Create Secureboot_uefi_key_management.md by sacnaik · Pull Request #1451 · sonic-net/SONiC

sacnaik · 2023-08-28T18:10:58Z

Secure boot UEFI key management HLD

Added picture for key hierarchies

Image size change

zhangyanzhao · 2023-08-29T15:01:30Z

community review recording https://zoom.us/rec/share/2iI8PrtCImHig7wTVU0JLRj2TmnqlzWugD7yJuCpN866CbS2CKLS6jAR94vMOMKs.YmbqVw1-zSzQI03F

lguohan · 2023-08-29T15:52:57Z

doc/secure_boot/Secureboot_uefi_key_management.md

+
+![image](https://github.com/sacnaik/SONiC/assets/25231205/a42cd039-0675-4a71-84e0-bce00eb2ca9d)
+
+### 5.2 OVMF based platform can use Linux implementation to access UEFI variable


can you clarify the cisco code contribution here?

The HLD is referred to as OVMF since it is Open firmware and available for someone to experiment with. Cisco BIOS has implemented a similar approach to OVMF. When Cisco8000 implements SONiC UEFI key management for Cisco hardware similar code will be added under Cisco platform-specific code. That means the common contribution here is the SONiC CLI and Python module defining the base class that is mentioned in the document.

mheese

Great to see some progress in SONiC around UEFI Secure Boot features!

Please see my inline comments, but I also have some general comments:

enrolling and managing custom keys for Secure Boot is probably the pinnacle of security in this area, and the hardest to achieve for average users, yet these commands are really only helpful for that specific use-case
using custom keys particularly in db can have dire consequences particularly if SecureBoot=1
the system should also provide access to the SecureBoot variable
if SecureBoot=1, there should be protection of the boot chain: if db or dbx get updated, the system should ensure that the current boot entries are actually still going to work. As you mentioned updating these databases requires a reboot, but the shim of a normal SONiC installation will need to be signed correctly as well for this to still work. So either there should be a check of at least the SONiC OS boot entry against the db/dbx before updating it, or maybe the system should refuse to reboot otherwise (?) --> this requires some more discussion IMHO
the same goes for SONiC updates, they should fail if an update leads to installing a shim which is not going to be able to boot any longer
I understand that the idea for specific SONiC CLI commands is to abstract potentially platform specific implementations away. However, would you mind providing examples where different implementations would be necessary? At least on x86 I would have yet to encounter hardware where the standard tooling would be insufficient.

mheese · 2023-08-30T17:32:51Z

doc/secure_boot/Secureboot_uefi_key_management.md

+2. platform security uefi variables update kek <file>   
+3. platform security uefi variables update db  <file>
+4. platform security uefi variables update dbx <file>  
+```


a couple of comments here:

can we call the subcommand secureboot instead of uefi? This is more fitting as these commands are all specifically dealing with secureboot variables, and not other UEFI variables

You outlined really well all the steps which are necessary in order to create an authenticated variable file. Honestly, this is the hard part, while running a command to update the variable will on most platforms simply translate to an efi-updatevar command or by direct access through efivarfs. It would be nice to see an easy UX here

I'm missing access to the general SecureBoot variable which can get information if UEFI Secure Boot is enabled or not on the platform

Yarden-Z · 2023-09-06T18:56:19Z

doc/secure_boot/Secureboot_uefi_key_management.md

+   cat db-orig-1.esl db-orig-3.esl > DB-new.esl
+7. Create authenticated variable and sign it
+   sign-efi-sig-list -g "<GUID>" -k KEK.key -c KEK.crt db DB-new.esl DB-new.auth
+8. Copy DB-new.auth to the system and use CLI to update UEFI database


What is the command used here?
Can you copy the DB-new.auth without providing the KEK.key to the system?

I believe the idea is to perform the signing outside of the system, and then in (8) only copy the new file to the system where you can then update it with the CLI

I understand, but there might be UEFI cases where you cannot upload a new entry to the UEFI without providing the private KEK key (worth checking if this is true, when I played with these items a few years ago this was the case).
Or if you are entering a new KEK, you'll need the PK.

