Skip to content

Commit b8ac9fc

Browse files
davidpil2002davidpil2002
committed
[secure boot]Add getopts to signing scripts
1 parent 944ac0a commit b8ac9fc

File tree

8 files changed

+66
-63
lines changed

8 files changed

+66
-63
lines changed

‎build_debian.sh‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -646,11 +646,11 @@ if [[ $SECURE_UPGRADE_MODE == 'dev' || $SECURE_UPGRADE_MODE == "prod" && $SONIC_
646646
exit 1
647647
fi
648648

649-
sudo bash scripts/signing_secure_boot_dev.sh $CONFIGURED_ARCH \
650-
$FILESYSTEM_ROOT \
651-
$LINUX_KERNEL_VERSION \
652-
$SECURE_UPGRADE_DEV_SIGNING_CERT \
653-
$SECURE_UPGRADE_DEV_SIGNING_KEY
649+
sudo bash scripts/signing_secure_boot_dev.sh -a $CONFIGURED_ARCH \
650+
-r $FILESYSTEM_ROOT \
651+
-l $LINUX_KERNEL_VERSION \
652+
-c $SECURE_UPGRADE_DEV_SIGNING_CERT \
653+
-p $SECURE_UPGRADE_DEV_SIGNING_KEY
654654
elif [[ $SECURE_UPGRADE_MODE == "prod" ]]; then
655655
# Here Vendor signing should be implemented
656656
OUTPUT_SEC_BOOT_DIR=$FILESYSTEM_ROOT/boot

‎installer/default_platform.conf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -475,8 +475,7 @@ bootloader_menu_config()
475475
fi
476476
477477
DEFAULT_GRUB_SERIAL_COMMAND="serial --port=${CONSOLE_PORT} --speed=${CONSOLE_SPEED} --word=8 --parity=no --stop=1"
478-
# DEFAULT_GRUB_CMDLINE_LINUX="console=tty0 console=ttyS${CONSOLE_DEV},${CONSOLE_SPEED}n8 quiet $CSTATES"
479-
DEFAULT_GRUB_CMDLINE_LINUX="console=tty0 console=ttyS${CONSOLE_DEV},${CONSOLE_SPEED}n8 loglevel=7 systemd.log_level=debug $CSTATES"
478+
DEFAULT_GRUB_CMDLINE_LINUX="console=tty0 console=ttyS${CONSOLE_DEV},${CONSOLE_SPEED}n8 quiet $CSTATES"
480479
GRUB_SERIAL_COMMAND=${GRUB_SERIAL_COMMAND:-"$DEFAULT_GRUB_SERIAL_COMMAND"}
481480
GRUB_CMDLINE_LINUX=${GRUB_CMDLINE_LINUX:-"$DEFAULT_GRUB_CMDLINE_LINUX"}
482481
export GRUB_SERIAL_COMMAND

‎rules/config‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -212,8 +212,8 @@ SONIC_ENABLE_SECUREBOOT_SIGNATURE ?= n
212212
# SECURE_UPGRADE_DEV_SIGNING_KEY - path to development signing key, used for image signing during build
213213
# SECURE_UPGRADE_DEV_SIGNING_CERT - path to development signing certificate, used for image signing during build
214214
# SECURE_UPGRADE_MODE - enum value for secure upgrade mode, valid options are "dev", "prod" and "no_sign"
215-
SECURE_UPGRADE_DEV_SIGNING_KEY = /sonic/files/nv_onyx_key.pem
216-
SECURE_UPGRADE_DEV_SIGNING_CERT = /sonic/files/nv_onyx_key_certificate.pem
215+
SECURE_UPGRADE_DEV_SIGNING_KEY = /sonic/your/private/key/path/private_key.pem
216+
SECURE_UPGRADE_DEV_SIGNING_CERT = /sonic/your/certificate/path/cert.pem
217217
SECURE_UPGRADE_MODE = "no_sign"
218218

