vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: check default GUID selection of signature database variables

Browse Source 
The name to GUID mapping that "env set -e" applies when no -guid
option is given was not covered by any test, which is how the wrong
default GUID for "dbr" went unnoticed until the previous commit.

Add a test case that enrolls each of db, dbx, dbt and dbr in setup
mode without an explicit -guid option and checks that every variable
is created under the image security database GUID and not under the
global variable GUID. Then enroll PK and KEK, also without -guid, and
check that both are created under the global variable GUID and not
under the image security database GUID. This is also the first
coverage of dbt and dbr anywhere under test/.

The signature database enrollment happens in setup mode because once
secure boot is enabled, efi_variable_authenticate() only accepts
writes to PK, KEK, db and dbx; PK and KEK are enrolled last because
installing PK leaves setup mode.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
This commit is contained in:
Aristo Chen
2026-07-27 18:50:28 +02:00
committed by Heinrich Schuchardt
parent 7a63ea5889
commit af52349756
2 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/py/tests/test_efi_secboot/conftest.py
+8
View File
@@ -96,6 +96,14 @@ def efi_boot_env(request, ubman):
check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx db.esl dbx_db.auth'
% (mnt_point, EFITOOLS_PATH),
shell=True)
# dbt (with TEST_db certificate)
check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbt db.esl dbt.auth'
% (mnt_point, EFITOOLS_PATH),
shell=True)
# dbr (with TEST_db certificate)
check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbr db.esl dbr.auth'
% (mnt_point, EFITOOLS_PATH),
shell=True)
# Copy image
check_call('cp %s/lib/efi_loader/helloworld.efi %s' %
test/py/tests/test_efi_secboot/test_authvar.py
+47
View File
@@ -279,3 +279,50 @@ class TestEfiAuthVar(object):
output = ubman.run_command(
'printenv -e SetupMode')
assert '00000000: 01' in output
def test_efi_var_auth6(self, ubman, efi_boot_env):
"""
Test Case 6 - Default GUID of signature database variables
"""
ubman.restart_uboot()
disk_img = efi_boot_env
with ubman.log.section('Test Case 6a'):
# Test Case 6a, install signature database variables in setup
# mode without -guid
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'printenv -e SetupMode'])
assert '00000000: 01' in ''.join(output)
for var in ('db', 'dbx', 'dbt', 'dbr'):
output = ubman.run_command_list([
'fatload host 0:1 4000000 %s.auth' % var,
'setenv -e -nv -bs -rt -at -i 4000000:$filesize %s' % var,
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f %s' % var])
assert 'Failed to set EFI variable' not in ''.join(output)
assert '%s:' % var in ''.join(output)
with ubman.log.section('Test Case 6b'):
# Test Case 6b, variables must not exist under the global
# variable GUID
for var in ('db', 'dbx', 'dbt', 'dbr'):
output = ubman.run_command(
'printenv -e -n -guid 8be4df61-93ca-11d2-aa0d-00e098032b8c %s' % var)
assert '\"%s\" not defined' % var in output
with ubman.log.section('Test Case 6c'):
# Test Case 6c, PK and KEK get the global variable GUID by
# default. Enrolling PK leaves setup mode, so this must come
# after the signature database enrollment above.
for var in ('PK', 'KEK'):
output = ubman.run_command_list([
'fatload host 0:1 4000000 %s.auth' % var,
'setenv -e -nv -bs -rt -at -i 4000000:$filesize %s' % var,
'printenv -e -n -guid 8be4df61-93ca-11d2-aa0d-00e098032b8c %s' % var])
assert 'Failed to set EFI variable' not in ''.join(output)
assert '%s:' % var in ''.join(output)
for var in ('PK', 'KEK'):
output = ubman.run_command(
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f %s' % var)
assert '\"%s\" not defined' % var in output