Skip to content

Commit 8b2d85a

Browse files
traviertravier
committed
examples/bootc*: Secure Boot support
1 parent 1f48198 commit 8b2d85a

File tree

3 files changed

+60
-32
lines changed

3 files changed

+60
-32
lines changed

‎examples/bootc-uki/Containerfile.stage2

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,42 @@ FROM base as kernel
44

55
ARG COMPOSEFS_FSVERITY
66

7-
RUN <<EOF
7+
RUN --mount=type=secret,id=key \
8+
--mount=type=secret,id=cert <<EOF
89
set -eux
910

1011
mkdir -p /etc/kernel /etc/dracut.conf.d
1112
echo "console=ttyS0,115200 composefs=${COMPOSEFS_FSVERITY} selinux=1 enforcing=0 systemd.debug_shell=1 root=UUID=6523f8ae-3eb1-4e2a-a05a-18b695ae656f rw" > /etc/kernel/cmdline
1213

13-
dnf install -y systemd-ukify;
14-
kver=$(cd /usr/lib/modules && echo *);
14+
dnf install -y systemd-ukify sbsigntools systemd-boot-unsigned
15+
kver=$(cd /usr/lib/modules && echo *)
1516
ukify build \
16-
--linux /usr/lib/modules/$kver/vmlinuz \
17-
--initrd /usr/lib/modules/$kver/initramfs.img \
17+
--linux "/usr/lib/modules/$kver/vmlinuz" \
18+
--initrd "/usr/lib/modules/$kver/initramfs.img" \
19+
--uname="${kver}" \
1820
--cmdline "@/etc/kernel/cmdline" \
19-
--output /boot/$kver.efi
21+
--os-release "@/etc/os-release" \
22+
--signtool sbsign \
23+
--secureboot-private-key "/run/secrets/key" \
24+
--secureboot-certificate "/run/secrets/cert" \
25+
--measure \
26+
--json pretty \
27+
--output "/boot/$kver.efi"
28+
sbsign \
29+
--key "/run/secrets/key" \
30+
--cert "/run/secrets/cert" \
31+
"/usr/lib/systemd/boot/efi/systemd-bootx64.efi" \
32+
--output "/boot/systemd-bootx64.efi"
2033
EOF
2134

2235
FROM base as final
2336

2437
RUN --mount=type=bind,from=kernel,target=/_mount/kernel <<EOF
25-
kver=$(cd /usr/lib/modules && echo *);
38+
kver=$(cd /usr/lib/modules && echo *)
2639
mkdir -p /boot/EFI/Linux
2740
# We put the UKI in /boot for now due to composefs verity not being the
2841
# same due to mtime of /usr/lib/modules being changed
29-
cp /_mount/kernel/boot/$kver.efi /boot/EFI/Linux/$kver.efi;
42+
cp /_mount/kernel/boot/$kver.efi /boot/EFI/Linux/$kver.efi
3043
EOF
3144

3245
FROM base as final-final

‎examples/bootc-uki/build.final

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -15,38 +15,33 @@ IMAGE_ID="$(sed s/sha256:// tmp/iid)"
1515
./cfsctl --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
1616
COMPOSEFS_FSVERITY="$(./cfsctl --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}")"
1717

18+
# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
19+
# Alternative to generate keys for testing: `sbctl create-keys`
20+
if [[ ! -d "secureboot" ]]; then
21+
echo "Generating test Secure Boot keys"
22+
mkdir secureboot
23+
pushd secureboot > /dev/null
24+
uuidgen --random > GUID.txt
25+
openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Platform Key/" -out PK.crt
26+
openssl x509 -outform DER -in PK.crt -out PK.cer
27+
openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Key Exchange Key/" -out KEK.crt
28+
openssl x509 -outform DER -in KEK.crt -out KEK.cer
29+
openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Signature Database key/" -out db.crt
30+
openssl x509 -outform DER -in db.crt -out db.cer
31+
popd > /dev/null
32+
fi
33+
34+
# For debugging, add --no-cache to podman command
1835
sudo podman build \
1936
-t quay.io/fedora/fedora-bootc-uki:42 \
2037
--build-arg=COMPOSEFS_FSVERITY="${COMPOSEFS_FSVERITY}" \
2138
-f Containerfile.stage2 \
39+
--secret=id=key,src=secureboot/db.key \
40+
--secret=id=cert,src=secureboot/db.crt \
2241
--iidfile=tmp/iid2
2342

2443
rm -rf tmp/efi
2544
mkdir -p tmp/efi
2645
./cfsctl --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
2746
./cfsctl --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}"
2847
./cfsctl --repo tmp/sysroot/composefs oci prepare-boot "${IMAGE_ID}" --bootdir tmp/efi
29-
30-
# For debugging, add --no-cache to podman command
31-
# mkdir tmp/internal-sysroot
32-
# # podman build \
33-
# --iidfile=tmp/iid \
34-
# -v "${PWD}/tmp/internal-sysroot:/tmp/sysroot:z,U" \
35-
# --secret=id=key,src=secureboot/db.key \
36-
# --secret=id=cert,src=secureboot/db.crt \
37-
38-
# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
39-
# Alternative to generate keys for testing: `sbctl create-keys`
40-
# if [[ ! -d "secureboot" ]]; then
41-
# echo "Generating test Secure Boot keys"
42-
# mkdir secureboot
43-
# pushd secureboot > /dev/null
44-
# uuidgen --random > GUID.txt
45-
# openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Platform Key/" -out PK.crt
46-
# openssl x509 -outform DER -in PK.crt -out PK.cer
47-
# openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Key Exchange Key/" -out KEK.crt
48-
# openssl x509 -outform DER -in KEK.crt -out KEK.cer
49-
# openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Signature Database key/" -out db.crt
50-
# openssl x509 -outform DER -in db.crt -out db.cer
51-
# popd > /dev/null
52-
# fi

‎examples/bootc-uki/build_vars

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
if [[ ! -d "secureboot" ]]; then
8+
echo "fail"
9+
exit 1
10+
fi
11+
12+
# See: https://github.com/rhuefi/qemu-ovmf-secureboot
13+
# $ dnf install -y python3-virt-firmware
14+
GUID=$(cat secureboot/GUID.txt)
15+
virt-fw-vars --input "/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2" \
16+
--secure-boot \
17+
--set-pk $GUID "secureboot/PK.crt" \
18+
--add-kek $GUID "secureboot/KEK.crt" \
19+
--add-db $GUID "secureboot/db.crt" \
20+
-o "VARS_CUSTOM.secboot.qcow2.template"

0 commit comments

Comments
 (0)