[PATCH v4 00/16] efi_loader: add secure boot support

[Heinrich Schuchardt]

On 12/18/19 1:44 AM, AKASHI Takahiro wrote:
> One of major missing features in current UEFI implementation is "secure boot."
> The ultimate goal of my attempt is to implement image authentication based
> on signature and provide UEFI secure boot support which would be fully
> compliant with UEFI specification, section 32[1].
> (The code was originally developed by Patrick Wildt.)
>
> Please note, however, this patch doesn't work on its own; there are
> a couple of functional dependencies[2] and [3], that I have submitted
> before. For complete workable patch set, see my repository[4],
> which also contains experimental timestamp-based revocation suuport.
>
> My "non-volatile" support[5], which is under discussion, is not mandatory
> and so not included here, but this inevitably implies that, for example,
> signature database variables, like db and dbx, won't be persistent unless you
> explicitly run "env save" command and that UEFI variables are not separated
> from U-Boot environment. Anyhow, Linaro is also working on implementing
> real "secure storage" solution based on TF-A and OP-TEE.
>

Device trees can be used for denial of service or to destroy hardware.

How will you address the validation of device trees?

Best regards

Heinrich