#1080313 --no-microsoft still adds Microsoft certs to the KEK db

Package:
python3-virt-firmware
Source:
python3-virt-firmware
Submitter:
Trent W. Buck
Date:
2024-09-02 00:49:34 UTC
Severity:
normal
#1080313#5
Date:
2024-09-02 00:44:38 UTC
From:
To:
(I'm not a Secure Boot expert, so this might be a dumb bug report.  If so, sorry!)

I noticed that --no-microsoft prevents Microsoft keys being added to the db sigdb, but does not prevent Microsoft keys being added to the KEK sigdb.
I don't know if this is intentional.
If this is intentional, please tweak the manpage to make this more obvious.
If this is accidental, I guess efivars.py needs to get a conditional passed from vars.py?

Here is normal usage:

    bash5$ virt-fw-vars -i /usr/share/OVMF/OVMF_VARS_4M.fd --enroll-cert ./cert
    INFO: reading raw edk2 varstore from /usr/share/OVMF/OVMF_VARS_4M.fd
    INFO: var store range: 0x64 -> 0x40000
    INFO: create variable PK
    INFO: clear PK sigdb
    INFO: add PK cert ./cert
    INFO: create variable KEK
    INFO: clear KEK sigdb
    INFO: add KEK cert ./cert
    INFO: add KEK cert /usr/lib/python3/dist-packages/virt/firmware/certs/MicrosoftCorporationKEKCA2011.pem
    INFO: add KEK cert /usr/lib/python3/dist-packages/virt/firmware/certs/MicrosoftCorporationKEK2KCA2023.pem
    INFO: add dummy dbx entry
    INFO: create variable dbx
    INFO: create variable db
    INFO: add db cert /usr/lib/python3/dist-packages/virt/firmware/certs/MicrosoftWindowsProductionPCA2011.pem
    INFO: add db cert /usr/lib/python3/dist-packages/virt/firmware/certs/WindowsUEFICA2023.pem
    INFO: add db cert /usr/lib/python3/dist-packages/virt/firmware/certs/MicrosoftCorporationUEFICA2011.pem
    INFO: add db cert /usr/lib/python3/dist-packages/virt/firmware/certs/MicrosoftUEFICA2023.pem

Here is --no-microsoft behaving unexpectedly:

    bash5$ virt-fw-vars -i /usr/share/OVMF/OVMF_VARS_4M.fd --enroll-cert ./cert --no-microsoft
    INFO: reading raw edk2 varstore from /usr/share/OVMF/OVMF_VARS_4M.fd
    INFO: var store range: 0x64 -> 0x40000
    INFO: create variable PK
    INFO: clear PK sigdb
    INFO: add PK cert ./cert
    INFO: create variable KEK
    INFO: clear KEK sigdb
    INFO: add KEK cert ./cert
    INFO: add KEK cert /usr/lib/python3/dist-packages/virt/firmware/certs/MicrosoftCorporationKEKCA2011.pem       <--- !!!
    INFO: add KEK cert /usr/lib/python3/dist-packages/virt/firmware/certs/MicrosoftCorporationKEK2KCA2023.pem     <--- !!!
    INFO: add dummy dbx entry
    INFO: create variable dbx

I *think* this command does what I expected the previous command to do:

    bash5$ virt-fw-vars -i /usr/share/OVMF/OVMF_VARS_4M.fd --set-pk a0baa8a3-041d-48a8-bc87-c36d121b5e3d cert --add-kek a0baa8a3-041d-48a8-bc87-c36d121b5e3d cert --add-db a0baa8a3-041d-48a8-bc87-c36d121b5e3d cert
    INFO: reading raw edk2 varstore from /usr/share/OVMF/OVMF_VARS_4M.fd
    INFO: var store range: 0x64 -> 0x40000
    INFO: create variable PK
    INFO: clear PK sigdb
    INFO: add PK cert cert
    INFO: create variable KEK
    INFO: add KEK cert cert
    INFO: create variable db
    INFO: add db cert cert