Add Secure Boot Support #12692

davidpil2002 · 2022-11-13T12:58:40Z

Why I did it

Add Secure Boot support to SONiC OS.
Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process before the operating system has been loaded.

How I did it

Added a signing process to sign the following components:
shim, grub, Linux kernel, and kernel modules when doing the build, and when feature is enabled in build time according to the HLD explanations (the feature is disabled by default).

How to verify it

There are self-verifications of each boot component when building the image, in addition, there is an existing end-to-end test in sonic-mgmt repo that checks that the boot succeeds when loading a secure system (details below).

How to build a sonic image with secure boot feature: (more description in HLD)

Required to use the following build flags from rules/config:

SECURE_UPGRADE_MODE="dev"
SECURE_UPGRADE_DEV_SIGNING_KEY="/path/to/private/key.pem"
SECURE_UPGRADE_DEV_SIGNING_CERT="/path/to/cert/key.pem"
After setting those flags should build the sonic-buildimage.

Before installing the image, should prepared the setup (switch device) with the follow:

check that the device support UEFI
stored pub keys in UEFI DB
enabled Secure Boot flag in UEFI

How to run a test that verify the Secure Boot flow:
The existing test "test_upgrade_path" under "sonic-mgmt/tests/upgrade_path/test_upgrade_path", is enough to validate proper boot
You need to specify the following arguments:
Base_image_list your_secure_image
Taget_image_list your_second_secure_image
Upgrade_type cold
And run the test, basically the test will install the base image given in the parameter and then upgrade to target image by doing cold reboot and validates all the services are up and working correctly

note: the path to the existing sonic-mgmt test can be found in the link in the HLD description.

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

No REDIS DB used in this feature

HLD link: sonic-net/SONiC#1028

A picture of a cute animal (not mandatory but encouraged)

davidpil2002 · 2022-11-14T06:39:20Z

hi @lguohan,

Apparently, there is some test issue when connecting to the host, the attached error is below.
For now, I didn't find something related to this specific commit, can you help with this issue?

details from log:
link: https://www.testbed-tools.org/scheduler/testplan/7215
error msg:
E AnsibleConnectionFailure: Host unreachable

@liat-grozovik ++

PS: sent an email to buildimage team
@yxieca FYI

rules/config

lguohan · 2022-11-25T09:14:17Z

how can we test this SB feature? is there a virtual environment that we can test and validate?

liat-grozovik · 2022-11-25T09:20:20Z

If I am not mistaken, we are working on a functional test as it requires specific image built with it Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: Guohan Lu ***@***.***> Sent: Friday, November 25, 2022 11:14:28 AM To: sonic-net/sonic-buildimage ***@***.***> Cc: Liat Grozovik ***@***.***>; Mention ***@***.***> Subject: Re: [sonic-net/sonic-buildimage] Add Secure Boot Support (PR #12692) how can we test this SB feature? is there a virtual environment that we can test and validate? — Reply to this email directly, view it on GitHub<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsonic-net%2Fsonic-buildimage%2Fpull%2F12692%23issuecomment-1327193094&data=05%7C01%7Cliatg%40nvidia.com%7Cdbb7613ed04a401579ff08dacec574ff%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C638049644711564875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2FWBCvkRhnNrzdlTk79YzjLaYbTqeuWsV1xrU1Rt1iOw%3D&reserved=0>, or unsubscribe<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAKTABA2VVOJIISLKLNOCEOTWKB7PJANCNFSM6AAAAAAR7ASVOU&data=05%7C01%7Cliatg%40nvidia.com%7Cdbb7613ed04a401579ff08dacec574ff%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C638049644711564875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=K0qvRI%2FqzoCtVuiRhp1Bj8Aumi09npjSnhn19pkMQ9I%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.***>

scripts/signing_kernel_modules.sh

scripts/signing_secure_boot_dev.sh

installer/default_platform.conf

lguohan · 2022-11-25T09:38:17Z

the design doc says only signing mellanox specific kernel module, wonder why?

