To Integer ${out}
317+
IF ${setup_mode} != 1 Fail Secure Boot not in setup mode
318+
# Generate a new PK key and enroll the new PK. Setup mode should be cleared
319+
Generate New PK Key Set
320+
${status}= Enroll New PK From OS
321+
IF ${status} != 0 Fail Could not enroll new PK from OS
322+
${out}= Read Secure Boot Variable SetupMode
323+
${setup_mode}= Convert To Integer ${out}
324+
IF ${setup_mode} != 0 Fail Secure Boot not in user mode
325+
# Attempt to change PK.
326+
Generate New PK Key Set newPK
327+
# Sign the new PK signature list with existing PK
328+
Execute Command In Terminal
329+
... sign-efi-sig-list -k PK.key -c PK.crt PK newPK.esl newPK.auth
330+
${status}= Enroll New PK From OS newPk.auth
331+
IF ${status} != 0 Fail Could not change PK from OS
332+
${out}= Read Secure Boot Variable SetupMode
333+
${setup_mode}= Convert To Integer ${out}
334+
IF ${setup_mode} != 0 Fail Secure Boot not in user mode
335+
336+
SBO009.003 Attempt to change PK with incorrectly signed PK in OS (Ubuntu)
337+
[Documentation] This test verifies that it is impossible to load
338+
... a certificate in the wrong file format.
339+
Skip If not ${TESTS_IN_UBUNTU_SUPPORT} SBO009.003 not supported
340+
# 1. Make sure that SB is enabled and default keys enrolled.
341+
Power On
342+
${sb_menu}= Enter Secure Boot Menu And Return Construction
343+
${advanced_menu}= Enter Advanced Secure Boot Keys Management And Return Construction ${sb_menu}
344+
Reset To Default Secure Boot Keys ${advanced_menu}
345+
# 2. Delete PK so that we can enroll a new one in OS
346+
Enter PK Options And Delete PK ${advanced_menu}
347+
# Let the flash operation be finished before resetting
348+
Sleep 1
349+
Tianocore Reset System
350+
# Now boot to the OS
351+
Boot System Or From Connected Disk ${ENV_ID_UBUNTU}
352+
Login To Linux
353+
Switch To Root User
354+
# The magic starts here...
355+
# Check if we are in SetupMode
356+
${out}= Read Secure Boot Variable SetupMode
357+
${setup_mode}= Convert To Integer ${out}
358+
IF ${setup_mode} != 1 Fail Secure Boot not in setup mode
359+
# Generate a new PK key and enroll the new PK. Setup mode should be cleared
360+
Generate New PK Key Set
361+
${status}= Enroll New PK From OS
362+
IF ${status} != 0 Fail Could not enroll new PK from OS
363+
${out}= Read Secure Boot Variable SetupMode
364+
${setup_mode}= Convert To Integer ${out}
365+
IF ${setup_mode} != 0 Fail Secure Boot not in user mode
366+
# Attempt to change PK but do not sign it with current PK.
367+
Generate New PK Key Set newPK
368+
${status}= Enroll New PK From OS newPK.auth
369+
IF ${status} == 0
370+
Fail Unauthorized PK has been enrolled successfully
371+
END
372+
${out}= Read Secure Boot Variable SetupMode
373+
${setup_mode}= Convert To Integer ${out}
374+
IF ${setup_mode} != 0 Fail Secure Boot not in user mode
375+
267376

268377
*** Keywords ***
269378
Set Secure Boot State To Disabled

‎lib/secure-boot-lib.robot‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,56 @@ ${BAD_FORMAT_URL}= https://cloud.3mdeb.com/index.php/s/AsBnATiHTZQ6jae/
1818
${BAD_FORMAT_NAME}= bad_format.img
1919
${BAD_FORMAT_SHA256}= 59d17bc120dfd0f2e6948a2bfdbdf5fb06eddcb44f9a053a8e7b8f677e21858c
2020

