ACK: [PATCH] securebootcert: report info instead of failure for missing DB and KEK when secureboot disabled (LP: #1374351 )

[Colin Ian King]

On 29/09/14 06:33, Ivan Hu wrote:
> When secureboot enabled, it's obverious that something wrong with missing DB and
> KEK variables, failures will be report. When the secureboot disabled and missing
> DB and KEK variables, report the information that the machine is not in
> readiness for secureboot.
> 
> Signed-off-by: Ivan Hu <ivan.hu at canonical.com>
> ---
>  src/uefi/securebootcert/securebootcert.c |   22 ++++++++++++++++------
>  1 file changed, 16 insertions(+), 6 deletions(-)
> 
> diff --git a/src/uefi/securebootcert/securebootcert.c b/src/uefi/securebootcert/securebootcert.c
> index 53d9e13..4fd6cef 100644
> --- a/src/uefi/securebootcert/securebootcert.c
> +++ b/src/uefi/securebootcert/securebootcert.c
> @@ -62,6 +62,7 @@ typedef struct _EFI_SIGNATURE_LIST {
>  }
>  
>  static uint8_t var_found;
> +static bool securebooted = false;
>  
>  static bool compare_guid(EFI_GUID *guid1, uint8_t *guid2)
>  {
> @@ -118,6 +119,8 @@ static void securebootcert_secure_boot(fwts_framework *fw, fwts_uefi_var *var, c
>  				"The secure boot variable data invalid.");
>  			return;
>  		}
> +		if (value == 1)
> +			securebooted = true;
>  		fwts_log_info_verbatum(fw, "  Value: 0x%2.2x%s.", value, mode);
>  		fwts_passed(fw, "Secure boot relative variable %s check passed.", varname);
>  	}
> @@ -359,12 +362,19 @@ static int securebootcert_test1(fwts_framework *fw)
>  	if (!(var_found & VAR_SETUPMODE_FOUND))
>  		fwts_failed(fw, LOG_LEVEL_HIGH, "SecureBootCertVariableNotFound",
>  			"The secure boot variable SetupMode not found.");
> -	if (!(var_found & VAR_DB_FOUND))
> -		fwts_failed(fw, LOG_LEVEL_HIGH, "SecureBootCertVariableNotFound",
> -			"The secure boot variable DB not found.");
> -	if (!(var_found & VAR_KEK_FOUND))
> -		fwts_failed(fw, LOG_LEVEL_HIGH, "SecureBootCertVariableNotFound",
> -			"The secure boot variable KEK not found.");
> +	if (securebooted) {
> +		if (!(var_found & VAR_DB_FOUND))
> +			fwts_failed(fw, LOG_LEVEL_HIGH, "SecureBootCertVariableNotFound",
> +				"The secure boot variable DB not found.");
> +		if (!(var_found & VAR_KEK_FOUND))
> +			fwts_failed(fw, LOG_LEVEL_HIGH, "SecureBootCertVariableNotFound",
> +				"The secure boot variable KEK not found.");
> +	} else {
> +		if (!(var_found & VAR_DB_FOUND))
> +			fwts_log_info(fw, "Not in readiness for secureboot, variable DB not found.");		
> +		if (!(var_found & VAR_KEK_FOUND))
> +			fwts_log_info(fw, "Not in readiness for secureboot, variable KEK not found.");
> +	}
>  
>  	fwts_uefi_free_variable_names(&name_list);
>  
> 
Thanks Ivan

Acked-by: Colin Ian King <colin.king at canonical.com>