Re: [PATCH 06/10] add example to generated and distribute MOK data

[Jan Kiszka <jan.kiszka@siemens.com>]

On 23.12.22 09:40, Felix Moessbauer wrote:
> This patch adds two recipes to easily handle a Machine Owner Key (MOK)
> that can be used to sign kernel modules or other components.
> 
> The sb-mok-keys package generates a x509 certificate at build time and
> adds both the certificate and the private key to a binary package.
> This is implemented in a way that the source package does not contain
> any keys, but only the binary package does. While this breaks
> reproducability, this ensures that the keys never end up in a src
> repository.

It's still not usable in case of externally managed keys (security
tokens, trust centers etc.). This should be made clear, and we still
need to invent a pattern for such cases which are more common in production.

Jan

> 
> A second package sb-mok-public is provided to distribute the generated
> key into the target image (to inject into EFI at runtime). This package
> build-depends on the sb-mok-keys, but conflicts at runtime to make sure
> that the private key cannot be installed into the target image (given
> that the -public package is installed).
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  .../sb-mok-keys/files/Makefile.tmpl           | 27 +++++++++++++++++++
>  .../sb-mok-keys/sb-mok-keys.bb                | 23 ++++++++++++++++
>  .../sb-mok-public/files/rules                 | 12 +++++++++
>  .../sb-mok-public/sb-mok-public.bb            | 17 ++++++++++++
>  4 files changed, 79 insertions(+)
>  create mode 100644 meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl
>  create mode 100644 meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb
>  create mode 100644 meta-isar/recipes-secureboot/sb-mok-public/files/rules
>  create mode 100644 meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb
> 
> diff --git a/meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl b/meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl
> new file mode 100644
> index 0000000..b377c51
> --- /dev/null
> +++ b/meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl
> @@ -0,0 +1,27 @@
> +# Base image recipe for ISAR
> +#
> +# This software is a part of ISAR.
> +# Copyright (C) 2022 Siemens AG
> +
> +CN=${COMMON_NAME}
> +
> +all: create_key
> +
> +create_key:
> +	mkdir MOK
> +	openssl req -new -x509 -newkey rsa:2048 -keyout MOK/MOK.priv -outform DER -out MOK/MOK.der -nodes -days 36500 -subj "/CN=$(CN)/"
> +	chmod 600 MOK/MOK.priv
> +
> +install:
> +	install -d $(DESTDIR)/etc/sb-mok-keys/MOK
> +	# note that this will later be changed by dh_fixperms
> +	# this is also required so that the non-privileged sbuild
> +	# user can read the file
> +	install -m 644 MOK/MOK.priv $(DESTDIR)/etc/sb-mok-keys/MOK/
> +	install -m 644 MOK/MOK.der  $(DESTDIR)/etc/sb-mok-keys/MOK/
> +
> +clean:
> +ifneq (,$(wildcard ./MOK/MOK.priv))
> +	shred MOK/MOK.priv
> +endif
> +	rm -rf MOK
> diff --git a/meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb b/meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb
> new file mode 100644
> index 0000000..6137834
> --- /dev/null
> +++ b/meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb
> @@ -0,0 +1,23 @@
> +# Base image recipe for ISAR
> +#
> +# This software is a part of ISAR.
> +# Copyright (C) 2022 Siemens AG
> +
> +inherit dpkg
> +
> +
> +SRC_URI = "file://Makefile.tmpl"
> +S = "${WORKDIR}/src"
> +
> +TEMPLATE_VARS = "COMMON_NAME"
> +TEMPLATE_FILES = "Makefile.tmpl"
> +
> +DEBIAN_BUILD_DEPENDS .= ",openssl"
> +# common name of x509 certificate used for signing
> +COMMON_NAME = "ISAR Builder"
> +
> +do_prepare_build[cleandirs] += "${S}/debian"
> +do_prepare_build() {
> +    cp ${WORKDIR}/Makefile ${S}
> +    deb_debianize
> +}
> diff --git a/meta-isar/recipes-secureboot/sb-mok-public/files/rules b/meta-isar/recipes-secureboot/sb-mok-public/files/rules
> new file mode 100644
> index 0000000..305b443
> --- /dev/null
> +++ b/meta-isar/recipes-secureboot/sb-mok-public/files/rules
> @@ -0,0 +1,12 @@
> +#!/usr/bin/make -f
> +# Base image recipe for ISAR
> +#
> +# This software is a part of ISAR.
> +# Copyright (C) 2022 Siemens AG
> +
> +%:
> +	dh $@
> +
> +override_dh_install:
> +	install -d debian/sb-mok-public/etc/sb-mok-keys/MOK/
> +	install -m 644 /etc/sb-mok-keys/MOK/MOK.der debian/sb-mok-public/etc/sb-mok-keys/MOK/MOK.der
> diff --git a/meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb b/meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb
> new file mode 100644
> index 0000000..46fdeed
> --- /dev/null
> +++ b/meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb
> @@ -0,0 +1,17 @@
> +# Base image recipe for ISAR
> +#
> +# This software is a part of ISAR.
> +# Copyright (C) 2022 Siemens AG
> +
> +inherit dpkg
> +
> +DEPENDS += "sb-mok-keys"
> +DEBIAN_BUILD_DEPENDS .= ",sb-mok-keys"
> +DEBIAN_CONFLICTS .= ",sb-mok-keys"
> +
> +SRC_URI = "file://rules"
> +
> +do_prepare_build[cleandirs] += "${S}/debian"
> +do_prepare_build() {
> +    deb_debianize
> +}

-- 
Siemens AG, Technology
Competence Center Embedded Linux