219219
# PACKAGE_URL_PREFIX - the package url prefix

‎scripts/efi-sign.sh‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,28 @@ set -e
88
# - grub
99
# - vmlinuz
1010
#
11-
usage() {
11+
print_usage() {
1212
cat <<EOF
1313
1414
$0: Usage
15-
$0 <PRIVATE_KEY_PEM> <CERT_PEM> <EFI_FILE> <EFI_FILE_SIGNED>
15+
$0 -p <PRIVATE_KEY_PEM> -c <CERT_PEM> -e <EFI_FILE> -s <EFI_FILE_SIGNED>
1616
Usage example: efi-sign.sh priv-key.pem pub-key.pem shimx64.efi shimx64-signed.efi
1717
1818
EOF
1919
}
2020

21-
if [ "$1" = "-h" -o "$1" = "--help" ]; then
22-
usage
23-
fi
24-
25-
PRIVATE_KEY_PEM="$1"
26-
CERT_PEM="$2"
27-
EFI_FILE="$3"
28-
EFI_FILE_SIGNED="$4"
29-
21+
while getopts 'p:c:e:s:hv' flag; do
22+
case "${flag}" in
23+
p) PRIVATE_KEY_PEM="${OPTARG}" ;;
24+
c) CERT_PEM="${OPTARG}" ;;
25+
e) EFI_FILE="${OPTARG}" ;;
26+
s) EFI_FILE_SIGNED="${OPTARG}" ;;
27+
v) VERBOSE='true' ;;
28+
h) print_usage
29+
exit 1 ;;
30+
esac
31+
done
32+
if [ $OPTIND -eq 1 ]; then echo "no options were pass"; print_usage; exit 1 ;fi
3033

3134
[ -f "$PRIVATE_KEY_PEM" ] || {
3235
echo "Error: PRIVATE_KEY_PEM file does not exist: $PRIVATE_KEY_PEM"

‎scripts/secure_boot_signature_verification.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ KERNEL_MODULES_DIR=''
88
CERT_PEM=''
99
VERBOSE='false'
1010

11-
usage() {
11+
print_usage() {
1212
cat <<EOF
1313
1414
$0: Usage

‎scripts/signing_kernel_modules.sh‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
usage() {
55
cat <<EOF
66
$0: # Display Help
7-
$0 <LINUX_KERNEL_VERSION> <PEM_CERT> <PEM_PRIVATE_KEY> <LOCAL_SIGN_FILE> <LOCAL_EXTRACT_CERT> <KERNEL_MODULES_DIR>
7+
$0 -l <LINUX_KERNEL_VERSION> -c <PEM_CERT> -p <PEM_PRIVATE_KEY> -s <LOCAL_SIGN_FILE> -e <LOCAL_EXTRACT_CERT> -k <KERNEL_MODULES_DIR>
88
Sign kernel modules in <KERNEL_MODULES_DIR> using private & public keys.
99
1010
Parameters description:
@@ -21,16 +21,20 @@ Runs examples:
2121
EOF
2222
}
2323

24-
if [ "$1" = "-h" -o "$1" = "--help" ]; then
25-
usage
26-
fi
27-
28-
LINUX_KERNEL_VERSION="$1"
29-
PEM_CERT="$2"
30-
PEM_PRIVATE_KEY="$3"
31-
KERNEL_MODULES_DIR="$4"
32-
LOCAL_SIGN_FILE="$5"
33-
LOCAL_EXTRACT_CERT="$6"
24+
while getopts 'l:c:p:k:s:e:hv' flag; do
25+
case "${flag}" in
26+
l) LINUX_KERNEL_VERSION="${OPTARG}" ;;
27+
c) PEM_CERT="${OPTARG}" ;;
28+
p) PEM_PRIVATE_KEY="${OPTARG}" ;;
29+
k) KERNEL_MODULES_DIR="${OPTARG}" ;;
30+
s) LOCAL_SIGN_FILE="${OPTARG}" ;;
31+
e) LOCAL_EXTRACT_CERT="${OPTARG}" ;;
32+
v) VERBOSE='true' ;;
33+
h) print_usage
34+
exit 1 ;;
35+
esac
36+
done
37+
if [ $OPTIND -eq 1 ]; then echo "no options were pass"; print_usage; exit 1 ;fi
3438

