Skip to content

Commit c45bed2

Browse files
CamelronCamelron
authored
[3.0] Introduce signed packages for edk2-hvloader and kernel-mshv (#10580)
Introduce signed packages to enable secure boot for components in the Linux Dom0 scenario's boot chain.
1 parent 84aabf5 commit c45bed2

6 files changed

Lines changed: 237 additions & 2 deletions

File tree

‎LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎LICENSES-AND-NOTICES/SPECS/data/licenses.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2246,6 +2246,7 @@
22462246
"docker-compose",
22472247
"doxygen",
22482248
"dtc",
2249+
"edk2-hvloader-signed",
22492250
"elixir",
22502251
"espeak-ng",
22512252
"espeakup",
@@ -2270,6 +2271,7 @@
22702271
"keda",
22712272
"keras",
22722273
"kernel-64k-signed",
2274+
"kernel-mshv-signed",
22732275
"kernel-signed",
22742276
"kernel-uki",
22752277
"kernel-uki-signed",

‎SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
%global debug_package %{nil}
2+
%define name_github HvLoader
3+
%ifarch x86_64
4+
%global buildarch x86_64
5+
6+
# edk2-stable202402
7+
%define GITDATE 20240524
8+
%define GITCOMMIT 3e722403cd16
9+
10+
%endif
11+
Summary: Signed HvLoader.efi for %{buildarch} systems
12+
Name: edk2-hvloader-signed-%{buildarch}
13+
Version: %{GITDATE}git%{GITCOMMIT}
14+
Release: 4%{?dist}
15+
License: MIT
16+
Vendor: Microsoft Corporation
17+
Distribution: Azure Linux
18+
URL: https://github.com/microsoft/HvLoader
19+
# This package's "version" and "release" must reflect the unsigned version that
20+
# was signed.
21+
# An important consequence is that when making a change to this package, the
22+
# unsigned version/release must be increased to keep the two versions consistent.
23+
# Ideally though, this spec will not change much or at all, so the version will
24+
# just track the unsigned package's version/release.
25+
#
26+
# To populate these sources:
27+
# 1. Build the unsigned packages as normal
28+
# 2. Sign the desired binary
29+
# 3. Place the unsigned package and signed binary in this spec's folder
30+
# 4. Build this spec
31+
Source0: edk2-hvloader-%{version}-%{release}.%{buildarch}.rpm
32+
Source1: HvLoader.efi
33+
ExclusiveArch: x86_64
34+
35+
%description
36+
This package contains the HvLoader EFI binary signed for secure boot. The package is
37+
specifically created for installing on %{buildarch} systems
38+
39+
%package -n edk2-hvloader
40+
Summary: HvLoader.efi is an EFI application for loading an external hypervisor loader.
41+
Group: Applications/System
42+
43+
%description -n edk2-hvloader
44+
HvLoader.efi is an EFI application for loading an external hypervisor loader.
45+
46+
HvLoader.efi loads a given hypervisor loader binary (DLL, EFI, etc.), and
47+
calls it's entry point passing HvLoader.efi ImageHandle. This way the
48+
hypervisor loader binary has access to HvLoader.efi's command line options,
49+
and use those as configuration parameters. The first HvLoader.efi command line
50+
option is the path to hypervisor loader binary.
51+
52+
%prep
53+
54+
%build
55+
mkdir rpm_contents
56+
pushd rpm_contents
57+
58+
# This spec's whole purpose is to inject the signed HvLoader binary
59+
rpm2cpio %{SOURCE0} | cpio -idmv
60+
cp %{SOURCE1} ./boot/efi/HvLoader.efi
61+
62+
popd
63+
64+
%install
65+
pushd rpm_contents
66+
67+
# Don't use * wildcard. It does not copy over hidden files in the root folder...
68+
cp -rp ./. %{buildroot}/
69+
70+
popd
71+
72+
%files -n edk2-hvloader
73+
%license MdeModulePkg/Application/%{name_github}-%{version}/LICENSE
74+
/boot/efi/HvLoader.efi
75+
76+
%changelog
77+
* Fri Jan 24 2025 Cameron Baird <cameronbaird@microsoft.com> - 20240524git3e722403cd16-4
78+
- Original version for Azure Linux.
79+
- License verified

