[PATCH 2/2] uefi: check the kernel lockdown for uefi tests
Colin Ian King
colin.king at canonical.com
Fri Mar 20 10:53:28 UTC 2020
On 20/03/2020 09:00, Ivan Hu wrote:
> Check the kernel lockdown status and give warnings for those which
> test uefi runtime services via kernel efi_test driver.
>
> Signed-off-by: Ivan Hu <ivan.hu at canonical.com>
> ---
> src/uefi/securebootcert/securebootcert.c | 8 ++++++++
> src/uefi/uefirtauthvar/uefirtauthvar.c | 8 ++++++++
> src/uefi/uefirtmisc/uefirtmisc.c | 8 ++++++++
> src/uefi/uefirttime/uefirttime.c | 8 ++++++++
> src/uefi/uefirtvariable/uefirtvariable.c | 8 ++++++++
> src/uefi/uefivarinfo/uefivarinfo.c | 8 ++++++++
> 6 files changed, 48 insertions(+)
>
> diff --git a/src/uefi/securebootcert/securebootcert.c b/src/uefi/securebootcert/securebootcert.c
> index 93efe894..852b2316 100644
> --- a/src/uefi/securebootcert/securebootcert.c
> +++ b/src/uefi/securebootcert/securebootcert.c
> @@ -427,6 +427,14 @@ static int securebootcert_init(fwts_framework *fw)
> return FWTS_ABORTED;
> }
>
> + if (fwts_lib_efi_runtime_kernel_lockdown()) {
> + fwts_log_info(fw, "Kernel is lockdown. Aborted.");
Maybe this could be re-phrases, e.g. "Kernel is in lockdown mode.
Aborted.");
> + fwts_log_info(fw, "Please unlock the kernel before you test the UEFI tests.");
> + fwts_log_info(fw, "Make sure you disable secureboot and disable "
> + "the kernel lockdown, (by kernel parameter lockdown=None).");
> + return FWTS_ABORTED;
> + }
This lockdown message is being repeated a lot of times, so I'd prefer it
if a helper function was written to print this message rather than
cut-n-paste it many times.
> +
> if (fwts_lib_efi_runtime_load_module(fw) != FWTS_OK) {
> fwts_log_info(fw, "Cannot load efi_runtime module. Aborted.");
> return FWTS_ABORTED;
> diff --git a/src/uefi/uefirtauthvar/uefirtauthvar.c b/src/uefi/uefirtauthvar/uefirtauthvar.c
> index 4b1ebe08..eef4a61a 100644
> --- a/src/uefi/uefirtauthvar/uefirtauthvar.c
> +++ b/src/uefi/uefirtauthvar/uefirtauthvar.c
> @@ -120,6 +120,14 @@ static int uefirtauthvar_init(fwts_framework *fw)
> return FWTS_ABORTED;
> }
>
> + if (fwts_lib_efi_runtime_kernel_lockdown()) {
> + fwts_log_info(fw, "Kernel is lockdown. Aborted.");
> + fwts_log_info(fw, "Please unlock the kernel before you test the UEFI tests.");
> + fwts_log_info(fw, "Make sure you disable secureboot and disable "
> + "the kernel lockdown, (by kernel parameter lockdown=None).");
> + return FWTS_ABORTED;
> + }
> +
> if (fwts_lib_efi_runtime_load_module(fw) != FWTS_OK) {
> fwts_log_info(fw, "Cannot load efi_runtime module. Aborted.");
> return FWTS_ABORTED;
> diff --git a/src/uefi/uefirtmisc/uefirtmisc.c b/src/uefi/uefirtmisc/uefirtmisc.c
> index 5031bc48..11cbf9bf 100644
> --- a/src/uefi/uefirtmisc/uefirtmisc.c
> +++ b/src/uefi/uefirtmisc/uefirtmisc.c
> @@ -50,6 +50,14 @@ static int uefirtmisc_init(fwts_framework *fw)
> return FWTS_ABORTED;
> }
>
> + if (fwts_lib_efi_runtime_kernel_lockdown()) {