3539
if [ -z ${LINUX_KERNEL_VERSION} ]; then
3640
echo "ERROR: LINUX_KERNEL_VERSION arg1 is empty"

‎scripts/signing_secure_boot_dev.sh‎

Lines changed: 27 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,32 +4,38 @@
44
## Enable debug output for script & exit code when failing occurs
55
set -x -e
66

7-
usage() {
7+
print_usage() {
88
cat <<EOF
99
1010
$0: Usage
11-
$0 <CONFIGURED_ARCH> <FS_ROOT> <LINUX_KERNEL_VERSION> <PEM_CERT> <PEM_PRIV_KEY>
12-
Usage example: efi-sign.sh priv-key.pem pub-key.pem shimx64.efi shimx64-signed.efi
11+
$0 -a <CONFIGURED_ARCH> -r <FS_ROOT> -l <LINUX_KERNEL_VERSION> -c <PEM_CERT> -p <PEM_PRIV_KEY>
1312
1413
EOF
1514
}
1615

1716
clean_file() {
1817
if [ -f $1 ]; then
1918
echo "clean old file named: $1"
20-
echo "sudo rm $1"
21-
sudo rm $1
22-
echo "$?"
23-
exit 1
19+
echo "sudo rm -f $1"
20+
sudo sudo rm -f $1
2421
fi
2522
}
2623

24+
while getopts 'a:r:l:c:p:hv' flag; do
25+
case "${flag}" in
26+
a) CONFIGURED_ARCH="${OPTARG}" ;;
27+
r) FS_ROOT="${OPTARG}" ;;
28+
l) LINUX_KERNEL_VERSION="${OPTARG}" ;;
29+
c) PEM_CERT="${OPTARG}" ;;
30+
p) PEM_PRIV_KEY="${OPTARG}" ;;
31+
v) VERBOSE='true' ;;
32+
h) print_usage
33+
exit 1 ;;
34+
esac
35+
done
36+
if [ $OPTIND -eq 1 ]; then echo "no options were pass"; print_usage; exit 1 ;fi
37+
2738
echo "$0 signing & verifying EFI files and Kernel Modules start ..."
28-
CONFIGURED_ARCH="$1"
29-
FS_ROOT="$2"
30-
LINUX_KERNEL_VERSION="$3"
31-
PEM_CERT="$4"
32-
PEM_PRIV_KEY="$5"
3339

3440
if [ -z ${CONFIGURED_ARCH} ]; then
3541
echo "ERROR: CONFIGURED_ARCH=${CONFIGURED_ARCH} is empty"
@@ -85,13 +91,9 @@ clean_file ${MMX_EFI_SRC}-signed
8591
clean_file $FS_ROOT/boot/shim${EFI_ARCH}.efi
8692
clean_file $FS_ROOT/boot/mm${EFI_ARCH}.efi
8793

88-
# clean old shim & mmx files in the env
89-
sudo rm -f ${SHIMX_EFI_SRC}-signed ${MMX_EFI_SRC}-signed \
90-
$FS_ROOT/boot/shim${EFI_ARCH}.efi $FS_ROOT/boot/mm${EFI_ARCH}.efi
91-
9294
echo "signing shim${EFI_ARCH}.efi & mm${EFI_ARCH}.efi from location: ${SHIM_DIR_SRC} .."
93-
sudo ${EFI_SIGNING} $PEM_PRIV_KEY $PEM_CERT ${SHIMX_EFI_SRC} ${SHIMX_EFI_SRC}-signed
94-
sudo ${EFI_SIGNING} $PEM_PRIV_KEY $PEM_CERT ${MMX_EFI_SRC} ${MMX_EFI_SRC}-signed
95+
sudo ${EFI_SIGNING} -p $PEM_PRIV_KEY -c $PEM_CERT -e ${SHIMX_EFI_SRC} -s ${SHIMX_EFI_SRC}-signed
96+
sudo ${EFI_SIGNING} -p $PEM_PRIV_KEY -c $PEM_CERT -e ${MMX_EFI_SRC} -s ${MMX_EFI_SRC}-signed
9597

