SecurityPkg: Add option to reset secure boot keys.

This commit add option which allows reset content of Secure Boot
keys and databases to default variables.

Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
Reviewed-by: Sunny Wang <sunny.wang@arm.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
Reviewed-by: Pete Batard <pete@akeo.ie>
Tested-by: Pete Batard <pete@akeo.ie> # on Raspberry Pi 4

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
index fa7e11848cc9e546c4b40c7815bc7eacba57eea0..e4560c592ca9bfc5aff3122bfdd00fbc04c72e53 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
@@ -69,6 +69,12 @@ formset
     endif;\r
     endif;\r
 \r
+    text\r
+      help   = STRING_TOKEN(STR_SECURE_RESET_TO_DEFAULTS_HELP),\r
+      text   = STRING_TOKEN(STR_SECURE_RESET_TO_DEFAULTS),\r
+      flags  = INTERACTIVE,\r
+      key    = KEY_SECURE_BOOT_RESET_TO_DEFAULT;\r
+\r
   endform;\r
 \r
   //\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
index 14c7311b08b56c29ea002abf9ad6bf6a7868f723..420687a211416282b4905f3a62e95c10ef68f829 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
@@ -110,6 +110,7 @@
 [Protocols]\r
   gEfiHiiConfigAccessProtocolGuid               ## PRODUCES\r
   gEfiDevicePathProtocolGuid                    ## PRODUCES\r
+  gEfiHiiPopupProtocolGuid\r
 \r
 [Depex]\r
   gEfiHiiConfigRoutingProtocolGuid  AND\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index f527aa32e647e86ffca8e16529a28a011ddc2930..65a8188d6d03cc7a0e3d19f5af0ed6affff9abf8 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -8,6 +8,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 **/\r
 \r
 #include "SecureBootConfigImpl.h"\r
+#include <Protocol/HiiPopup.h>\r
 #include <Library/BaseCryptLib.h>\r
 #include <Library/SecureBootVariableLib.h>\r
 #include <Library/SecureBootVariableProvisionLib.h>\r
@@ -4155,6 +4156,131 @@ ON_EXIT:
   return Status;\r
 }\r
 \r
+/**\r
+  This function reinitializes Secure Boot variables with default values.\r
+\r
+  @retval   EFI_SUCCESS           Success to update the signature list page\r
+  @retval   others                Fail to delete or enroll signature data.\r
+**/\r
+STATIC EFI_STATUS\r
+EFIAPI\r
+KeyEnrollReset (\r
+  VOID\r
+  )\r
+{\r
+  EFI_STATUS  Status;\r
+  UINT8       SetupMode;\r
+\r
+  Status = EFI_SUCCESS;\r
+\r
+  Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);\r
+  if (EFI_ERROR(Status)) {\r
+    return Status;\r
+  }\r
+\r
+  // Clear all the keys and databases\r
+  Status = DeleteDb ();\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    DEBUG ((DEBUG_ERROR, "Fail to clear DB: %r\n", Status));\r
+    return Status;\r
+  }\r
+\r
+  Status = DeleteDbx ();\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    DEBUG ((DEBUG_ERROR, "Fail to clear DBX: %r\n", Status));\r
+    return Status;\r
+  }\r
+\r
+  Status = DeleteDbt ();\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    DEBUG ((DEBUG_ERROR, "Fail to clear DBT: %r\n", Status));\r
+    return Status;\r
+  }\r
+\r
+  Status = DeleteKEK ();\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    DEBUG ((DEBUG_ERROR, "Fail to clear KEK: %r\n", Status));\r
+    return Status;\r
+  }\r
+\r
+  Status = DeletePlatformKey ();\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    DEBUG ((DEBUG_ERROR, "Fail to clear PK: %r\n", Status));\r
+    return Status;\r
+  }\r
+\r
+  // After PK clear, Setup Mode shall be enabled\r
+  Status = GetSetupMode (&SetupMode);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot get SetupMode variable: %r\n",\r
+      Status));\r
+    return Status;\r
+  }\r
+\r
+  if (SetupMode == USER_MODE) {\r
+    DEBUG((DEBUG_INFO, "Skipped - USER_MODE\n"));\r
+    return EFI_SUCCESS;\r
+  }\r
+\r
+  Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot set CUSTOM_SECURE_BOOT_MODE: %r\n",\r
+      Status));\r
+    return EFI_SUCCESS;\r
+  }\r
+\r
+  // Enroll all the keys from default variables\r
+  Status = EnrollDbFromDefault ();\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot enroll db: %r\n", Status));\r
+    goto error;\r
+  }\r
+\r
+  Status = EnrollDbxFromDefault ();\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot enroll dbx: %r\n", Status));\r