21+
${EFIVARFS}= /sys/firmware/efi/efivars
22+
${EFI_GLOBAL_VAR_GUID}= 8be4df61-93ca-11d2-aa0d-00e098032b8c
23+
${SECURE_BOOT_DB_GUID}= d719b2cb-3d3a-4596-a3bc-dad00e67656f
24+
25+
&{PK_VAR}= varname=PK
26+
... guid=${EFI_GLOBAL_VAR_GUID}
27+
... length=0
28+
&{KEK_VAR}= varname=KEK
29+
... guid=${EFI_GLOBAL_VAR_GUID}
30+
... length=0
31+
&{DB_VAR}= varname=db
32+
... guid=${SECURE_BOOT_DB_GUID}
33+
... length=0
34+
&{DBX_VAR}= varname=dbx
35+
... guid=${SECURE_BOOT_DB_GUID}
36+
... length=0
37+
&{DBT_VAR}= varname=dbt
38+
... guid=${SECURE_BOOT_DB_GUID}
39+
... length=0
40+
&{PK_DEFAULT_VAR}= varname=PKDefault
41+
... guid=${EFI_GLOBAL_VAR_GUID}
42+
... length=0
43+
&{KEK_DEFAULT_VAR}= varname=KEKDefault
44+
... guid=${EFI_GLOBAL_VAR_GUID}
45+
... length=0
46+
&{DB_DEFAULT_VAR}= varname=dbDefault
47+
... guid=${SECURE_BOOT_DB_GUID}
48+
... length=0
49+
&{DBX_DEFAULT_VAR}= varname=dbxDefault
50+
... guid=${SECURE_BOOT_DB_GUID}
51+
... length=0
52+
&{DBT_DEFAULT_VAR}= varname=dbtDefault
53+
... guid=${SECURE_BOOT_DB_GUID}
54+
... length=0
55+
&{SECURE_BOOT_VAR}= varname=SecureBoot
56+
... guid=${EFI_GLOBAL_VAR_GUID}
57+
... length=1
58+
&{SETUP_MODE_VAR}= varname=SetupMode
59+
... guid=${EFI_GLOBAL_VAR_GUID}
60+
... length=1
61+
&{VENDOR_KEYS_VAR}= varname=VendorKeys
62+
... guid=${EFI_GLOBAL_VAR_GUID}
63+
... length=1
64+
65+
@{SB_VAR_LIST}= &{PK_VAR} &{KEK_VAR} &{DB_VAR} &{DBX_VAR}
66+
... &{PK_DEFAULT_VAR} &{KEK_DEFAULT_VAR}
67+
... &{DB_DEFAULT_VAR} &{DBX_DEFAULT_VAR}
68+
... &{SECURE_BOOT_VAR} &{SETUP_MODE_VAR}
69+
... &{VENDOR_KEYS_VAR}
70+
2171