9698
# cp shim & mmx signed files to boot directory in the fs.
9799
sudo cp ${SHIMX_EFI_SRC}-signed $FS_ROOT/boot/shim${EFI_ARCH}.efi
@@ -105,18 +107,15 @@ sudo bash scripts/secure_boot_signature_verification.sh -c $PEM_CERT -e $FS_ROOT
105107
## grub signing
106108
######################
107109

108-
# clean old files
109-
clean_file ${GRUB_EFI_SRC}-signed
110-
clean_file $FS_ROOT/boot/grub${EFI_ARCH}.efi
111-
112110
GRUB_DIR_SRC=$FS_ROOT/usr/lib/grub/x86_64-efi/monolithic/
113111
GRUB_EFI_SRC=$GRUB_DIR_SRC/grub${EFI_ARCH}.efi
114112

115-
# clean old grub files in the env
116-
sudo rm -f ${GRUB_EFI_SRC}-signed $FS_ROOT/boot/grub${EFI_ARCH}.efi
113+
# clean old files
114+
clean_file ${GRUB_EFI_SRC}-signed
115+
clean_file $FS_ROOT/boot/grub${EFI_ARCH}.efi
117116

118117
echo "signing grub${EFI_ARCH}.efi from location: ${GRUB_EFI_SRC} .."
119-
sudo ${EFI_SIGNING} $PEM_PRIV_KEY $PEM_CERT ${GRUB_EFI_SRC} ${GRUB_EFI_SRC}-signed
118+
sudo ${EFI_SIGNING} -p $PEM_PRIV_KEY -c $PEM_CERT -e ${GRUB_EFI_SRC} -s ${GRUB_EFI_SRC}-signed
120119

121120
# cp signed grub to fs boot dir.
122121
sudo cp ${GRUB_EFI_SRC}-signed $FS_ROOT/boot/grub${EFI_ARCH}.efi
@@ -133,20 +132,17 @@ CURR_VMLINUZ=$FS_ROOT/boot/vmlinuz-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH}
133132
# clean old files
134133
clean_file ${CURR_VMLINUZ}-signed
135134

136-
# clean old grub files in the env
137-
sudo rm -f ${CURR_VMLINUZ}-signed
138-
139135
echo "signing ${CURR_VMLINUZ} .."
140-
sudo ${EFI_SIGNING} $PEM_PRIV_KEY $PEM_CERT ${CURR_VMLINUZ} ${CURR_VMLINUZ}-signed
136+
sudo ${EFI_SIGNING} -p $PEM_PRIV_KEY -c $PEM_CERT -e ${CURR_VMLINUZ} -s ${CURR_VMLINUZ}-signed
141137

142138
# rename signed vmlinuz with the name vmlinuz without signed suffix
143-
sudo cp ${CURR_VMLINUZ}-signed ${CURR_VMLINUZ}
139+
sudo mv ${CURR_VMLINUZ}-signed ${CURR_VMLINUZ}
144140

145141
sudo bash scripts/secure_boot_signature_verification.sh -c $PEM_CERT -e ${CURR_VMLINUZ}
146142

147143
#########################
148144
# Kernel Modules signing
149145
#########################
150-
sudo bash scripts/signing_kernel_modules.sh $LINUX_KERNEL_VERSION ${PEM_CERT} ${PEM_PRIV_KEY}
146+
sudo bash scripts/signing_kernel_modules.sh -l $LINUX_KERNEL_VERSION -c ${PEM_CERT} -p ${PEM_PRIV_KEY} -k ${FS_ROOT}
151147

152148
echo "$0 signing & verifying EFI files and Kernel Modules DONE"

‎scripts/signing_secure_boot_prod.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
#In this script Vendor should code the logic to build a secure boot image by using vendor flows

0 commit comments

Comments
 (0)