> + fwts_log_info(fw, "Kernel is lockdown. Aborted.");
> + fwts_log_info(fw, "Please unlock the kernel before you test the UEFI tests.");
> + fwts_log_info(fw, "Make sure you disable secureboot and disable "
> + "the kernel lockdown, (by kernel parameter lockdown=None).");
> + return FWTS_ABORTED;
> + }
> +
> if (fwts_lib_efi_runtime_load_module(fw) != FWTS_OK) {
> fwts_log_info(fw, "Cannot load efi_runtime module. Aborted.");
> return FWTS_ABORTED;
> diff --git a/src/uefi/uefirttime/uefirttime.c b/src/uefi/uefirttime/uefirttime.c
> index e316c0ab..ce27ded3 100644
> --- a/src/uefi/uefirttime/uefirttime.c
> +++ b/src/uefi/uefirttime/uefirttime.c
> @@ -174,6 +174,14 @@ static int uefirttime_init(fwts_framework *fw)
> return FWTS_ABORTED;
> }
>
> + if (fwts_lib_efi_runtime_kernel_lockdown()) {
> + fwts_log_info(fw, "Kernel is lockdown. Aborted.");
> + fwts_log_info(fw, "Please unlock the kernel before you test the UEFI tests.");
> + fwts_log_info(fw, "Make sure you disable secureboot and disable "
> + "the kernel lockdown, (by kernel parameter lockdown=None).");
> + return FWTS_ABORTED;
> + }
> +
> if (fwts_lib_efi_runtime_load_module(fw) != FWTS_OK) {
> fwts_log_info(fw, "Cannot load efi_runtime module. Aborted.");
> return FWTS_ABORTED;
> diff --git a/src/uefi/uefirtvariable/uefirtvariable.c b/src/uefi/uefirtvariable/uefirtvariable.c
> index fbb877a6..0f37b174 100644
> --- a/src/uefi/uefirtvariable/uefirtvariable.c
> +++ b/src/uefi/uefirtvariable/uefirtvariable.c
> @@ -100,6 +100,14 @@ static int uefirtvariable_init(fwts_framework *fw)
> return FWTS_ABORTED;
> }
>
> + if (fwts_lib_efi_runtime_kernel_lockdown()) {
> + fwts_log_info(fw, "Kernel is lockdown. Aborted.");
> + fwts_log_info(fw, "Please unlock the kernel before you test the UEFI tests.");
> + fwts_log_info(fw, "Make sure you disable secureboot and disable "
> + "the kernel lockdown, (by kernel parameter lockdown=None).");
> + return FWTS_ABORTED;
> + }
> +
> if (fwts_lib_efi_runtime_load_module(fw) != FWTS_OK) {
> fwts_log_info(fw, "Cannot load efi_runtime module. Aborted.");
> return FWTS_ABORTED;
> diff --git a/src/uefi/uefivarinfo/uefivarinfo.c b/src/uefi/uefivarinfo/uefivarinfo.c
> index 79672b8e..9f7eb61d 100644
> --- a/src/uefi/uefivarinfo/uefivarinfo.c
> +++ b/src/uefi/uefivarinfo/uefivarinfo.c
> @@ -41,6 +41,14 @@ static int uefivarinfo_init(fwts_framework *fw)
> return FWTS_ABORTED;
> }
>
> + if (fwts_lib_efi_runtime_kernel_lockdown()) {
> + fwts_log_info(fw, "Kernel is lockdown. Aborted.");
> + fwts_log_info(fw, "Please unlock the kernel before you test the UEFI tests.");
> + fwts_log_info(fw, "Make sure you disable secureboot and disable "
> + "the kernel lockdown, (by kernel parameter lockdown=None).");
> + return FWTS_ABORTED;
> + }
> +
> if (fwts_lib_efi_runtime_load_module(fw) != FWTS_OK) {
> fwts_log_info(fw, "Cannot load efi_runtime module. Aborted.");
> return FWTS_ABORTED;
>
More information about the fwts-devel
mailing list