backport: secureboot support #14246

sacnaik · 2023-03-15T05:09:50Z

Backporting PR#12692 to the 202205 branch.

The diffs of PR#12692 do not cleanly get applied to the 202205 branch. Hence patch #12692 was slightly modified for the 202205 branch.

Why I did it

To support UEFI secure boot on the 202205 branch

How I did it

The feature is supported at the master branch see #12692.
Backported #12692 from master to 202205 branch

How to verify it

Booted on UEFI secure boot-enabled hardware.

Which release branch to backport (provide reason below if selected)

Description for the changelog

Refer HLD: sonic-net/SONiC#1028

Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Backporting sonic-net#12692 PR on 202205 branch. The diffs of sonic-net#12692 does not cleanly gets apply. on 202205 branch. Hence the patch sonic-net#12692 slightly modified so that it can get applied on 202205 branch without functional break. Signed-off-by: Sachin Naik <sachnaik@cisco.com>

linux-foundation-easycla · 2023-03-15T05:09:53Z

The committers listed above are authorized under a signed CLA.

✅ login: sacnaik / name: Sachin Naik (5574593, f7ce9f2)

rlhui · 2023-03-15T16:13:37Z

@davidpil2002 , would you please review this one for 202205? thanks

installer/x86_64/install.sh

davidpil2002 · 2023-03-27T12:09:25Z

@sacnaik In general look good to me.
I beleive you didnt manage to cherry pick beause there is some modification in the instaltion structucre.
few comments:
1.take in consideration that theoretical my PR should support ARM (still not fully tested)
And your PR not, because the structure its different, in your installation modification only in X64 directory.
2. you forget to rm this file scripts/signing_secure_boot_prod.sh
3.
Pls also add the fix about mokutil that I pushed lastly to support device with old ONIE versions

The older ONIE version does not support mokutil command. This backport changes will address the issue.

sacnaik · 2023-04-05T18:24:02Z

@davidpil2002

ARM support is not needed at this time on 202205 branches and once you fully test I can cherry-pick that or move to newer branch
scripts/signing_secure_boot_prod.sh - I removed it
Added Secure boot fix instalation with devices that used ONIE version older than 2021.11 #14429 to the changes

davidpil2002 · 2023-04-09T07:42:24Z

looks good to me,
there is a small PR that will be publish soon with some additional small fixes, I think the best it's to merge this PR with the fixes by the day 1.
I approved this PR, but pls add the PR with the fixes.
@DavidZagury pls can you write in the comment the PR with your fixes so all the branches will be aligned?

davidpil2002 · 2023-04-10T13:59:57Z

@davidpil2002

ARM support is not needed at this time on 202205 branches and once you fully test I can cherry-pick that or move to newer branch

scripts/signing_secure_boot_prod.sh - I removed it

Added Secure boot fix instalation with devices that used ONIE version older than 2021.11 #14429 to the changes

hi @sacnaik ,
sorry for the inconvinence, but we decided to remove the mokutil dependency by using efivar tool.
any chances you can cherry pick this new fix, instead the previous one.
new fix:
#14589

You are welcome to review it as well

sacnaik · 2023-04-18T19:57:48Z

Backported #14589 as well

yxieca

This change is not an approved feature for 202205 branch. Please request back porting to 202211 branch instead.

#14589) …1.11 by using efivar tool instead #### Why I did it solution to BUG below/ #14316 bug report also in this issue: backport: secureboot support #14246 #### How I did it When installing an image secure boot is checking if the UEFI have the secure boot flag enabled or disabled using a tool name `mokutil` this tool its not exist in ONIE version older than 2021.11 so its crasshing the install. To fix that we add a coded that checking secure boot enabled/disabled by using efivar tool that should exist in any UEFI system #### How to verify it Install the image in a device with ONIE version older than 2021.11 and check that the installation and boot succeed (all docker up).

abdosi · 2023-07-12T17:33:24Z

Already Backport msft repo 202205 branch.