Yarden-Z · 2023-09-06T19:03:17Z

doc/secure_boot/Secureboot_uefi_key_management.md

+```
+
+## 7 Test considerations
+The sonic-mgmt can cover UEFI key management such as adding, updating, removing, and revoking UEFI keys.


Should add a note that this feature should enhance secure boot tests where we can install an image with a specific key, then move it to the dbx and therefor - the same image cannot be installed anymore (signed with the previous key).

Yarden-Z · 2023-09-06T19:04:20Z

doc/secure_boot/Secureboot_uefi_key_management.md

+
+````
+
+### 4.4 Revoke keys


Worth mentioning that key revocation is a potentially destructive action.
If we are removing a DB entry that is currently being used - this will cause the system to enter fatal mode (recoverable only via UEFI).

totally agree. See also my comment above about protection of boot chain.

Yarden-Z · 2023-09-06T19:06:09Z

doc/secure_boot/Secureboot_uefi_key_management.md

+The platform plugin for this OVMF type UEFI can use either sysfs or efi-readvar and efi-updatevar to implement getVariable() and setVariable() methods.   
+
+
+## 6 SONiC CLI commands


What are the potential return values here?
Updatevar might fail (it being immutable, specific platform constraints, etc').
What is the expected design for these type of commands? As I see that they only receive a file and perform an action.

abdosi · 2023-09-28T15:02:20Z

@xumia for reference

zhangyanzhao · 2024-02-05T08:27:14Z

@sacnaik can you please add the code PRs to this HLD by referring to #806? Thanks.

zhangyanzhao · 2024-05-06T02:32:41Z

code PR is not ready, move to backlog for future release

zhangyanzhao · 2024-12-10T05:30:15Z

no code PRs, move to backlog

Create Secureboot_uefi_key_management.md

e2e8cb2

Secure boot UEFI key management HLD

sacnaik mentioned this pull request Aug 28, 2023

UEFI key management in SONiC to perform secure boot key rotation, update, remove revoke etc #1401

Closed

sacnaik added 15 commits August 28, 2023 15:00

Update Secureboot_uefi_key_management.md

c5d17ea

Update Secureboot_uefi_key_management.md

8b883b6

Update Secureboot_uefi_key_management.md

9019219

Added picture for key hierarchies

Update Secureboot_uefi_key_management.md

e38c16d

Update Secureboot_uefi_key_management.md

1b547d2

Update Secureboot_uefi_key_management.md

fcd0784

change of image size

d2eee39

Update Secureboot_uefi_key_management.md

b431681

Update Secureboot_uefi_key_management.md

a90d91b

Image size change

Update Secureboot_uefi_key_management.md

f9bb370

Update Secureboot_uefi_key_management.md

841e52f

Update Secureboot_uefi_key_management.md

8e64090

Update Secureboot_uefi_key_management.md

6119953

Update Secureboot_uefi_key_management.md

9bfe09e

Update Secureboot_uefi_key_management.md

6f15867

zhangyanzhao requested review from abdosi and qiluo-msft August 29, 2023 15:35

lguohan reviewed Aug 29, 2023

View reviewed changes

mheese reviewed Aug 30, 2023

View reviewed changes

Yarden-Z reviewed Sep 6, 2023

View reviewed changes


		![image](https://github.com/sacnaik/SONiC/assets/25231205/a42cd039-0675-4a71-84e0-bce00eb2ca9d)

		### 5.2 OVMF based platform can use Linux implementation to access UEFI variable

		The platform plugin for this OVMF type UEFI can use either sysfs or efi-readvar and efi-updatevar to implement getVariable() and setVariable() methods.


		## 6 SONiC CLI commands

Conversation

sacnaik commented Aug 28, 2023

Uh oh!

zhangyanzhao commented Aug 29, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mheese left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abdosi commented Sep 28, 2023

Uh oh!

zhangyanzhao commented Feb 5, 2024

Uh oh!

zhangyanzhao commented May 6, 2024

Uh oh!

zhangyanzhao commented Dec 10, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants