Enabling UEFI Secure Boot on your Platform

If you have not seen how to setup your own EFITOOL, please click this link (Howto?) and setup before coming to this post. It would make more sense once you have the EFITOOL compiled on your Linux OS.

1. Boot system to EFI Shell:

Go to BIOS setup menu

Select CSM -> Video to UEFI only. //If your screen blank out, try use direct Graphic cable without converter

Click Disable CSM mode

Save and reboot

Look for Secure Boot mode

Check what mode it is: 

If it is in User mode, go to Disable Auto Provisioning and Clear all existing keys.

Save and reboot.

Now it should report as Setup mode.

Boot to UEFI shell.

fs3:   //or what your USB drive initialized to

2. Run Lockdown.efi.

or
3. Now on your platform update the variables, remembering to do PK last because

an update to PK usually puts the platform into secure mode

UpdateVars db db.auth

UpdateVars KEK KEK.auth

UpdateVars PK PK.auth

And you should now be running in secure mode with your own keys.

How to compile EFITOOLS to 32bits instead of 64bits?

What is EFITOOLS?
This is an UEFI tool that able to help you to load your PK, KEK, DB keys into the Firmware and enabled Secure Boot on your Computer.
It is also able to help you create the Private and Public Keys of PK, KEK and DB.

Why Compile 32bits Version instead of 64bits?
When you want to boot 32bit OS, you'll need 32bit UEFI BIOS. Since you are running 32bit UEFI BIOS, you can only execute EFI or binaries that are compile for 32bit.

Steps to compile 32bit version of EFITools:

1) Requirement:
32bit OS(32bit version) 64bit OS (64bit version) Fedora /Ubuntu / Linux based OS
In our example we will use Fedora 32bit. You can use 64bit OS to compile for 32bit version, however, my guide does not include that.

2) Download required dependancy and libraries needed:

a) Get the GNU-EFI library:: CMD ::
           Method 1: sudo yum install gnu-efi
           Method 2: git clone https://github.com/vathpela/gnu-efi
                            cd into the directory
                            make
                            sudo make install
                         
b) Get the sbsigntool ::CMD ::
          Method 1: git clone https://github.com/wmarone/sbsigntool
                           cd into the directory
                           ./autogen.sh
                           ./configure          //Notice, they might be some dependency missing, need installation
                           make
                           sudo make install

c) Get some libraries needed
           sudo yum install pkgconfig
           sudo yum install perl-CPAN
           sudo yum install perl-File-Slurp
           sudo yum install help2man

3) Above are similar across 32bits version and 64bits version, however, below will be 32bit focus only.

     There will be an error in the lib/security_policy.c as there are asm code in the security policy and so far I can't find a workaround for it.

        vim lib/Makefile

        Delete the security_policy.o from the FILES = line

        Add the bolded two lines

        clean:

        rm -f lib.a

        rm -f $(LIBFILES)

        rm -f lib-efi.a

        rm -f $(EFILIBFILES)

         vim Makefile

         Delete the PreLoader.efi from the EFIFILES = line, as this file required the security_policy.c library

4) Compile all the necessary files by doing make

         make clean && make 

         //It should complete with no error and undefine symbols

5) Now create a USB drive image:

        ./mkusb * * usb_drive_image.img

6) Open the System in Fedora application and plug in a USB pendrive

    Click Restore Image on the drive and select the usb_drive_image.img

Congratulation, you have successfully created your own signed application with PK, KEK, DB keys.

Next - > See Enabling UEFI Secure Boot on your Platform

Signing with own keys on EFI files using sbsigntool

1. git clone https://github.com/wmarone/sbsigntool
2. ./autogen.sh      (this will work provided you are not behind firewall that filter out git:// access
• If you are behind block git:// access, go download the sbsigntool package and use that instead
• Link: https://build.opensuse.org/package/show?package=sbsigntools&project=home%3Ajejb1%3AUEFI
1. After unzip at linux host (tar -xvf sbsigntools-0.6-debian.tar.gz)
2. Run ./autogen.sh
• Error regarding git can be ignore as you already have those files (ccan)
3. ./configure
• At this stage, there will be lots of dependencies. Be patience as you add and install those.
• There are lots of dependencies on the CPAN Perl script
• Do this first: ( to get most of the dependencies fixed)                        
• sudo yum install perl-CPAN

• (1/5): perl-ExtUtils-
  (2/5): perl-Test-Harness-
  (3/5): perl-CPAN-1.9205-
  (4/5): perl-ExtUtils-MakeMaker-
  (5/5): perl-devel-
  

• The above fixes error such as 
• Can't locate /xxxx.pm in @INC (@INC contains

• Some of the issues encountered:

•  File-Slurp (It is needed for use File::Slurp qw( ))
• Download: Link
• untar and cd into directory
• perl Makefile.PL
• make
• make test
• sudo make install
• uuid package missing
• sudo yum install libuuid-devel pkgconfig
• libcrypto package missing
• use command to verify if it is installed and detected by the package
• pkg-config --libs libcrypto
• If correctly configure: return result is -lcrypto
• Fixes: 
• sudo yum install openssl-devel
• sudo yum install openssl
4. Once it passes all the checkings 
1. Do command:
• make 
• sudo make install

Congratulation, your sbsigntool should be installed and operation now.

How to install and git openssl?

Need to generate Public and Private key?
Do some encryption?

First you need to install Openssl!!

1. git clone https://github.com/openssl/openssl
2. cd to the new directory created
• view (vi) INSTALL (For instruction how to install)
3. Basically command needed is:
• ./config
• make
• make test
• make install

If you encounter issue when installing sbsigntool in the next step that:

Probably you need to do the following as well:

• sudo yum install openssl-devel-1.0.0i-1.fc17.i686

If got error on libcrypto not found:

Check using: pkg-config --libs libcrypto

• Good Result: -lcrypto
• Bad Result -
  Package libcrypto was not found in the pkg-config search path.
  Perhaps you should add the directory containing `libcrypto.pc' to the PKG_CONFIG_PATH environment variable
  No package 'libcrypto' found

Solution:

• Try CMD: locate libcrypto
• Need to have: 
• /usr/local/ssl/lib/libcrypto.a
• /usr/local/ssl/lib/pkgconfig/libcrypto.pc
• /usr/lib64/pkgconfig/libcrypto.pc
• /usr/lib64/libcrypto.so
• /usr/lib/libcrypto.so