acrn-sign: add bbclass for signing #272
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This allows the secure boot work well out of the box Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
This bbclass allows to enable secure boot out of the box. In secureboot flow: -> UEFI firmware verifies GRUB -> GRUB verifies ACRN, Service VM kernel -> Service VM OS kernel verifies the Device Model (acrn-dm) and User VM OVMF bootloader (with the help of acrn-dm) This bbclass : Generate sample grub.cfg Generate initial grub configuration grub.init.cfg Generte gpg secure keys Sign acrn.bin, grub.init.cfg, grub.cfg and bzImage with gpg private key Build standalone grub efi having all necessary modules, signed grub.init.cfg and public gpg key Sign grub bootx64efi with UEFI secure key (db.key) and Ceritificat (db.crt) Verify signed grub bootx64.efi image Preliminary requirements for sigining in local.conf: (1) INHERIT += "acrn-sign" (2) Set UEFI keys path to PREGENERATED_ACRN_SIGNING_KEY_DIR variable having db.key and db.crt (3) Install signed files to boot partition IMAGE_EFI_BOOT_FILES_append_pn-acrn-image-base = "\ acrn.bin.sig \ bzImage.sig \ grub.cfg;EFI/BOOT/grub.cfg \ grub.cfg.sig;EFI/BOOT/grub.cfg.sig \ grub-efi-bootx64.efi;EFI/BOOT/bootx64.efi \ " (4) Set manually generated UUIDs for boot and root partitions BOOT_PARTITION_FSUUID = "56F8DCBA" (No dash) DISK_SIGNATURE_UUID = "ada6f5b6-944a-4589-ae3a-592a56563ef5" (5) Set WKS_FILE WKS_FILE_pn-acrn-image-base = "acrn-bootdisk-static-uuid.wks.in" Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This bbclass allows to enable secure boot out of the box.
In secureboot flow:
-> UEFI firmware verifies GRUB
-> GRUB verifies ACRN, Service VM kernel
-> Service VM OS kernel verifies the Device Model (acrn-dm) and User VM OVMF bootloader (with the help of acrn-dm)
This bbclass :
Generate sample grub.cfg
Generate initial grub configuration grub.init.cfg
Generte gpg secure keys
Sign acrn.bin, grub.init.cfg, grub.cfg and bzImage with gpg private key
Build standalone grub efi having all necessary modules, signed grub.init.cfg and public gpg key
Sign grub bootx64efi with UEFI secure key (db.key) and Ceritificat (db.crt)
Verify signed grub bootx64.efi image
Preliminary requirements for sigining in local.conf:
(1) INHERIT += "acrn-sign"
(2) Set UEFI keys path to PREGENERATED_ACRN_SIGNING_KEY_DIR variable having db.key and db.crt
(3) Install signed files to boot partition
IMAGE_EFI_BOOT_FILES_append_pn-acrn-image-base = "
acrn.bin.sig
bzImage.sig
grub.cfg;EFI/BOOT/grub.cfg
grub.cfg.sig;EFI/BOOT/grub.cfg.sig
grub-efi-bootx64.efi;EFI/BOOT/bootx64.efi
"
(4) Set manually generated UUIDs for boot and root partitions
BOOT_PARTITION_FSUUID = "56F8DCBA" (No dash)
DISK_SIGNATURE_UUID = "ada6f5b6-944a-4589-ae3a-592a56563ef5"
(5) Set WKS_FILE
WKS_FILE_pn-acrn-image-base = "acrn-bootdisk-static-uuid.wks.in"
Signed-off-by: Naveen Saini naveen.kumar.saini@intel.com