On Mon Sep 2, 2024 at 11:41 AM CEST, Mikko Rapeli wrote: > From: Michelle Lin <[email protected]> > > This class calls systemd ukify tool, which will combine > kernel/initrd/stub components to build the UKI. To sign the UKI > (i.e. SecureBoot), the keys/cert files can be specified > in a configuration file or UEFI binary signing can be done > via separate steps, see qemuarm64-secureboot in meta-arm. > UKIs are loaded by UEFI firmware on target which can improve > security by loading only correctly signed kernel, initrd and kernel > command line. > > Using systemd-measure to pre-calculate TPM PCR values and sign them is > not supported since that requires a TPM device on the build host. Thus > "ConditionSecurity=measured-uki" default from systemd 256 does not work > but "ConditionSecurity=tpm2" in combination with secure boot will. > These can be used to boot securely into systemd-boot, kernel, kernel > command line and initrd which then securely mounts a read-only dm-verity > /usr partition and creates a TPM encrypted read-write / rootfs. > > Tested via qemuarm64-secureboot in meta-arm with > https://lists.yoctoproject.org/g/meta-arm/topic/patch_v3_02_13/108031399 > and a few more changes needed, will be posted separately. > > Signed-off-by: Michelle Lin <[email protected]> > Cc: Erik Schilling <[email protected]> > Signed-off-by: Mikko Rapeli <[email protected]>
> --- > meta/classes-recipe/uki.bbclass | 158 ++++++++++++++++++++++++++++++++ > 1 file changed, 158 insertions(+) > create mode 100644 meta/classes-recipe/uki.bbclass Acked-by: Erik Schilling <[email protected]>
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#204087): https://lists.openembedded.org/g/openembedded-core/message/204087 Mute This Topic: https://lists.openembedded.org/mt/108223987/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
