Repository navigation
fog.enrollsb: confirm the PK by reading it back, not by SetupMode - #202
Merged
Merged
Conversation
Forum topic 18307: the unattended Secure Boot enrollment said "Automatic Secure Boot enrollment failed ... still in Setup Mode". The machine came back in Custom Mode, and a second run found the certificate in db. So db, KEK and PK all landed. The failure came from the check after the PK write: SetupMode still read 1. Some firmware updates that flag only at the next reset. sbEnrollDb now reads PK back through efivarfs and compares it to the EFI_SIGNATURE_LIST inside PK.auth. It runs that check even when dd reports an error. A db or KEK failure still stops before PK. The result has three outcomes: - PK is FOG's: success. A note prints if SetupMode still reads 1. - PK is absent: the existing "still in Setup Mode" message, now true. - PK is something else: a new message that does not claim Setup Mode. The dd test double now stores what firmware keeps (attribute word plus signature list), and a real PK.auth from efitools gates the dwLength parse. Verified on QEMU/OVMF with FOG's published PK/KEK/db.auth: the PK reads back byte-identical to the PK.auth payload. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Forum topic 18307. The unattended "Enroll Secure Boot Key" task printed:
The machine came back in Custom Mode. A second run found the certificate already in db. So db, KEK and PK all landed, and the message was false.
Cause
sbEnrollDb()confirmed the PK write by requiringSetupModeto read0immediately after it. Some firmware stores the PK and keeps reportingSetupMode=1until the next reset.Change
sbPkReadback()reads PK back through efivarfs (GetVariable) and compares it to theEFI_SIGNATURE_LISTinsidePK.auth, at16 + dwLength. It returns 0 (FOG's PK), 1 (absent: still Setup Mode), or 2 (some other PK).sbEnrollDb()runs the readback even when the PKddreports an error. A db or KEK failure still stops before the PK write.sbEnroll()gives each outcome its own message. rc 2 no longer claims Setup Mode. On success it prints a note whenSetupModestill reads 1.fog.enrollsbforcecomment describe the new check.Tests
ddtest double now stores what firmware keeps: the attribute word plus the signature list, not the auth descriptor.PK.authmade by efitoolssign-efi-sig-list(throwaway key, not committed) and itsPK.esl, so the dwLength parse is not checked against its own assumption.tests/checks/secureboot.sh: 95 passed, 0 failed. Restoring the old SetupMode gate turns 39/39a red. A wrong payload offset turns 40b/40c red.Verified
On QEMU/OVMF (q35, SMM, Secure Boot firmware) in Setup Mode, with FOG's published PK/KEK/db.auth, the patched
sbEnrollDbreturned 0. The PK read back is byte-identical to the PK.auth payload (1407 bytes). A foreign payload returns 2.Not verified: vendor firmware that reports a stale
SetupMode. OVMF flips it at once.🤖 Generated with Claude Code