2272
*** Keywords ***
2373
Get Secure Boot Menu Construction
@@ -272,3 +322,93 @@ Restore Secure Boot Defaults
272322
Enable Secure Boot ${sb_menu}
273323
END
274324
# Changes to Secure Boot take action immediately, so we can just continue
325+
326+
Enter PK Options And Delete PK
327+
[Documentation] Enters Advanced Secure Boot Keys Management menu and
328+
... then PK Options, and deletes PK. Keyword assumes PK is present.
329+
[Arguments] ${advanced_menu}
330+
${pk_opts_menu}= Enter Submenu From Snapshot And Return Construction
331+
... ${advanced_menu}
332+
... PK Options
333+
... opt_only=${TRUE}
334+
Should Contain ${pk_opts_menu} > Enroll PK
335+
# Bug in EDK2, 'K' in Pk is small in this string
336+
Should Contain Match ${pk_opts_menu} Delete Pk [*
337+
# Select Delete PK
338+
Press Key N Times And Enter 1 ${ARROW_DOWN}
339+
# Consume pop-up and confirm action
340+
Read From Terminal Until Are you sure you want to delete PK?
341+
Read From Terminal Until discard change and return
342+
Write Bare Into Terminal y
343+
344+
Generate New PK Key Set
345+
[Documentation] Creates a set of file required to manage PK via OS.
346+
[Arguments] ${basename}=PK
347+
VAR ${keygen_cmd}=
348+
... openssl req -new -x509 -newkey rsa:2048 -subj \"/CN\=PK/\"
349+
... -keyout ${basename}.key -out ${basename}.crt -days 3650 -nodes -sha256
350+
... separator=${SPACE}
351+
VAR ${pk_sign_cmd}=
352+
... sign-efi-sig-list -t "$(date --date\='1 second' +'%Y-%m-%d %H:%M:%S')"
353+
... -k ${basename}.key -c ${basename}.crt PK ${basename}.esl ${basename}.auth
354+
... separator=${SPACE}
355+
VAR ${no_pk_sign_cmd}=
356+
... sign-efi-sig-list -t "$(date --date\='1 second' +'%Y-%m-%d %H:%M:%S')"
357+
... -k ${basename}.key -c ${basename}.crt PK /dev/null no${basename}.auth
358+
... separator=${SPACE}
359+
Execute Command In Terminal ${keygen_cmd}
360+
Execute Command In Terminal cert-to-efi-sig-list ${basename}.crt ${basename}.esl
361+
# Enrolling new keys may fail if we try to use these files too quickly.
362+
# Timestamp verification may fail.
363+
Sleep 2s
364+
Execute Command In Terminal ${pk_sign_cmd}
365+
Sleep 2s
366+
Execute Command In Terminal ${no_pk_sign_cmd}
367+
Sleep 3s
368+
369+
Get SB Variable Info
370+
[Documentation] Returns the GUID for given Secure Boot variable name.
371+
[Arguments] ${varname}
372+
FOR ${var} IN @{SB_VAR_LIST}
373+
IF '${var.varname}' == '${varname}' RETURN ${var}
374+
END
375+
Fail Invalid Secure Boot Variable Name
376+
377+
Read Secure Boot Variable
378+
[Documentation] Reads a Secure Boot variable via efivarfs
379+
[Arguments] ${var} ${n_bytes}=0
380+
${var_info}= Get SB Variable Info ${var}
381+
# Check if the file even exists
382+
${status}= Execute Command In Terminal
383+
... test -f ${EFIVARFS}/${var}-${var_info.guid}; echo $?
384+
${status}= Convert To Integer ${status}
385+
IF ${status} != 0 RETURN ${EMPTY}
386+
# If 0 bytes to read, read whole file, skipping the 4 first bytes
387+
# indicating attribute
388+
IF ${n_bytes} == 0
389+
${ret}= Execute Command In Terminal
390+
... xxd -p -s +4 ${EFIVARFS}/${var}-${var_info.guid}
391+
ELSE
392+
# It is safe to read more than the length of the variable. 'tail' will
393+
# simply return all bytes of the variable, including attribute.
394+
${ret}= Execute Command In Terminal
395+
... tail -c ${n_bytes} ${EFIVARFS}/${var}-${var_info.guid} | xxd -p
396+
END
397+
RETURN ${ret}
398+
399+
Enroll New PK From OS
400+
[Documentation] Enrolls a new PK from file.
401+
[Arguments] ${pk_auth_file}=PK.auth
402+
${status}= Execute Command In Terminal
403+
... test -f ${EFIVARFS}/${PK_VAR.varname}-${PK_VAR.guid}; echo $?
404+
${status}= Convert To Integer ${status}
405+
# Disable immutability attribute of the file in OS
406+
IF ${status} == 0
407+
Execute Command In Terminal
408+
... chattr -i ${EFIVARFS}/${PK_VAR.varname}-${PK_VAR.guid}
409+
END
410+
${out}= Execute Command In Terminal
411+
... efi-updatevar -f ${pk_auth_file} PK
412+
${status}= Execute Command In Terminal echo $?
413+
${status}= Convert To Integer ${status}
414+
RETURN ${status}

0 commit comments

Comments
 (0)