canonical / canonical/secboot

Don't present ErrorKindAddonDriversPresent for option ROMs loaded from integrated PCI devices.

Open
#516 0 comments 0 reactions 0 assignees View on GitHub
preinstall-checks
Dominant language
Go
Stars
23
Forks
29
Avg merge
2d 8h
Merged PRs (30d)
2

Description

The purpose of this error is to indicate the presence of third party code signed by a secure boot CA that's not explicitly trusted, in this case, the Microsoft UEFI CA. We already ignore `EV_EFI_BOOT_SERVICES_DRIVER` and `EV_EFI_RUNTIME_SERVICES_DRIVER` events from SPI flash, but some systems we tested in the cert lab are triggering this error with option ROMs that don't appear to have a corresponding `EV_EFI_VARIABLE_AUTHORITY` event in PCR7 and therefore weren't authenticated with secure boot. Whilst these systems might need further investigation, it's likely that these option ROMs were loaded from integrated PCI devices.

We should ignore `EV_EFI_BOOT_SERVICES_DRIVER` and `EV_EFI_RUNTIME_SERVICES_DRIVER` events for option ROMs from integrated PCI devices. This is slightly complex because we need to:
- Figure out how to map EFI device paths to something in sysfs.
- Understand if it's possible to determine if a PCI device is integrated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.