efi/preinstall: Update PCRProfileOptionsFlags #481
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chrisccoulson
force-pushed
the
preinstall-cleanup-pcr-profile-options
branch
from
fb26b17 to
bec8f72
Compare
Collaborator
Author
|
Note that as with the other PRs that make some changes to |
chrisccoulson
force-pushed
the
preinstall-cleanup-pcr-profile-options
branch
from
bec8f72 to
68bfe14
Compare
This updates PCRProfileOptionsFlags, such that: - There are now individual options to include each PCR if not already included (PCRProfileOptionLockTo*). - PCRProfileOptionsMostSecure includes all of the new PCRProfileOptionLockTo* options. - PCRProfileOptionTrustCAsForAddonDrivers and PCRProfileOptionTrustCAsForBootCode have been renamed to - PCRProfileOptionTrustSecureBootAuthoritiesForAddonDrivers and PCRProfileOptionTrustSecureBootAuthoritiesForBootCode. They can only be used if the active CAs are not recognized. They can't be used to omit PCRs 2 or 4 from the profile if the CA is recognized and explicitly distrusted, so that users can't use these options to create insecure profiles. - PCRProfileOptionDistrustVARSuppliedNonHostCode is gone because it is superceded by PCRProfileOptionLockToDriversAndApps. Fixes: FR-12150
chrisccoulson
force-pushed
the
preinstall-cleanup-pcr-profile-options
branch
from
68bfe14 to
321eeb1
Compare
pedronis
reviewed
Dec 12, 2025
Collaborator
pedronis
left a comment
pedronis
left a comment
There was a problem hiding this comment.
did a pass, some small comments
| if flags&auth.Trust != flags { | ||
| return authoritiesNotTrusted | ||
| } | ||
| certFound = true |
Collaborator
There was a problem hiding this comment.
isn't this more authFound than cert found?
| } | ||
| trust &= certTrust | ||
| if !certFound { | ||
| return authoritiesTrustUnknown |
Collaborator
There was a problem hiding this comment.
maybe this should have a comment that the authority of this cert is not in the data set
|
|
||
| var str string | ||
| switch flag { | ||
| case PCRProfileOptionMostSecure: |
Collaborator
There was a problem hiding this comment.
this value is now always exploded in the relevant flags?
| {pcr: internal_efi.BootManagerConfigPCR, unsupportedFlag: NoBootManagerConfigProfileSupport}, | ||
| {pcr: internal_efi.SecureBootPolicyPCR, unsupportedFlag: NoSecureBootPolicyProfileSupport, opt: secboot_efi.WithSecureBootPolicyProfile}, | ||
| } { | ||
| if _, exists := pcrs[data.pcr]; exists { |
Collaborator
There was a problem hiding this comment.
I think here s/exists/required/ would be a bit clearer
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This updates PCRProfileOptionsFlags, such that:
included (
PCRProfileOptionLockTo*).PCRProfileOptionsMostSecureincludes all of the newPCRProfileOptionLockTo*options.PCRProfileOptionTrustCAsForAddonDriversandPCRProfileOptionTrustCAsForBootCodehave been renamed toPCRProfileOptionTrustSecureBootAuthoritiesForAddonDriversandPCRProfileOptionTrustSecureBootAuthoritiesForBootCode. They can onlybe used if the active CAs are not recognized. They can't be used to
omit PCRs 2 or 4 from the profile if the CA is recognized and explicitly
distrusted, so that users can't use these options to create insecure
profiles.
PCRProfileOptionDistrustVARSuppliedNonHostCodeis gone because it issuperceded by
PCRProfileOptionLockToDriversAndApps.Fixes: FR-12150