SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: Add instructions for Microsoft secure boot keys

Browse Source 
Adding Microsoft keys by default is recommended because firmware drivers
might be signed by it.

This also changes the file ending from .esl to .auth as that is used by
sign-efi-sig-list manpage and other sources.
This commit is contained in:
Jan Janssen
2022-08-04 10:03:48 +02:00
parent f234a56db5
commit adb9485acb
3 changed files with 28 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/boot/efi/secure-boot.c
+3 -3
View File
@@ -81,9 +81,9 @@ EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path) {
char *buffer;
size_t size;
} sb_vars[] = {
{ u"db", u"db.esl", EFI_IMAGE_SECURITY_DATABASE_VARIABLE, NULL, 0 },
{ u"KEK", u"KEK.esl", EFI_GLOBAL_VARIABLE, NULL, 0 },
{ u"PK", u"PK.esl", EFI_GLOBAL_VARIABLE, NULL, 0 },
{ u"db", u"db.auth", EFI_IMAGE_SECURITY_DATABASE_VARIABLE, NULL, 0 },
{ u"KEK", u"KEK.auth", EFI_GLOBAL_VARIABLE, NULL, 0 },
{ u"PK", u"PK.auth", EFI_GLOBAL_VARIABLE, NULL, 0 },
};
/* Make sure all keys files exist before we start enrolling them by loading them from the disk first. */