On 7/10/26 15:23, Ian Mullins wrote:
This series implements the EFI_SECURITY_ARCH_PROTOCOL and
EFI_SECURITY2_ARCH_PROTOCOL. The primary motivation is to support EFI
applications like systemd-stub in Unified Kernel Images (UKI) so they
can temporarily override authentication for embedded payloads.
Note: This work was originally authored by Enric Balletbo i Serra.
I am submitting it upstream on his behalf with additional testing.
Consumption of these protocols by EFI applications does not conform to
the UEFI specification.
Chapter 1.4 Goals has this sentence:
"On the other hand, firmware-internal interfaces, such as those defined
by the PI Specification, are produced and consumed by firmware only, and
are not considered interfaces that a UEFI aware OS can connect to,
interact with, or depend on."
Neither the PI nor the UEFI specification indicate that overwriting
pointers to the EFI_SECURITY_ARCH_PROTOCOL or
EFI_SECURITY2_ARCH_PROTOCOL at boot time shall influence which images
LoadImage() accepts. What systemd uses is undocumented behavior of EDK II.
The correct way forward is to fix systemd and Linux' EFI_ZBOOT stub to
make them comply with the UEFI specification.
See this mail by Lennart Poettering:
https://lists.freedesktop.org/archives/systemd-devel/2025-March/051313.html
Best regards
Heinrich
---
Testing Performed
I have validated these patches across various secure boot scenarios on
both physical hardware and emulators to ensure the new overrides work
without regressing standard secure boot enforcement.
Hardware: Renesas R-Car S4 (EBBR UKI boot)
- [PASS] Unsigned image, Secure Boot disabled, without patch
(Boots)
- [PASS] Unsigned image, Secure Boot compiled (not enforcing),
without patch (Boots)
- [PASS] Signed image, Secure Boot enforcing, without patch
(Fails to boot as expected)
- [PASS] Signed image, Secure Boot enforcing, with patch
(Boots successfully)
- [PASS] Signed image (wrong keys), Secure Boot enforcing, with patch
(Fails to boot as expected)
Emulator: QEMU (qemu UKI boot)
- [PASS] Unsigned image, Secure Boot disabled, without patch
(Boots)
- [PASS] Unsigned image, Secure Boot enabled, without patch
(Boots)
- [PASS] Signed image, Secure Boot enabled, without patch
(Fails to boot as expected)
- [PASS] Signed image, Secure Boot enabled, with patch
(Boots successfully)
Signed-off-by: Ian Mullins <[email protected]>
---
Enric Balletbo i Serra (2):
efi_loader: implement EFI Security Architecture protocols
efi_selftest: add tests for security architecture protocols
include/efi_api.h | 30 +++
include/efi_loader.h | 15 +-
lib/efi_loader/Kconfig | 11 ++
lib/efi_loader/Makefile | 1 +
lib/efi_loader/efi_boottime.c | 3 +-
lib/efi_loader/efi_image_loader.c | 31 ++-
lib/efi_loader/efi_security.c | 99 ++++++++++
lib/efi_loader/efi_setup.c | 7 +
lib/efi_selftest/Makefile | 1 +
lib/efi_selftest/efi_selftest_security_arch.c | 110 +++++++++++
.../py/tests/test_efi_secboot/README.security_arch | 208 +++++++++++++++++++++
.../tests/test_efi_secboot/test_security_arch.py | 73 ++++++++
12 files changed, 580 insertions(+), 9 deletions(-)
---
base-commit: 913fedc816570c07bfc7f9c4046dc2a3a55e4099
change-id: 20260710-efi_security_protocol-6b9fb0e8da41
Best regards,
