T861: op-mode: initial parts for UEFI secure boot CLI #4020
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
👍 |
|
✅ No issues found in unused-imports check.. Please refer the workflow run |
c-po
requested review from
dmbaturin,
sarthurdev,
zdc,
jestabro,
sever-sever and
fett0
sever-sever
approved these changes
Sep 4, 2024
c-po
force-pushed
the
secure-boot
branch
2 times, most recently
from
a6f5501 to
a884836
Compare
11 tasks
dmbaturin
approved these changes
Sep 15, 2024
sarthurdev
requested changes
Sep 15, 2024
vyos@vyos:~$ show ver ... Architecture: x86_64 Boot via: installed image System type: KVM guest Secure Boot: enabled ...
Support getting current system secure boot state. In addition add optional suppor tto list all enrolled MOK (Machine Owner Keys) in the UEFI variable store.
Deploy VyOS Secure Boot CA MOK (Machine Owner Key) into UEFI variables of the running machine.
sarthurdev
approved these changes
Sep 16, 2024
fatpelt
reviewed
Oct 7, 2024
| from vyos.utils.boot import is_uefi_system | ||
| if not is_uefi_system(): | ||
| return False | ||
| tmp = cmd('mokutil --sb-state') |
There was a problem hiding this comment.
This line throws an exception for devices that do not support secure-boot. should this be wrapped in a try?
# show ver
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/version.py", line 91, in <module>
res = vyos.opmode.run(sys.modules[__name__])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/vyos/opmode.py", line 271, in run
res = func(**args)
^^^^^^^^^^^^
File "/usr/libexec/vyos/op_mode/version.py", line 81, in show
version_data = _get_raw_data(funny=funny)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/libexec/vyos/op_mode/version.py", line 67, in _get_raw_data
if get_secure_boot_state():
^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/vyos/utils/system.py", line 148, in get_secure_boot_state
tmp = cmd('mokutil --sb-state')
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/vyos/utils/process.py", line 155, in cmd
raise OSError(code, feedback)
OSError: [Errno 255] failed to run command: mokutil --sb-state
returned:
exit code: 255
# mokutil --sb-state
This system doesn't support Secure Boot
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change Summary
Add
show secure-boot [keys]CLI command together withinstall mokCLI command.Current SB state is displayed too via
show verTypes of changes
Related Task(s)
Related PR(s)
Component(s) name
Secure Boot / UEFI
Proposed changes
Checklist: