barebox on EFI bios and secure boot

barebox on EFI bios and secure boot

[giorgio.nicole]

Hi,

I use barebox to boot a linux kernel on an Intel atom based PC with an EFI bios and this just works.

Now I wanted to configure the bios to enable the secure boot mode: this means I tried to write some
EFI variables (db, dbx, KEK, PK); for this I used the efitools utils (efi-updatevar for example) but it didn't
worked: I always get an 'Invalid argument' error.

After some unsuccessful tries I booted the linux kernel directly from the bios, without barebox and in this
case the efi-updatevar tool worked as expected; so I suppose that starting barebox has some kind of effect
on the persistent store for the efi vars.

Does anyone have similar issues or a suggestion about what can be checked to fix this ???

thank you,

giorgio

Re: barebox on EFI bios and secure boot

[Ahmad Fatoum]

Hello Giorgio,

On 08.08.24 11:45, giorgio.nicole@arcor.de wrote:
> I use barebox to boot a linux kernel on an Intel atom based PC with an EFI bios and this just works.
> 
> Now I wanted to configure the bios to enable the secure boot mode: this means I tried to write some
> EFI variables (db, dbx, KEK, PK); for this I used the efitools utils (efi-updatevar for example) but it didn't
> worked: I always get an 'Invalid argument' error.

In this case, neither barebox or the kernel are signed, right?

> After some unsuccessful tries I booted the linux kernel directly from the bios, without barebox and in this
> case the efi-updatevar tool worked as expected; so I suppose that starting barebox has some kind of effect
> on the persistent store for the efi vars.

I am not familiar with UEFI secure boot, so I don't know if there is some lock
down happening here or what could cause this.

Some things to try:

 - Are other variables writable?
 - Can you write this variable from barebox? wecho -o /efivars/your-variable
   or memcpy -d /efivars/some-variable

> Does anyone have similar issues or a suggestion about what can be checked to fix this ???

Christian (CC'd) mentioned a while ago that he had a secure booting UEFI system.
I asked him on IRC and he mentioned using lockdown.efi for lock down back then.

Hope this helps and let me know how it goes.

Cheers,
Ahmad

> 
> thank you,
> 
> giorgio
> 
> 
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |