UEFI secure boot support for pxe_ilo driver
https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-pxe-ilo This spec proposes grub2 as a alternative bootloader for Ironic pxe driver to add support for UEFI secure boot to pxe_ilo driver. Change-Id: I5745fe5c30b0ba1eb67065218dec9c334884007a
This commit is contained in:
Shivanand Tendulker
parent
795f4033cf
commit
5a212299c4
297
specs/liberty/uefi-secure-boot-pxe-ilo.rst
Normal file
297
specs/liberty/uefi-secure-boot-pxe-ilo.rst
Normal file
@ -0,0 +1,297 @@
|
||||
..
|
||||
This work is licensed under a Creative Commons Attribution 3.0 Unported
|
||||
License.
|
||||
|
||||
http://creativecommons.org/licenses/by/3.0/legalcode
|
||||
|
||||
==================================================
|
||||
UEFI Secure Boot support for pxe_iLO driver
|
||||
==================================================
|
||||
|
||||
Include the URL of your launchpad blueprint:
|
||||
|
||||
https://blueprints.launchpad.net/ironic/+spec/uefi-secure-boot-pxe-ilo
|
||||
|
||||
As part of Kilo release UEFI secure boot support was enabled for all the iLO
|
||||
drivers except pxe_ilo. It is important to have this feature supported for
|
||||
pxe_ilo driver so that security sensitive users of pxe_ilo driver could deploy
|
||||
more securely using Secure Boot feature of the UEFI. This spec proposes UEFI
|
||||
Secure Boot support in baremetal provisioning for pxe_ilo driver.
|
||||
|
||||
Problem description
|
||||
===================
|
||||
|
||||
Secure Boot is part of the UEFI specification (http://www.uefi.org). It helps
|
||||
to make sure that node boots using only software that is trusted by Admin/End
|
||||
user.
|
||||
|
||||
Secure Boot is different from TPM (Trusted Platform Module). TPM is a standard
|
||||
for a secure cryptoprocessor, which is dedicated microprocessor designed to
|
||||
secure hardware by integrating cryptographic keys into devices. Secure Boot is
|
||||
part of UEFI specification, which can secure the boot process by preventing
|
||||
the loading of drivers or OS loaders that are not signed with an acceptable
|
||||
digital signature.
|
||||
|
||||
When the node starts with secure boot enabled, system firmware checks the
|
||||
signature of each piece of boot software, including firmware drivers (Option
|
||||
ROMs), boot loaders and the operating system. If the signatures are good,
|
||||
the node boots, and the firmware gives control to the operating system.
|
||||
|
||||
The Admin and End users having security sensitivity with respect to baremetal
|
||||
provisioning owing to the workloads they intend to run on the provisioned
|
||||
nodes would be interested in using secure boot provided by UEFI.
|
||||
|
||||
Once secure boot is enabled for a node, it cannot boot using unsigned boot
|
||||
images. Hence it is important to use signed bootloaders and kernel if node
|
||||
were to be booted using secure boot.
|
||||
|
||||
This feature has been enabled for iscsi_ilo and agent_ilo driver during Kilo
|
||||
release. It needs to be enabled for pxe_ilo driver. This needs pxe_ilo driver
|
||||
should support signed UEFI bootloader for the nodes to boot in the UEFI secure
|
||||
boot environment.
|
||||
|
||||
Proposed change
|
||||
===============
|
||||
|
||||
This spec proposes to support UEFI secure boot for pxe_ilo driver and grub2 as
|
||||
an alternate bootloader for UEFI deploy for PXE drivers.
|
||||
|
||||
Preparing the environment
|
||||
-------------------------
|
||||
|
||||
* The operator informs the Ironic using the ``capabilities`` property of the
|
||||
node. The operator may add a new capability ``secure_boot=true`` in
|
||||
``capabilities`` within ``properties`` of that node. This is an optional
|
||||
property that can be used if node needs to be provisioned for secure boot.
|
||||
By default the behavior would be as if this property is set to 'false'. The
|
||||
inspection feature in iLO drivers can auto discover secure boot capability
|
||||
of the node and create node capability into that node object.
|
||||
|
||||
* If the user has ``secure_boot`` capability set in the flavor, pxe_ilo has
|
||||
ability to change the boot mode to UEFI and prepare the node for the secure
|
||||
boot on the fly using proliantutils library calls.
|
||||
|
||||
* Even if the ``secure_boot`` capability is set to ``true`` in the node's
|
||||
``properties/capabilities``, node can be used for normal non-secure boot
|
||||
deployments. Driver would use the ``secure_boot`` capability information from
|
||||
the node's ``instance_info`` field to provision node for UEFI secure boot.
|
||||
|
||||
Preparing flavor for secure boot
|
||||
--------------------------------
|
||||
|
||||
* The ``extra_specs`` field in the nova flavor should be used to indicate
|
||||
secure boot. User will need to create a flavor by adding
|
||||
"capabilities:secure_boot="true" to it.
|
||||
|
||||
* iLO driver will not do secure boot if "secure_boot" capability flavor is
|
||||
not present or set to "False". Nova scheduler will use secure_boot
|
||||
capability as one of the node selection criteria if "secure_boot" is
|
||||
present in extra_spec. If "secure_boot" is not present in extra_spec then
|
||||
Nova scheduler will not consider "secure_boot" capability as a node
|
||||
selection criteria.
|
||||
|
||||
* Ironic virt Driver will pass the flavor capability information to the driver
|
||||
as part of 'instance_info'. Having capability information as part of
|
||||
'instance_info' would help driver in preparing and decommissioning the node
|
||||
appropriately. With respect to secure boot feature, this information would be
|
||||
used by pxe_ilo driver for:-
|
||||
|
||||
* During provisioning, driver can turn on the secure boot capability to
|
||||
validate signatures of bootloaders and kernel.
