shaba/virt-manager
1
0
Fork 0
mirror of https://github.com/virt-manager/virt-manager.git synced 2025-03-09 08:58:27 +03:00
Code Issues Projects Releases Wiki Activity

virtinst: enable secure feature together with smm for UEFI

Browse Source 
The secure feature actually enforce the secure boot if Secure Boot
Mode is configured.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1387479

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
This commit is contained in:
Pavel Hrdina 2017-06-07 20:47:59 +02:00
parent 1c22105a54
commit b690908aa4
3 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tests/cli-test-xml/compare/virt-install-boot-uefi.xml
View File

@ -6,7 +6,7 @@
<vcpu>1</vcpu>
<os>
<type arch="x86_64" machine="q35">hvm</type>
<loader readonly="yes" type="pflash">/usr/share/ovmf/OVMF_CODE.secboot.fd</loader>
<loader readonly="yes" type="pflash" secure="yes">/usr/share/ovmf/OVMF_CODE.secboot.fd</loader>
<boot dev="hd"/>
</os>
<features>

2
virtManager/domain.py
View File

@ -698,7 +698,7 @@ class vmmDomain(vmmLibvirtObject):
guest.os.loader = loader
guest.os.loader_type = "pflash"
guest.os.loader_ro = True
guest.check_uefi_smm()
guest.check_uefi_secure()
if nvram != _SENTINEL:
guest.os.nvram = nvram

10
virtinst/guest.py
View File

@ -561,16 +561,18 @@ class Guest(XMLBuilder):
self.os.loader_type = "pflash"
self.os.loader = path
self.check_uefi_smm()
self.check_uefi_secure()
def check_uefi_smm(self):
def check_uefi_secure(self):
"""
If the firmware name contains "secboot" it is probably build
with SMM feature required so we need to enable that feature,
otherwise the firmware may fail to load. True secure boot is
currently supported only on x86 architecture and with q35 with
SMM feature enabled so change the machine to q35 as well.
To actually enforce the secure boot for the guest if Secure Boot
Mode is configured we need to enable loader secure feature.
"""
if not self.os.is_x86():
@ -579,10 +581,12 @@ class Guest(XMLBuilder):
if "secboot" not in self.os.loader:
return
if not self.conn.check_support(self.conn.SUPPORT_DOMAIN_FEATURE_SMM):
if (not self.conn.check_support(self.conn.SUPPORT_DOMAIN_FEATURE_SMM) or
not self.conn.check_support(self.conn.SUPPORT_DOMAIN_LOADER_SECURE)):
return
self.features.smm = True
self.os.loader_secure = True
self.os.machine = "q35"
###################