lguohan · 2022-11-25T09:41:36Z

the pr needs to provide steps how to build sb-enabled image for other to try it out. otherwise, it would be difficult for community members to check.

davidpil2002 · 2022-11-27T13:26:26Z

how can we test this SB feature? is there a virtual environment that we can test and validate?

with a physical device:

enable the Secure Boot flag in UEFI.
store the public keys in UEFI.
build the sonic-buildimage using the Secure Boot flags according to the HLD explanations.
manually, check that the boot and init flow works.
automation - run the corresponding sonic-mgmt tests. (pointer to sonic-mgmt test should be attached in the HLD description)

In general - a successful secure boot flow is one where you load all kernel modules and nothing fails.

With a virtual machine:

should verify that the VM supports UEFI and supports storing pub keys in the DB and Secure Boot UEFI flag.
In addition - currently the Linux is pulling the public key from the UEFI DB in order to verify the sbsign output for each secure boot component. The VM would have to support this basic Linux flow.
Do steps like a physical device.

davidpil2002 · 2022-11-27T13:38:33Z

the design doc says only signing mellanox specific kernel module, wonder why?

fix the doc to generic vendor:
fsroot-vendor_name instead fsroot-mellanox

davidpil2002 · 2022-11-28T07:16:49Z

the pr needs to provide steps how to build sb-enabled image for other to try it out. otherwise, it would be difficult for community members to check.

The HLD shows all the steps in general, but I added as per your requested more description in this PR.

davidpil2002 · 2022-11-28T08:34:53Z

the pr needs to provide steps how to build sb-enabled image for other to try it out. otherwise, it would be difficult for community members to check.

done

davidpil2002 · 2022-11-28T08:35:18Z

the design doc says only signing mellanox specific kernel module, wonder why?

fixed

davidpil2002

Ack all the comments/concerns & add one commit

davidpil2002

fix all comments, pls approve/review @qiluo-msft @Yarden-Z

abdosi · 2023-03-06T20:09:39Z

/ azp run Azure.sonic-buildimage

abdosi · 2023-03-06T20:10:00Z

@qiluo-msft and @xumia can we review again this please

abdosi · 2023-03-06T20:10:37Z

@sacnaik can you create PR for 202205 for this change ?

davidpil2002 · 2023-03-08T08:06:57Z

@sacnaik can you create PR for 202205 for this change ?

This PR is pending the @qiluo-msft approval, after the approval, we can cherry-pick. is it that OK?

Backporting sonic-net#12692 PR on 202205 branch. The diffs of sonic-net#12692 does not cleanly gets apply. on 202205 branch. Hence the patch sonic-net#12692 slightly modified so that it can get applied on 202205 branch without functional break. Signed-off-by: Sachin Naik <sachnaik@cisco.com>

ITJamie · 2023-03-18T16:20:40Z

Please note the following issue with a build of master: #14316. install failed due to missing mokutil

- Why I did it Add Secure Boot support to SONiC OS. Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process before the operating system has been loaded. - How I did it Added a signing process to sign the following components: shim, grub, Linux kernel, and kernel modules when doing the build, and when feature is enabled in build time according to the HLD explanations (the feature is disabled by default). - How to verify it There are self-verifications of each boot component when building the image, in addition, there is an existing end-to-end test in sonic-mgmt repo that checks that the boot succeeds when loading a secure system (details below). How to build a sonic image with secure boot feature: (more description in HLD) Required to use the following build flags from rules/config: SECURE_UPGRADE_MODE="dev" SECURE_UPGRADE_DEV_SIGNING_KEY="/path/to/private/key.pem" SECURE_UPGRADE_DEV_SIGNING_CERT="/path/to/cert/key.pem" After setting those flags should build the sonic-buildimage. Before installing the image, should prepared the setup (switch device) with the follow: check that the device support UEFI stored pub keys in UEFI DB enabled Secure Boot flag in UEFI How to run a test that verify the Secure Boot flow: The existing test "test_upgrade_path" under "sonic-mgmt/tests/upgrade_path/test_upgrade_path", is enough to validate proper boot You need to specify the following arguments: Base_image_list your_secure_image Taget_image_list your_second_secure_image Upgrade_type cold And run the test, basically the test will install the base image given in the parameter and then upgrade to target image by doing cold reboot and validates all the services are up and working correctly

