Open vasudevluthra opened 4 months ago
I'm not an official reviewer, but I just want to help reduce the work load of official reviewers.
RUN git clone -b "15.8" https://github.com/rhboot/shim.git /shim-build
7d8bce770e56b615ba2b7021f56611fdb50948ebac4693fb0952e89d3c9e0258 shimx64.efi
Subject: O = Cisco, OU = Perseus, CN = Virtual UEFI SubCA V3
Issuer: OU = Pavo, O = Cisco, CN = Virtual UEFI Root CA V2
shim sbat section is appropriate.
objcopy -j .sbat -O binary shimx64.efi /dev/stdout
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.cisco,1,Cisco,shim,15.8,psirt@cisco.com
NX bit disabled
objdump -p shimx64.efi | grep DllCharacteristics
DllCharacteristics 00000000
Hello reviewers @steve-mcintyre @aronowski, it would be really helpful if you could kindly review our submission for the shim review. Our last two shim review submission #354 and #126 got closed before being approved and we have been trying to get the shim review completed for a while. A lot of teams at Cisco are dependent on this shim and we would really appreciate if you could kindly review our submission.
On 2024.05.15 12:18:44, vasudevluthra wrote:
Hello reviewers @steve-mcintyre @aronowski, it would be really helpful if you could kindly review our submission for the shim review.
Yes, but we do have limited resources ourselves. It would also be really helpful if we got some help in this matter as well. There are some applications, where it would come in handy for people to do some community work and help us review these.
Our last two shim review submission #354 and #126 got closed before being approved and we have been trying to get the shim review completed for a while.
I know that feeling. I myself have been trying for about 2 years.
A lot of teams at Cisco are dependent on this shim and we would really appreciate if you could kindly review our submission.
Should I help and write an application to convince the managers, that investing a certain amount of the current budget will help in the long term?
-- Reply to this email directly or view it on GitHub: https://github.com/rhboot/shim-review/issues/411#issuecomment-2113294795 You are receiving this because you were mentioned.
Message ID: @.***>
cisco-shim-x86_64-20240415
7d8bce770e56b615ba2b7021f56611fdb50948ebac4693fb0952e89d3c9e0258 shimx64.efi
- I assume that your CA is not used currently. We currently have no strict policies for CAs, but with RSA 2048 bit keys maybe limit the validity to 2030 for new CAs. @steve-mcintyre any opinions here?
There's still a worry about using keys larger than 2048 bits of RSA; older firmware versions on older machines may not work. We're hoping to get some testing done to give us better data here. For now, we have to allow 2048-bit RSA.
Hello reviewers @THS-on and @steve-mcintyre, thank you for reviewing our submission. Based on your comments, we have made changes to the Dockerfile to use the release tarball instead of the git branch. The updated tag is https://github.com/cisco/sto-uefi-secure-bootloader/releases/tag/cisco-shim-x86_64-20240613 , I have also updated the tag in the checklist for this issue.
In addition, to address your questions,
@aronowski We have started some conversations internally with the goal to be more involved in contributing to the shim community.
Hi @vasudevluthra thank you for the updates and answering the questions. Because you don't use ephemeral key signing for the Linux kernel can provide an answer to from above:
- How do you make sure that older kernel modules cannot be loaded on newer kernels?
Hi @THS-on thank you for your comment. We use our own embedded cert in the kernel to verify our signatures. The kernel can be delivered with new embedded keys as needed that do not allow loading older modules.
@vasudevluthra thanks for the clarification. Ideally you would switch the cert every time, but I think its fine for now. @steve-mcintyre what do you think?
Note I am not an official reviewer, this is an ‘extra’ review
cisco-shim-x86_64-20240613
sha256sum install/shimx64.efi
7d8bce770e56b615ba2b7021f56611fdb50948ebac4693fb0952e89d3c9e0258 install/shimx64.efi
@vasudevluthra just one question, what do you mean by We use upstreams distros for grub since we are not rebuilding it.
I assume you still building it to sign the grub with your own keys, or are you loading upstream keys?
Can you rub objcopy on the efi and paste here the SBAT entries from your grub*.efi?
Hi @SherifNagy, thank you for your review. We only rebuild the kernels with additional hardening, which requires us to sign with our own key. We do resign GRUB with the same key but we have no need to rebuild GRUB.
This is the SBAT entry for the grub:
Checking the existing reviews, I think this looks good. Accepted!
Thanks a lot for the review and acceptance @steve-mcintyre! We really appreciate it.
Confirm the following are included in your repo, checking each box:
What is the link to your tag in a repo cloned from rhboot/shim-review?
https://github.com/cisco/sto-uefi-secure-bootloader/releases/tag/cisco-shim-x86_64-20240415
Updated tag after modifying Dockerfile to use release tarball instead of git branch
https://github.com/cisco/sto-uefi-secure-bootloader/releases/tag/cisco-shim-x86_64-20240613
What is the SHA256 hash of your final SHIM binary?
SHA2-256(shimx64.efi)= 7d8bce770e56b615ba2b7021f56611fdb50948ebac4693fb0952e89d3c9e0258
What is the link to your previous shim review request (if any, otherwise N/A)?
https://github.com/rhboot/shim-review/issues/354
https://github.com/rhboot/shim-review/issues/126
https://github.com/rhboot/shim-review/issues/37 (accepted)
If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?
https://github.com/rhboot/shim-review/issues/354#issuecomment-1883345036