|
 |
4210fa |
From a0bb7822bc0745cba1af1c119fb9f7a0e5ec828c Mon Sep 17 00:00:00 2001
|
|
|
4210fa |
From: Peter Jones <pjones@redhat.com>
|
|
|
4210fa |
Date: Fri, 14 Feb 2014 14:44:31 -0500
|
|
|
4210fa |
Subject: [PATCH 21/74] Add a failure case to the test plan and fix an ordering
|
|
|
4210fa |
error.
|
|
|
4210fa |
|
|
|
4210fa |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
4210fa |
---
|
|
|
4210fa |
testplan.txt | 27 +++++++++++++++++----------
|
|
|
4210fa |
1 file changed, 17 insertions(+), 10 deletions(-)
|
|
|
4210fa |
|
|
|
4210fa |
diff --git a/testplan.txt b/testplan.txt
|
|
|
4210fa |
index 118dfcd..2fbf238 100644
|
|
|
4210fa |
--- a/testplan.txt
|
|
|
4210fa |
+++ b/testplan.txt
|
|
|
4210fa |
@@ -12,23 +12,26 @@ How to test a new shim build for RHEL/fedora:
|
|
|
4210fa |
-s -c "Red Hat Test Certificate"
|
|
|
4210fa |
6) put pesign-test-app-signed.efi in \EFI\test as grubx64.efi
|
|
|
4210fa |
cp /usr/share/pesign-test-app-0.4/pesign-test-app-signed.efi \
|
|
|
4210fa |
- /boot/efi/EFI/test/test.efi
|
|
|
4210fa |
-7) sign a copy of grubx64.efi with RHTC and iput it in \EFI\test\:
|
|
|
4210fa |
- pesign -i /boot/efi/EFI/redhat/grubx64.efi -o grubx64-unsigned.efi \
|
|
|
4210fa |
- -r -u 0
|
|
|
4210fa |
- pesign -i grubx64-unsigned.efi -o /boot/efi/EFI/test/grub.efi \
|
|
|
4210fa |
- -s -c "Red Hat Test Certificate"
|
|
|
4210fa |
+ /boot/efi/EFI/test/test.efi
|
|
|
4210fa |
+7) sign a copy of grubx64.efi with RHTC and iput it in \EFI\test\ . Also
|
|
|
4210fa |
+ leave an unsigned copy there:
|
|
|
4210fa |
+ pesign -i /boot/efi/EFI/redhat/grubx64.efi \
|
|
|
4210fa |
+ -o /boot/efi/EFI/test/grubx64-unsigned.efi \
|
|
|
4210fa |
+ -r -u 0
|
|
|
4210fa |
+ pesign -i /boot/efi/EFI/test/grubx64-unsigned.efi \
|
|
|
4210fa |
+ -o /boot/efi/EFI/test/grub.efi \
|
|
|
4210fa |
+ -s -c "Red Hat Test Certificate"
|
|
|
4210fa |
8) sign a copy of mokmanager with RHTC and put it in \EFI\test:
|
|
|
4210fa |
pesign -i /usr/share/shim/MokManager.efi \
|
|
|
4210fa |
- -o /boot/efi/EFI/test/MokManager.efi -s \
|
|
|
4210fa |
+ -o /boot/efi/EFI/test/MokManager.efi -s \
|
|
|
4210fa |
-c "Red Hat Test Certificate"
|
|
|
4210fa |
9) copy grub.cfg to our test directory:
|
|
|
4210fa |
cp /boot/efi/EFI/redhat/grub.cfg /boot/efi/EFI/test/grub.cfg
|
|
|
4210fa |
10) *move* \EFI\redhat\BOOT.CSV to \EFI\test
|
|
|
4210fa |
- mv /boot/efi/EFI/redhat/BOOT.CSV /boot/efi/EFI/test/BOOT.CSV
|
|
|
4210fa |
-11) sign a copy of fallback.efi and put it in \EFI\BOOT\fallback.efi
|
|
|
4210fa |
rm -rf /boot/efi/EFI/BOOT/
|
|
|
4210fa |
mkdir /boot/efi/EFI/BOOT/
|
|
|
4210fa |
+ mv /boot/efi/EFI/redhat/BOOT.CSV /boot/efi/EFI/test/BOOT.CSV
|
|
|
4210fa |
+11) sign a copy of fallback.efi and put it in \EFI\BOOT\fallback.efi
|
|
|
4210fa |
pesign -i /usr/share/shim/fallback.efi \
|
|
|
4210fa |
-o /boot/efi/EFI/BOOT/fallback.efi \
|
|
|
4210fa |
-s -c "Red Hat Test Certificate"
|
|
|
4210fa |
@@ -55,7 +58,7 @@ How to test a new shim build for RHEL/fedora:
|
|
|
4210fa |
If you get the expected result, shim can run things signed by its internal
|
|
|
4210fa |
key ring. Check a box someplace that says it can do that.
|
|
|
4210fa |
23) from the EFI shell, copy grub to grubx64.efi:
|
|
|
4210fa |
- cp \EFI\test\grubx.efi \EFI\test\grubx64.efi
|
|
|
4210fa |
+ cp \EFI\test\grub.efi \EFI\test\grubx64.efi
|
|
|
4210fa |
24) in the EFI shell, run fs0:\EFI\test\shim.efi
|
|
|
4210fa |
result: this should start grub, which will let you boot a kernel
|
|
|
4210fa |
If grub starts, it means shim can run things signed by a key in the system's
|
|
|
4210fa |
@@ -78,3 +81,7 @@ How to test a new shim build for RHEL/fedora:
|
|
|
4210fa |
If this works, you should see a bit of output very quickly and then the same
|
|
|
4210fa |
thing as #24. This means shim recognized it was in \EFI\BOOT and ran
|
|
|
4210fa |
fallback.efi, which worked.
|
|
|
4210fa |
+29) copy the unsigned grub into place and reboot:
|
|
|
4210fa |
+ cp /boot/efi/EFI/test/grubx64-unsigned.efi /boot/efi/EFI/test/grubx64.efi
|
|
|
4210fa |
+30) reboot again.
|
|
|
4210fa |
+ result: shim should refuse to load grub.
|
|
|
4210fa |
--
|
|
|
4210fa |
1.9.3
|
|
|
4210fa |
|