This series implements the EFI_SECURITY_ARCH_PROTOCOL and EFI_SECURITY2_ARCH_PROTOCOL. The primary motivation is to support EFI applications like systemd-stub in Unified Kernel Images (UKI) so they can temporarily override authentication for embedded payloads.
Note: This work was originally authored by Enric Balletbo i Serra. I am submitting it upstream on his behalf with additional testing. --- Testing Performed I have validated these patches across various secure boot scenarios on both physical hardware and emulators to ensure the new overrides work without regressing standard secure boot enforcement. Hardware: Renesas R-Car S4 (EBBR UKI boot) - [PASS] Unsigned image, Secure Boot disabled, without patch (Boots) - [PASS] Unsigned image, Secure Boot compiled (not enforcing), without patch (Boots) - [PASS] Signed image, Secure Boot enforcing, without patch (Fails to boot as expected) - [PASS] Signed image, Secure Boot enforcing, with patch (Boots successfully) - [PASS] Signed image (wrong keys), Secure Boot enforcing, with patch (Fails to boot as expected) Emulator: QEMU (qemu UKI boot) - [PASS] Unsigned image, Secure Boot disabled, without patch (Boots) - [PASS] Unsigned image, Secure Boot enabled, without patch (Boots) - [PASS] Signed image, Secure Boot enabled, without patch (Fails to boot as expected) - [PASS] Signed image, Secure Boot enabled, with patch (Boots successfully) Signed-off-by: Ian Mullins <[email protected]> --- Enric Balletbo i Serra (2): efi_loader: implement EFI Security Architecture protocols efi_selftest: add tests for security architecture protocols include/efi_api.h | 30 +++ include/efi_loader.h | 15 +- lib/efi_loader/Kconfig | 11 ++ lib/efi_loader/Makefile | 1 + lib/efi_loader/efi_boottime.c | 3 +- lib/efi_loader/efi_image_loader.c | 31 ++- lib/efi_loader/efi_security.c | 99 ++++++++++ lib/efi_loader/efi_setup.c | 7 + lib/efi_selftest/Makefile | 1 + lib/efi_selftest/efi_selftest_security_arch.c | 110 +++++++++++ .../py/tests/test_efi_secboot/README.security_arch | 208 +++++++++++++++++++++ .../tests/test_efi_secboot/test_security_arch.py | 73 ++++++++ 12 files changed, 580 insertions(+), 9 deletions(-) --- base-commit: 913fedc816570c07bfc7f9c4046dc2a3a55e4099 change-id: 20260710-efi_security_protocol-6b9fb0e8da41 Best regards, -- Ian Mullins <[email protected]>
