firmware_uefi: emit telemetry for secureboot compliance#3966
Open
maheeraeron wants to merge 7 commits into
Open
firmware_uefi: emit telemetry for secureboot compliance#3966maheeraeron wants to merge 7 commits into
maheeraeron wants to merge 7 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds secure-boot compliance telemetry by comparing loaded NVRAM Secure Boot variables (PK/KEK/db/dbx) against a “base template” signature set, plumbing the base-template variables through the UEFI config path and triggering a post-injection callback to emit telemetry.
Changes:
- Add
base_secure_boot_template_varsalongsidecustom_uefi_varsacross OpenVMM config/manifest plumbing so the UEFI device can evaluate “base template presence”. - Add an
NvramStorage::after_custom_vars_injected()hook and call it on first boot after custom vars injection (when secure boot is enabled). - Implement signature-list parsing and telemetry emission in
hcl_compat_uefi_nvram_storage, plus unit tests and new deps.
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| vmm_core/vm_manifest_builder/src/lib.rs | Adds base_secure_boot_template_vars to UefiManifest::new and stores it in UefiConfig. |
| vm/devices/firmware/uefi_nvram_storage/src/lib.rs | Extends NvramStorage with after_custom_vars_injected() and forwards through trait objects. |
| vm/devices/firmware/hcl_compat_uefi_nvram_storage/src/lib.rs | Adds base-template tracking, signature parsing, and telemetry reporting for secure boot vars. |
| vm/devices/firmware/hcl_compat_uefi_nvram_storage/Cargo.toml | Adds uefi_nvram_specvars and uefi_specs dependencies. |
| vm/devices/firmware/firmware_uefi/src/service/nvram/spec_services/mod.rs | Exposes after_custom_vars_injected() passthrough on spec services. |
| vm/devices/firmware/firmware_uefi/src/service/nvram/mod.rs | Calls the new hook after injecting custom vars on first boot (secure boot enabled). |
| vm/devices/firmware/firmware_uefi/src/resolver.rs | Builds BaseSecureBootTemplateVariables from template vars and attaches them to the NVRAM backend. |
| vm/devices/firmware/firmware_uefi_resources/src/lib.rs | Adds base_secure_boot_template_vars field to UefiConfig (Protobuf). |
| petri/src/vm/openvmm/construct.rs | Plumbs base template vars separately from the final custom vars in Petri VM construction. |
| openvmm/openvmm_entry/src/ttrpc/mod.rs | Initializes new config field to default in the ttrpc path. |
| openvmm/openvmm_entry/src/lib.rs | Splits base-template vars from final custom vars and passes both into manifest/config. |
| openvmm/openvmm_defs/src/config.rs | Adds base_secure_boot_template_vars to the worker Config (MeshPayload). |
| openvmm/openvmm_core/src/worker/dispatch.rs | Plumbs new config field into internal Manifest (MeshPayload) and defaults in TODO path. |
| openhcl/underhill_core/src/worker.rs | Adds base_secure_boot_template_vars into firmware_uefi_resources::UefiConfig construction. |
| Cargo.lock | Records new dependency usage in the lockfile. |
Comment on lines
+56
to
+60
| const WIN_CERT_REVISION_2_0: u16 = 0x0200; | ||
|
|
||
| type SignatureSet = BTreeSet<(EFI_SIGNATURE_DATA, Vec<u8>)>; | ||
|
|
||
| /// Base Secure Boot template variable contents expected to be present in loaded NVRAM. |
Comment on lines
+384
to
+385
| let base_template_bytes = base_template_variable.len(); | ||
| let base_template_signatures = match collect_signature_set(base_template_variable) { |
Comment on lines
+120
to
+121
| /// Called after custom UEFI variables are injected on first boot. | ||
| fn after_custom_vars_injected(&self) {} |
Comment on lines
+245
to
+248
| /// Called after custom UEFI variables are injected on first boot. | ||
| pub fn after_custom_vars_injected(&self) { | ||
| self.storage.after_custom_vars_injected() | ||
| } |
Comment on lines
+684
to
+690
| let cert_len = auth.auth_info.header.length as usize; | ||
| if cert_len < size_of::<WIN_CERTIFICATE_UEFI_GUID>() { | ||
| return data; | ||
| } | ||
|
|
||
| let auth_len = size_of_val(&auth.timestamp) + cert_len; | ||
| data.get(auth_len..).unwrap_or(data) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per AzSec ask, emit telemetry evaluating whether a secure boot variable in NVRAM contains the base secure boot template signatures.