+  }\r
+\r
+  Status = EnrollDbtFromDefault ();\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot enroll dbt: %r\n", Status));\r
+  }\r
+\r
+  Status = EnrollKEKFromDefault ();\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot enroll KEK: %r\n", Status));\r
+    goto cleardbs;\r
+  }\r
+\r
+  Status = EnrollPKFromDefault ();\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot enroll PK: %r\n", Status));\r
+    goto clearKEK;\r
+  }\r
+\r
+  Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n"\r
+      "Please do it manually, otherwise system can be easily compromised\n"));\r
+  }\r
+\r
+  return Status;\r
+\r
+clearKEK:\r
+  DeleteKEK ();\r
+\r
+cleardbs:\r
+  DeleteDbt ();\r
+  DeleteDbx ();\r
+  DeleteDb ();\r
+\r
+error:\r
+  if (SetSecureBootMode (STANDARD_SECURE_BOOT_MODE) != EFI_SUCCESS) {\r
+    DEBUG ((DEBUG_ERROR, "Cannot set mode to Secure: %r\n", Status));\r
+  }\r
+  return Status;\r
+}\r
+\r
 /**\r
   This function is called to provide results data to the driver.\r
 \r
@@ -4206,6 +4332,8 @@ SecureBootCallback (
   SECUREBOOT_CONFIG_PRIVATE_DATA  *PrivateData;\r
   BOOLEAN                         GetBrowserDataResult;\r
   ENROLL_KEY_ERROR                EnrollKeyErrorCode;\r
+  EFI_HII_POPUP_PROTOCOL          *HiiPopup;\r
+  EFI_HII_POPUP_SELECTION         UserSelection;\r
 \r
   Status             = EFI_SUCCESS;\r
   SecureBootEnable   = NULL;\r
@@ -4756,6 +4884,31 @@ SecureBootCallback (
         FreePool (SetupMode);\r
       }\r
       break;\r
+    case KEY_SECURE_BOOT_RESET_TO_DEFAULT:\r
+    {\r
+      Status = gBS->LocateProtocol (&gEfiHiiPopupProtocolGuid, NULL, (VOID **) &HiiPopup);\r
+      if (EFI_ERROR (Status)) {\r
+        return Status;\r
+      }\r
+      Status = HiiPopup->CreatePopup (\r
+                           HiiPopup,\r
+                           EfiHiiPopupStyleInfo,\r
+                           EfiHiiPopupTypeYesNo,\r
+                           Private->HiiHandle,\r
+                           STRING_TOKEN (STR_RESET_TO_DEFAULTS_POPUP),\r
+                           &UserSelection\r
+                           );\r
+      if (UserSelection == EfiHiiPopupSelectionYes) {\r
+        Status = KeyEnrollReset ();\r
+      }\r
+      //\r
+      // Update secure boot strings after key reset\r
+      //\r
+      if (Status == EFI_SUCCESS) {\r
+        Status = UpdateSecureBootString (Private);\r
+        SecureBootExtractConfigFromVariable (Private, IfrNvData);\r
+      }\r
+    }\r
     default:\r
       break;\r
     }\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
index 6e54a4b0f21cea73a041b4845dc8335478270618..4ecc25efc3be061edbaddfe74f2ad59feb6e88a1 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
@@ -54,6 +54,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 \r
 #define KEY_VALUE_FROM_DBX_TO_LIST_FORM       0x100f\r
 \r
+#define KEY_SECURE_BOOT_RESET_TO_DEFAULT      0x1010\r
+\r
 #define KEY_SECURE_BOOT_OPTION                0x1100\r
 #define KEY_SECURE_BOOT_PK_OPTION             0x1101\r
 #define KEY_SECURE_BOOT_KEK_OPTION            0x1102\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
index ac783453cc88a94a8c7e088f0258135f7d4e2747..0d01701de704ba681c51324495e47407b7a0e6b4 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
@@ -21,6 +21,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #string STR_SECURE_BOOT_PROMPT             #language en-US "Attempt Secure Boot"\r
 #string STR_SECURE_BOOT_HELP               #language en-US "Enable/Disable the Secure Boot feature after platform reset"\r
 \r
+#string STR_SECURE_RESET_TO_DEFAULTS_HELP  #language en-US "Enroll keys with data from default variables"\r
+#string STR_SECURE_RESET_TO_DEFAULTS       #language en-US "Reset Secure Boot Keys"\r
+#string STR_RESET_TO_DEFAULTS_POPUP        #language en-US "Secure Boot Keys & databases will be initialized from defaults.\n Are you sure?"\r
+\r
 #string STR_SECURE_BOOT_ENROLL_SIGNATURE   #language en-US "Enroll Signature"\r
 #string STR_SECURE_BOOT_DELETE_SIGNATURE   #language en-US "Delete Signature"\r
 #string STR_SECURE_BOOT_DELETE_LIST_FORM   #language en-US "Delete Signature List Form"\r