- Why I did it Add Secure Boot support to SONiC OS. Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process before the operating system has been loaded. - How I did it Added a signing process to sign the following components: shim, grub, Linux kernel, and kernel modules when doing the build, and when feature is enabled in build time according to the HLD explanations (the feature is disabled by default). - How to verify it There are self-verifications of each boot component when building the image, in addition, there is an existing end-to-end test in sonic-mgmt repo that checks that the boot succeeds when loading a secure system (details below). How to build a sonic image with secure boot feature: (more description in HLD) Required to use the following build flags from rules/config: SECURE_UPGRADE_MODE="dev" SECURE_UPGRADE_DEV_SIGNING_KEY="/path/to/private/key.pem" SECURE_UPGRADE_DEV_SIGNING_CERT="/path/to/cert/key.pem" After setting those flags should build the sonic-buildimage. Before installing the image, should prepared the setup (switch device) with the follow: check that the device support UEFI stored pub keys in UEFI DB enabled Secure Boot flag in UEFI How to run a test that verify the Secure Boot flow: The existing test "test_upgrade_path" under "sonic-mgmt/tests/upgrade_path/test_upgrade_path", is enough to validate proper boot You need to specify the following arguments: Base_image_list your_secure_image Taget_image_list your_second_secure_image Upgrade_type cold And run the test, basically the test will install the base image given in the parameter and then upgrade to target image by doing cold reboot and validates all the services are up and working correctly Co-authored-by: davidpil2002 <91657985+davidpil2002@users.noreply.github.com>

Why I did it To support UEFI secure boot on the 202205 branch How I did it The feature is supported at the master branch see sonic-net/sonic-buildimage#12692 Backported sonic-net/sonic-buildimage#12692 from master to msft/202205 branch How to verify it Booted on UEFI secure boot enabled and disabled hardware.

Backporting sonic-net#12692 PR on 202205 branch. The diffs of sonic-net#12692 does not cleanly gets apply. on 202205 branch. Hence the patch sonic-net#12692 slightly modified so that it can get applied on 202205 branch without functional break. Signed-off-by: Sachin Naik <sachnaik@cisco.com>

davidpil2002 requested review from qiluo-msft, xumia and lguohan as code owners November 13, 2022 12:58

davidpil2002 force-pushed the secure_boot_support branch 2 times, most recently from fde1cfa to 5cc164f Compare November 13, 2022 15:18

This was referenced Nov 14, 2022

Add Secure Boot Kernel configuration sonic-net/sonic-linux-kernel#298

Merged

Secure Boot HLD sonic-net/SONiC#1028

Merged

davidpil2002 force-pushed the secure_boot_support branch 2 times, most recently from ebf9861 to 17cf0a5 Compare November 21, 2022 14:22

davidpil2002 requested a review from StormLiangMS as a code owner November 22, 2022 07:27

davidpil2002 force-pushed the secure_boot_support branch 3 times, most recently from 726e5ff to 944ac0a Compare November 22, 2022 09:45

lguohan reviewed Nov 25, 2022

View reviewed changes

rules/config Outdated Show resolved Hide resolved

lguohan reviewed Nov 25, 2022

View reviewed changes

scripts/signing_kernel_modules.sh Show resolved Hide resolved

lguohan reviewed Nov 25, 2022

View reviewed changes

scripts/signing_secure_boot_dev.sh Outdated Show resolved Hide resolved

lguohan reviewed Nov 25, 2022

View reviewed changes

installer/default_platform.conf Outdated Show resolved Hide resolved

davidpil2002 force-pushed the secure_boot_support branch from 767ca97 to b8ac9fc Compare November 28, 2022 14:19

