Plugin: UEFI db

Introduction

The EFI Signature Database (also known as db) contains multiple certificates, hashes and signatures, all signed by the KEK.

It is used to allow signed binaries to be run with SecureBoot enabled. This plugin allows updating the db with new certificates issued by Microsoft or the OEM vendor.

Firmware Format

The daemon will decompress the cabinet archive and extract a firmware blob in EFI_SIGNATURE_LIST format. See https://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf for details.

This plugin supports the following protocol ID:

  • org.uefi.dbx2

GUID Generation

These devices use the GUID constructed of the uppercase SHA256 of the X.509 certificate. e.g.

  • UEFI\CRT_{sha256}

Additionally, the subject vendor and name are used if provided.

  • UEFI\VENDOR_{vendor}&NAME_{name}

Update Behavior

The firmware is deployed when the machine is in normal runtime mode, but it is only activated when the system is restarted.

Vendor ID Security

The vendor ID is set from the certificate vendor, e.g. UEFI:Microsoft.

External Interface Access

This plugin requires:

  • Read and write access to /sys/firmware/efi/efivars

Version Considerations

This plugin has been available since fwupd version 2.0.8.

Owners

Anyone can submit a pull request to modify this plugin, but the following people should be consulted before making major or functional changes:

  • Richard Hughes: hughsie