[202211] Add Secure Boot Support backport#40
Closed
DavidZagury wants to merge 1 commit into202211from
Closed
Conversation
- Why I did it Add Secure Boot support to SONiC OS. Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process before the operating system has been loaded. - How I did it Added a signing process to sign the following components: shim, grub, Linux kernel, and kernel modules when doing the build, and when feature is enabled in build time according to the HLD explanations (the feature is disabled by default). - How to verify it There are self-verifications of each boot component when building the image, in addition, there is an existing end-to-end test in sonic-mgmt repo that checks that the boot succeeds when loading a secure system (details below). How to build a sonic image with secure boot feature: (more description in HLD) Required to use the following build flags from rules/config: SECURE_UPGRADE_MODE="dev" SECURE_UPGRADE_DEV_SIGNING_KEY="/path/to/private/key.pem" SECURE_UPGRADE_DEV_SIGNING_CERT="/path/to/cert/key.pem" After setting those flags should build the sonic-buildimage. Before installing the image, should prepared the setup (switch device) with the follow: check that the device support UEFI stored pub keys in UEFI DB enabled Secure Boot flag in UEFI How to run a test that verify the Secure Boot flow: The existing test "test_upgrade_path" under "sonic-mgmt/tests/upgrade_path/test_upgrade_path", is enough to validate proper boot You need to specify the following arguments: Base_image_list your_secure_image Taget_image_list your_second_secure_image Upgrade_type cold And run the test, basically the test will install the base image given in the parameter and then upgrade to target image by doing cold reboot and validates all the services are up and working correctly
DavidZagury
pushed a commit
that referenced
this pull request
May 30, 2023
Why I did it [FIPS] Upgrade Open-SymCrypt version to 0.6 Improve the SymCrypt performance Support to download the debug packages from storage account in version 0.6. How I did it Upgrade to symcrypt-openssl from version 0.4 to version 0.6 Changes in https://github.com/sonic-net/sonic-fips: 0c29b23 Upgrade the submodules: SymCrypt and SymCrypt-OpenSSL #40 80022f3 Fix the ARM64 build failure 2e76a3d Disable the unsupported tests Other changes will be added as well: 55b8e0a Merge pull request #35 from xumia/change-license 120c1a7 Upgrade SymCrypt and SymCrypt-OpenSSL 2f9c084 Merge pull request #39 from liuh-80/dev/liuh/update-openssh-version a3be6c5 Revert openssh version e02fa1e Update fips version How to verify it
DavidZagury
pushed a commit
that referenced
this pull request
Oct 1, 2023
…face (sonic-net#15864) sonic-build image side change to fix source interface selection in dual tor scenario. dhcprelay related PR: [master]fix dhcpv6 relay dual tor source interface selection issue sonic-dhcp-relay#42 Announce dhcprelay submodule to 6a6ce24([to invoke #40 PR]([master]fix dhcpv6 relay dual tor source interface selection issue sonic-dhcp-relay#42))
DavidZagury
pushed a commit
that referenced
this pull request
Apr 28, 2025
…lly (sonic-net#677) #### Why I did it src/sonic-swss ``` * 64ea58a - (HEAD -> 202412, origin/202412) [hash] add SAI_NATIVE_HASH_FIELD_IPV6_FLOW_LABEL to hash-field map for ECMP/LAG switch hash configuration (#40) (6 hours ago) [mssonicbld] ``` #### How I did it #### How to verify it #### Description for the changelog
DavidZagury
pushed a commit
that referenced
this pull request
Apr 28, 2025
… automatically (sonic-net#722) #### Why I did it src/sonic-platform-common ``` * f2469a1 - (HEAD -> 202412, origin/202412) [code sync] Merge code from sonic-net/sonic-platform-common:202411 to 202412 (#40) (21 hours ago) [mssonicbld] ``` #### How I did it #### How to verify it #### Description for the changelog
DavidZagury
pushed a commit
that referenced
this pull request
May 27, 2025
…sonic-net#22652) #### Why I did it src/dhcpmon ``` * c7f2169 - (HEAD -> master, origin/master, origin/HEAD) Add support for clear per-interface counter (#39) (19 hours ago) [Yaqiang Zhu] * ee55c11 - [build] Update to ubuntu 24.04 in build pipeline (#40) (3 days ago) [Yaqiang Zhu] ``` #### How I did it #### How to verify it #### Description for the changelog
DavidZagury
pushed a commit
that referenced
this pull request
Jun 30, 2025
…tically (sonic-net#23101) #### Why I did it src/sonic-dash-api ``` * 38853ef - (HEAD -> master, origin/master, origin/HEAD) Use ValueOrRange for trusted_vni fields (#41) (2 days ago) [Lawrence Lee] * 5daac7d - Add outbound port map proto definitions (#40) (2 days ago) [Lawrence Lee] ``` #### How I did it #### How to verify it #### Description for the changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of sonic-net#12692
And following fixes:
sonic-net#14591
sonic-net#14582
sonic-net#14581
sonic-net#14589
Why I did it
Add Secure Boot support to SONiC OS.
Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process before the operating system has been loaded.
Work item tracking
How I did it
Added a signing process to sign the following components:
shim, grub, Linux kernel, and kernel modules when doing the build, and when feature is enabled in build time according to the HLD explanations (the feature is disabled by default).
How to verify it
There are self-verifications of each boot component when building the image, in addition, there is an existing end-to-end test in sonic-mgmt repo that checks that the boot succeeds when loading a secure system (details below).
How to build a sonic image with secure boot feature: (more description in HLD)
Required to use the following build flags from rules/config:
SECURE_UPGRADE_MODE="dev"
SECURE_UPGRADE_DEV_SIGNING_KEY="/path/to/private/key.pem"
SECURE_UPGRADE_DEV_SIGNING_CERT="/path/to/cert/key.pem"
After setting those flags should build the sonic-buildimage.
Before installing the image, should prepared the setup (switch device) with the follow:
check that the device support UEFI
stored pub keys in UEFI DB
enabled Secure Boot flag in UEFI
How to run a test that verify the Secure Boot flow:
The existing test "test_upgrade_path" under "sonic-mgmt/tests/upgrade_path/test_upgrade_path", is enough to validate proper boot
You need to specify the following arguments:
Base_image_list your_secure_image
Taget_image_list your_second_secure_image
Upgrade_type cold
And run the test, basically the test will install the base image given in the parameter and then upgrade to target image by doing cold reboot and validates all the services are up and working correctly
note: the path to the existing sonic-mgmt test can be found in the link in the HLD description.
Which release branch to backport (provide reason below if selected)
Tested branch (Please provide the tested image version)
Description for the changelog
Link to config_db schema for YANG module changes
A picture of a cute animal (not mandatory but encouraged)