davidpil2002 commented Nov 28, 2022

View reviewed changes

davidpil2002 mentioned this pull request Nov 29, 2022

Add support of secure warm-boot sonic-net/sonic-utilities#2532

Merged

davidpil2002 commented Mar 6, 2023

View reviewed changes

abdosi added the Chassis 🤖 Modular chassis support label Mar 6, 2023

sacnaik mentioned this pull request Mar 6, 2023

SONiC bootloader signing for UEFI secureboot #12901

Closed

7 tasks

qiluo-msft approved these changes Mar 13, 2023

View reviewed changes

liat-grozovik merged commit 8098bc4 into sonic-net:master Mar 14, 2023

sacnaik mentioned this pull request Mar 15, 2023

[202205] Add Secure Boot Kernel configuration sonic-net/sonic-linux-kernel#310

Merged

sacnaik mentioned this pull request Mar 15, 2023

backport: secureboot support #14246

Closed

8 tasks

This was referenced May 1, 2023

[202211] Add Secure Boot Support backport with fixes DavidZagury/sonic-buildimage#37

Closed

[202211] Add Secure Boot Support backport DavidZagury/sonic-buildimage#40

Closed

This was referenced May 5, 2023

[Secure Boot] Add Secure Boot Support (#12692) #14963

Merged

[202211] Add support of secure warm-boot backport sonic-net/sonic-utilities#2819

Merged

sacnaik mentioned this pull request May 6, 2023

Sachnaik/secureboot sonic-net/sonic-buildimage-msft#19

Merged

5 tasks

StormLiangMS added the Included in 202211 Branch label May 15, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Secure Boot Support #12692

Add Secure Boot Support #12692

davidpil2002 commented Nov 13, 2022 •

edited by liat-grozovik

Loading

davidpil2002 commented Nov 14, 2022 •

edited

Loading

lguohan commented Nov 25, 2022

liat-grozovik commented Nov 25, 2022 via email

lguohan commented Nov 25, 2022

lguohan commented Nov 25, 2022

davidpil2002 commented Nov 27, 2022 •

edited

Loading

davidpil2002 commented Nov 27, 2022

davidpil2002 commented Nov 28, 2022

davidpil2002 commented Nov 28, 2022

davidpil2002 commented Nov 28, 2022

davidpil2002 left a comment

davidpil2002 left a comment •

edited

Loading

abdosi commented Mar 6, 2023

abdosi commented Mar 6, 2023

abdosi commented Mar 6, 2023

davidpil2002 commented Mar 8, 2023

ITJamie commented Mar 18, 2023

Add Secure Boot Support #12692

Add Secure Boot Support #12692

Conversation

davidpil2002 commented Nov 13, 2022 • edited by liat-grozovik Loading

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

davidpil2002 commented Nov 14, 2022 • edited Loading

lguohan commented Nov 25, 2022

liat-grozovik commented Nov 25, 2022 via email

lguohan commented Nov 25, 2022

lguohan commented Nov 25, 2022

davidpil2002 commented Nov 27, 2022 • edited Loading

with a physical device:

With a virtual machine:

davidpil2002 commented Nov 27, 2022

davidpil2002 commented Nov 28, 2022

davidpil2002 commented Nov 28, 2022

davidpil2002 commented Nov 28, 2022

davidpil2002 left a comment

Choose a reason for hiding this comment

davidpil2002 left a comment • edited Loading

Choose a reason for hiding this comment

abdosi commented Mar 6, 2023

abdosi commented Mar 6, 2023

abdosi commented Mar 6, 2023

davidpil2002 commented Mar 8, 2023

ITJamie commented Mar 18, 2023

davidpil2002 commented Nov 13, 2022 •

edited by liat-grozovik

Loading

davidpil2002 commented Nov 14, 2022 •

edited

Loading

davidpil2002 commented Nov 27, 2022 •

edited

Loading

davidpil2002 left a comment •

edited

Loading