EnrollFromDefaultKeysApp.c 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117
  1. /** @file
  2. Enroll default PK, KEK, db, dbx.
  3. Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
  4. Copyright (c) 2021, Semihalf All rights reserved.<BR>
  5. SPDX-License-Identifier: BSD-2-Clause-Patent
  6. **/
  7. #include <Guid/AuthenticatedVariableFormat.h> // gEfiCustomModeEnableGuid
  8. #include <Guid/GlobalVariable.h> // EFI_SETUP_MODE_NAME
  9. #include <Guid/ImageAuthentication.h> // EFI_IMAGE_SECURITY_DATABASE
  10. #include <Library/BaseLib.h> // GUID_STRING_LENGTH
  11. #include <Library/BaseMemoryLib.h> // CopyGuid()
  12. #include <Library/DebugLib.h> // ASSERT()
  13. #include <Library/MemoryAllocationLib.h> // FreePool()
  14. #include <Library/PrintLib.h> // AsciiSPrint()
  15. #include <Library/UefiBootServicesTableLib.h> // gBS
  16. #include <Library/UefiLib.h> // AsciiPrint()
  17. #include <Library/UefiRuntimeServicesTableLib.h> // gRT
  18. #include <Uefi/UefiMultiPhase.h>
  19. #include <UefiSecureBoot.h>
  20. #include <Library/SecureBootVariableLib.h>
  21. #include <Library/SecureBootVariableProvisionLib.h>
  22. /**
  23. Entry point function of this shell application.
  24. @param[in] ImageHandle The firmware allocated handle for the EFI image.
  25. @param[in] SystemTable A pointer to the EFI System Table.
  26. @retval 0 The entry point is executed successfully.
  27. @retval other Some error occurs when executing this entry point.
  28. **/
  29. EFI_STATUS
  30. EFIAPI
  31. UefiMain (
  32. IN EFI_HANDLE ImageHandle,
  33. IN EFI_SYSTEM_TABLE *SystemTable
  34. )
  35. {
  36. EFI_STATUS Status;
  37. UINT8 SetupMode;
  38. Status = GetSetupMode (&SetupMode);
  39. if (EFI_ERROR (Status)) {
  40. AsciiPrint ("EnrollFromDefaultKeysApp: Cannot get SetupMode variable: %r\n", Status);
  41. return 1;
  42. }
  43. if (SetupMode == USER_MODE) {
  44. AsciiPrint ("EnrollFromDefaultKeysApp: Skipped - USER_MODE\n");
  45. return 1;
  46. }
  47. Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
  48. if (EFI_ERROR (Status)) {
  49. AsciiPrint ("EnrollFromDefaultKeysApp: Cannot set CUSTOM_SECURE_BOOT_MODE: %r\n", Status);
  50. return 1;
  51. }
  52. Status = EnrollDbFromDefault ();
  53. if (EFI_ERROR (Status)) {
  54. AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll db: %r\n", Status);
  55. goto error;
  56. }
  57. Status = EnrollDbxFromDefault ();
  58. if (EFI_ERROR (Status)) {
  59. AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll dbt: %r\n", Status);
  60. }
  61. Status = EnrollDbtFromDefault ();
  62. if (EFI_ERROR (Status)) {
  63. AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll dbx: %r\n", Status);
  64. }
  65. Status = EnrollKEKFromDefault ();
  66. if (EFI_ERROR (Status)) {
  67. AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll KEK: %r\n", Status);
  68. goto cleardbs;
  69. }
  70. Status = EnrollPKFromDefault ();
  71. if (EFI_ERROR (Status)) {
  72. AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll PK: %r\n", Status);
  73. goto clearKEK;
  74. }
  75. Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE);
  76. if (EFI_ERROR (Status)) {
  77. AsciiPrint (
  78. "EnrollFromDefaultKeysApp: Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n"
  79. "Please do it manually, otherwise system can be easily compromised\n"
  80. );
  81. }
  82. return 0;
  83. clearKEK:
  84. DeleteKEK ();
  85. cleardbs:
  86. DeleteDbt ();
  87. DeleteDbx ();
  88. DeleteDb ();
  89. error:
  90. Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE);
  91. if (EFI_ERROR (Status)) {
  92. AsciiPrint (
  93. "EnrollFromDefaultKeysApp: Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n"
  94. "Please do it manually, otherwise system can be easily compromised\n"
  95. );
  96. }
  97. return 1;
  98. }