sonic-net#14589) …1.11 by using efivar tool instead #### Why I did it solution to BUG below/ sonic-net#14316 bug report also in this issue: backport: secureboot support sonic-net#14246 #### How I did it When installing an image secure boot is checking if the UEFI have the secure boot flag enabled or disabled using a tool name `mokutil` this tool its not exist in ONIE version older than 2021.11 so its crasshing the install. To fix that we add a coded that checking secure boot enabled/disabled by using efivar tool that should exist in any UEFI system #### How to verify it Install the image in a device with ONIE version older than 2021.11 and check that the installation and boot succeed (all docker up).

gechiang · 2023-09-30T21:45:20Z

Added the label "Icluded in Chassis for 202205 branch" label to keep the consistency where this PR was already backported by Abhishek separately even though this PR got closed.

sacnaik requested review from qiluo-msft, xumia and lguohan as code owners March 15, 2023 05:09

ITJamie reviewed Mar 18, 2023

View reviewed changes

installer/x86_64/install.sh Outdated Show resolved Hide resolved

Fix on assigning production tool variable

f7ce9f2

davidpil2002 mentioned this pull request Mar 27, 2023

Secure boot fix instalation with devices that used ONIE version older than 2021.11 #14429

Closed

7 tasks

sacnaik added 2 commits April 5, 2023 11:17

Backport: sonic-net#14429 to support older ONIE versio

bc05bd5

The older ONIE version does not support mokutil command. This backport changes will address the issue.

Delete signing_secure_boot_prod.sh

d9240b0

davidpil2002 approved these changes Apr 9, 2023

View reviewed changes

davidpil2002 mentioned this pull request Apr 10, 2023

[secure boot]Fix mokutil check issue with ONIE version older than 202… #14589

Merged

7 tasks

backport sonic-net#14589

bd641d6

yxieca requested changes May 4, 2023

View reviewed changes

rlhui added the Chassis for 202205 branch PRs needed for 202205 branch in msft repo label May 5, 2023

rlhui assigned sacnaik May 5, 2023

abdosi mentioned this pull request May 10, 2023

Sachnaik/secureboot sonic-net/sonic-buildimage-msft#19

Merged

5 tasks

abdosi closed this Jul 12, 2023

gechiang added the Included in Chassis for 202205 Branch Indicate PR is already in MSFT repo 202205 branch label Sep 30, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

backport: secureboot support #14246

backport: secureboot support #14246

sacnaik commented Mar 15, 2023 •

edited

Loading

linux-foundation-easycla bot commented Mar 15, 2023 •

edited

Loading

rlhui commented Mar 15, 2023

davidpil2002 commented Mar 27, 2023 •

edited

Loading

sacnaik commented Apr 5, 2023

davidpil2002 commented Apr 9, 2023 •

edited

Loading

davidpil2002 commented Apr 10, 2023 •

edited

Loading

sacnaik commented Apr 18, 2023

yxieca left a comment

abdosi commented Jul 12, 2023

gechiang commented Sep 30, 2023

backport: secureboot support #14246

backport: secureboot support #14246

Conversation

sacnaik commented Mar 15, 2023 • edited Loading

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

linux-foundation-easycla bot commented Mar 15, 2023 • edited Loading

rlhui commented Mar 15, 2023

davidpil2002 commented Mar 27, 2023 • edited Loading

sacnaik commented Apr 5, 2023

davidpil2002 commented Apr 9, 2023 • edited Loading

davidpil2002 commented Apr 10, 2023 • edited Loading

sacnaik commented Apr 18, 2023

yxieca left a comment

Choose a reason for hiding this comment

abdosi commented Jul 12, 2023

gechiang commented Sep 30, 2023

sacnaik commented Mar 15, 2023 •

edited

Loading

linux-foundation-easycla bot commented Mar 15, 2023 •

edited

Loading

davidpil2002 commented Mar 27, 2023 •

edited

Loading

davidpil2002 commented Apr 9, 2023 •

edited

Loading

davidpil2002 commented Apr 10, 2023 •

edited

Loading