[edk2] Secureboot enable with OVMF
Park, Kyung Min
kyung.min.park at intel.com
Sun Dec 16 13:49:49 PST 2018
This works. Thanks!!
From: Laszlo Ersek [mailto:lersek at redhat.com]
Sent: Thursday, December 13, 2018 2:49 AM
To: Park, Kyung Min <kyung.min.park at intel.com>
Cc: edk2-devel at lists.01.org
Subject: Re: [edk2] Secureboot enable with OVMF
On 12/13/18 02:25, Park, Kyung Min wrote:
> I'm trying to enable the secureboot with OVMF. I followed the steps as below.
> But When I executed LockDown.efi, it gives me an error which says, "Failed to enroll PK: 26".
> According to UEFI spec, the 26 means EFI_SECURITY_VIOLATION, but I don't understand why I got this error.
> Before I ran the LockDown.efi, the secureboot was disabled by default and the PK key was not enrolled.
> 1. Build OVMF with secureboot enable
Please know that, if you build OVMF with *just* SECURE_BOOT_ENABLE, but without SMM_REQUIRE, then a malicious guest OS may modify the pflash chip with direct hardware access that contains the authenticated UEFI variables. In other words, a malicious guest OS may circumvent Secure Boot.
If that's OK for your use case (it could be), then it's OK to use just SECURE_BOOT_ENABLE; but it should be a conscious decision.
Regarding SMM_REQUIRE, please see OvmfPkg/README, section "SMM support".
> 2. Generate/Execute LockDown.efi to enroll PK/KEK/DB keys
> I would appreciate any useful information about this error.
You'll have to dig into LockDown.efi for that. If you are convinced LockDown.efi does the right thing, then you'll have to add debug messages to the edk2 stack that handles authenticated variables (the variable driver, some SecurityPkg / CryptoPkg libraries, etc). This is usually quite time consuming.
As an alternative, you might be able to use "/usr/share/edk2/ovmf/EnrollDefaultKeys.efi", from the "edk2-ovmf"
subpackage package, from
(You can find the source code in the SRPM.)
More information about the edk2-devel