‎SPECS-SIGNED/kernel-mshv-signed/kernel-mshv-signed.spec‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
%global debug_package %{nil}
2+
%global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh
3+
%ifarch x86_64
4+
%global buildarch x86_64
5+
%endif
6+
%define uname_r %{version}-%{release}
7+
Summary: Signed MSHV-enabled Linux Kernel for %{buildarch} systems
8+
Name: kernel-mshv-signed-%{buildarch}
9+
Version: 5.15.157.mshv1
10+
Release: 3%{?dist}
11+
License: GPLv2
12+
Vendor: Microsoft Corporation
13+
Distribution: Azure Linux
14+
Group: System Environment/Kernel
15+
URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel
16+
# This spec purpose is to take an input kernel rpm and input secure-boot-signed
17+
# kernel binary from the same build and generate a new "kernel" rpm with the
18+
# signed kernel binary + all of the other original kernel files, triggers,
19+
# scriptlets, requires, provides, etc.
20+
#
21+
# We need to ensure the kernel modules and kernel binary used are from the exact
22+
# same build because at build time the kernel modules are signed with an
23+
# ephemeral key that the kernel enrolls in its keyring. We enforce kernel
24+
# module signature checking when we enable security features like kernel
25+
# lockdown so our kernel can only load those specific kernel modules at runtime.
26+
#
27+
# Additionally, to complete the UEFI Secure Boot chain, we must PE-sign the
28+
# kernel binary. Ideally we would enable secure-boot signing tools like pesign
29+
# or sbsign to be callable from inside the rpmbuild environment, that way we can
30+
# secure-boot sign the kernel binary during the kernel's rpmbuild. It is best
31+
# practice to sign as soon as possible. However there are issues getting that
32+
# secure boot signing infrastructure in place today. Hence we sign the
33+
# resulting kernel binary and "repackage" the kernel RPM (something rpm itself
34+
# actively tries to make sure you never do...generally for good reasons).
35+
#
36+
# To achive this repackaging, this spec creates a new subpackage named
37+
# "kernel-mshv". To retain all of the initial kernel-mshv package behaviors, we make sure
38+
# the subpackage has the same requires, provides, triggers, post steps, and
39+
# files as the original kernel package.
40+
#
41+
# This specific repackaging implementation leaves room for us to enable the
42+
# more ideal secure-boot signing flow in the future without introducing any
43+
# sort of breaking change or new packaging. Users still install a "kernel-mshv"
44+
# package like they normally would.
45+
#
46+
# Maintenance Notes:
47+
# - This spec's "version" and "release" must reflect the unsigned version that
48+
# was signed. An important consequence is that when making a change to this
49+
# spec or the normal kernel spec, the other spec's version version/release must
50+
# be increased to keep the two versions consistent.
51+
#
52+
# - Make sure the kernel subpackage's Requires, Provides, triggers, post/postun
53+
# scriptlets, and files match the normal kernel-mshv spec's. The kernel subpackage
54+
# should contain the same content as the input kernel package but replace the
55+
# kernel binary with our signed kernel binary. Since all the requires, provides,
56+
# etc are the same, this new kernel package can be a direct replacement for the
57+
# normal kernel package and RPM will resolve packages with kernel dependencies
58+
# correctly.
59+
#
60+
# To populate the input sources:
61+
# 1. Build the unsigned packages as normal
62+
# 2. Sign the desired binary
63+
# 3. Place the unsigned package and signed binary in this spec's folder
64+
# 4. Build this spec
65+
Source0: kernel-mshv-%{version}-%{release}.%{buildarch}.rpm
66+
Source1: vmlinuz-%{uname_r}
67+
BuildRequires: cpio
68+
BuildRequires: openssl
69+
BuildRequires: sed
70+
71+
%description
72+
This package contains the MSHV-enabled Linux kernel package with kernel-mshv signed with the production key
73+
74+
%package -n kernel-mshv
75+
Summary: MSHV-enabled Linux Kernel
76+
Group: System Environment/Kernel
77+
Requires: filesystem
78+
Requires: kmod
79+
Requires(post): coreutils
80+
Requires(postun): coreutils
81+
%{?grub2_configuration_requires}
82+
ExclusiveArch: x86_64
83+
84+
%description -n kernel-mshv
85+
The kernel package contains the signed MSHV-enabled Linux kernel.
86+
87+
%prep
88+
89+
%build
90+
mkdir rpm_contents
91+
pushd rpm_contents
92+
93+
# This spec's whole purpose is to inject the signed kernel binary
94+
rpm2cpio %{SOURCE0} | cpio -idmv
95+
cp %{SOURCE1} ./boot/vmlinuz-%{uname_r}
96+
97+
popd
98+
99+
%install
100+
pushd rpm_contents
101+
102+
# Don't use * wildcard. It does not copy over hidden files in the root folder...
103+
cp -rp ./. %{buildroot}/
104+
105+
popd
106+
107+
%triggerin -n kernel-mshv -- initramfs
108+
mkdir -p %{_localstatedir}/lib/rpm-state/initramfs/pending
109+
touch %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
110+
echo "initrd generation of kernel %{uname_r} will be triggered later" >&2
111+
112+
%triggerun -n kernel-mshv -- initramfs
113+
rm -rf %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
114+
rm -rf /boot/efi/initrd.img-%{uname_r}
115+
echo "initrd of kernel %{uname_r} removed" >&2
116+
117+
%postun -n kernel-mshv
118+
%grub2_postun
119+
120+
%post -n kernel-mshv
121+
/sbin/depmod -a %{uname_r}
122+
%grub2_post
123+
124+
%files -n kernel-mshv
125+
%defattr(-,root,root)
126+
%license COPYING
127+
%exclude %dir /usr/lib/debug
128+
/boot/System.map-%{uname_r}
129+
/boot/config-%{uname_r}
130+
/boot/vmlinuz-%{uname_r}
131+
/boot/efi/vmlinuz-%{uname_r}
132+
%config(noreplace) %{_sysconfdir}/default/grub.d/50_mariner_mshv.cfg
133+
%config %{_sysconfdir}/grub.d/50_mariner_mshv_menuentry
134+
%defattr(0644,root,root)
135+
/lib/modules/%{uname_r}/*
136+
%exclude /lib/modules/%{uname_r}/build
137+
138+
%changelog
139+
* Fri Jan 24 2025 Cameron Baird <cameronbaird@microsoft.com> - 5.15.157.mshv1-3
140+
- Original version for Azure Linux.
141+
- license: MIT
142+
- License verified

0 commit comments

Comments
 (0)