[PATCH v1 2/2] test: check default GUID selection of signature database variables

[Heinrich Schuchardt]

On 7/14/26 11:49, Aristo Chen wrote:
> The name to GUID mapping that "env set -e" applies when no -guid
> option is given was not covered by any test, which is how the wrong
> default GUID for "dbr" went unnoticed until the previous commit.
> 
> Add a test case that enrolls each of db, dbx, dbt and dbr in setup
> mode without an explicit -guid option and checks that every variable
> is created under the image security database GUID and not under the
> global variable GUID. This is also the first coverage of dbt and dbr
> anywhere under test/. The enrollment happens in setup mode because
> once secure boot is enabled, efi_variable_authenticate() only accepts
> writes to PK, KEK, db and dbx.
> 
> Signed-off-by: Aristo Chen <aristo.chen at canonical.com>
> ---
>   test/py/tests/test_efi_secboot/conftest.py    |  8 +++++
>   .../py/tests/test_efi_secboot/test_authvar.py | 30 +++++++++++++++++++
>   2 files changed, 38 insertions(+)
> 
> diff --git a/test/py/tests/test_efi_secboot/conftest.py b/test/py/tests/test_efi_secboot/conftest.py
> index 76b8f9fa0a3..0755497d46d 100644
> --- a/test/py/tests/test_efi_secboot/conftest.py
> +++ b/test/py/tests/test_efi_secboot/conftest.py
> @@ -96,6 +96,14 @@ def efi_boot_env(request, ubman):
>           check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx db.esl dbx_db.auth'
>                      % (mnt_point, EFITOOLS_PATH),
>                      shell=True)
> +        # dbt (with TEST_db certificate)
> +        check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbt db.esl dbt.auth'
> +                   % (mnt_point, EFITOOLS_PATH),
> +                   shell=True)
> +        # dbr (with TEST_db certificate)
> +        check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbr db.esl dbr.auth'
> +                   % (mnt_point, EFITOOLS_PATH),
> +                   shell=True)
>   
>           # Copy image
>           check_call('cp %s/lib/efi_loader/helloworld.efi %s' %
> diff --git a/test/py/tests/test_efi_secboot/test_authvar.py b/test/py/tests/test_efi_secboot/test_authvar.py
> index 7b45f8fb814..45350b19b06 100644
> --- a/test/py/tests/test_efi_secboot/test_authvar.py
> +++ b/test/py/tests/test_efi_secboot/test_authvar.py
> @@ -279,3 +279,33 @@ class TestEfiAuthVar(object):
>               output = ubman.run_command(
>                   'printenv -e SetupMode')
>               assert '00000000: 01' in output
> +
> +    def test_efi_var_auth6(self, ubman, efi_boot_env):
> +        """
> +        Test Case 6 - Default GUID of signature database variables
> +        """
> +        ubman.restart_uboot()
> +        disk_img = efi_boot_env
> +        with ubman.log.section('Test Case 6a'):
> +            # Test Case 6a, install signature database variables in setup
> +            # mode without -guid
> +            output = ubman.run_command_list([
> +                'host bind 0 %s' % disk_img,
> +                'printenv -e SetupMode'])
> +            assert '00000000: 01' in ''.join(output)
> +
> +            for var in ('db', 'dbx', 'dbt', 'dbr'):

Thank you Aristo for updating the test.

Should we check the GUID of PK and KEK too?

Best regards

Heinrich

> +                output = ubman.run_command_list([
> +                    'fatload host 0:1 4000000 %s.auth' % var,
> +                    'setenv -e -nv -bs -rt -at -i 4000000:$filesize %s' % var,
> +                    'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f %s' % var])
> +                assert 'Failed to set EFI variable' not in ''.join(output)
> +                assert '%s:' % var in ''.join(output)
> +
> +        with ubman.log.section('Test Case 6b'):
> +            # Test Case 6b, variables must not exist under the global
> +            # variable GUID
> +            for var in ('db', 'dbx', 'dbt', 'dbr'):
> +                output = ubman.run_command(
> +                    'printenv -e -n -guid 8be4df61-93ca-11d2-aa0d-00e098032b8c %s' % var)
> +                assert '\"%s\" not defined' % var in output