|
||||
|
||||
* During teardown, secure boot mode would be disabled on the node.
|
||||
|
||||
Preparing bootloader and deploy images
|
||||
--------------------------------------
|
||||
|
||||
To support UEFI secure boot for pxe_ilo driver, pxe driver for Ironic should
|
||||
support signed UEFI bootloader. Currently 'elilo' is the default UEFI
|
||||
bootloader for all pxe drivers. Not all major linux distros ship signed 'elilo'
|
||||
bootloader. They ship signed 'grub2' bootloader.
|
||||
|
||||
Enabling grub2 bootloader requires steps similar to elilo. Steps are:-
|
||||
|
||||
* Copy signed shim and grub2 bootloader files into tftproot directory as
|
||||
bootx64.efi and grubx64.efi respectively .
|
||||
|
||||
* Create a master grub.cfg file under /tftpboot/grub
|
||||
|
||||
* Contents of master grub.cfg would look something like this.
|
||||
set default=master
|
||||
set timeout=5
|
||||
set hidden_timeout_quiet=false
|
||||
|
||||
menuentry "master" {
|
||||
configfile /tftpboot/$net_default_ip.conf
|
||||
}
|
||||
|
||||
This master grub.cfg gets loaded first during PXE boot. It tells grub to
|
||||
refer to the node specific config file in tftproot directory configured for
|
||||
PXE. The name of config file is coined using DHCP IP address that would be
|
||||
allocated to the node. This is to ensure that multiple grub.cfg files could
|
||||
be created for parallel deploys. The contents of $net_default_ip.conf is
|
||||
dynamically filled by PXE driver using grub template file.
|
||||
|
||||
Ironic needs to support 'grub2' as an alternate UEFI bootloader for following
|
||||
reasons:-
|
||||
|
||||
* No active development happening on 'elilo'
|
||||
|
||||
* All major linux distributions are supporting 'grub2' as a default UEFI
|
||||
bootloader.
|
||||
|
||||
* All major linux distributions provide signed 'grub2' bootloader which could
|
||||
be used in UEFI secure boot deploy with distro supplied cloud images.
|
||||
Otherwise users would need to build their own signed images for secure boot
|
||||
deploy.
|
||||
|
||||
* signed grub2 can be used for normal UEFI deploys as well.
|
||||
|
||||
All major linux distros ship their self signed 'grub2' and also provide
|
||||
Microsoft UEFI CA signed shim bootloader. The shim bootloader contains the UEFI
|
||||
signature of respective distros.
|
||||
|
||||
When node boots up using pxe, it loads Microsoft signed 'shim' boot loader
|
||||
which in turn loads the distro signed 'grub2'. Distro signed 'grub2' can
|
||||
validate and load the distro kernel.
|
||||
Shim bootloader is required as it is signed using Microsoft UEFI CA signature
|
||||
and recognizes corresponding linux vendors certificate as a valid certificate.
|
||||
Secure boot enabled HP Proliant UEFI systems are pre-loaded with Microsoft UEFI
|
||||
CA signatures.
|
||||
User signed images can be supported but user need to manually configure
|
||||
their keys to HP Proliant system ROM database using Proliant tools.
|
||||
|
||||
User can configure 'grub2' as a bootloader by changing the following existing
|
||||
variables in /etc/ironic/ironic.conf under pxe section:
|
||||
uefi_pxe_config_template
|
||||
uefi_pxe_bootfile_name
|
||||
|
||||
Alternatives
|
||||
------------
|
||||
|
||||
Add support for signed 'grub2' as a default UEFI bootloader in Ironic. But such
|
||||
a change would have backward compatibility impact.
|
||||
|
||||
Data model impact
|
||||
-----------------
|
||||
|
||||
None
|
||||
|
||||
State Machine Impact
|
||||
--------------------
|
||||
|
||||
None
|
||||
|
||||
REST API impact
|
||||
---------------
|
||||
|
||||
None
|
||||
|
||||
RPC API impact
|
||||
--------------
|
||||
|
||||
None
|
||||
|
||||
Client (CLI) impact
|
||||
-------------------
|
||||
None
|
||||
|
||||
Driver API impact
|
||||
-----------------
|
||||
|
||||
None
|
||||
|
||||
Nova driver impact
|
||||
------------------
|
||||
|
||||
None
|
||||
|
||||
Security impact
|
||||
---------------
|
||||
|
||||
This enhances security. Only correctly signed firmware, bootloader and OS can
|
||||
be booted. It provides users with the opportunity to run the software of their
|
||||
choice in the most secure manner.
|
||||
|
||||
Other end user impact
|
||||
---------------------
|
||||
|
||||
Users need to use properly signed deploy and boot components.
|
||||
Currently pxe_ilo driver would support deploy and boot images having 'shim' and
|
||||
'grub2' signed by Linux OS vendors.
|
||||
If user wants to use custom signed images, then he would need to manually
|
||||
configure their keys to UEFI using HP Proliant tools.
|
||||
If user were to use an unsigned image for deploy with flavor requesting
|
||||
UEFI secure boot, then deploy process would go through successfully, but
|
||||
final boot into instance image would fail. The signature validation of
|
||||
unsigned components would fail resulting in the failure of boot process. The
|
||||
appropriate boot failure message would get displayed on Node's console.
|
||||
|
||||
Scalability impact
|
||||
------------------
|
||||
|
||||
None
|
||||
|
||||
Performance Impact
|
||||
------------------
|
||||
|
||||
There is no performance impact due to signature validation in secure boot.
|
||||
|
||||
Other deployer impact
|
||||
---------------------
|
||||
|
||||
User can deploy only signed images with UEFI secure boot enabled.
|
||||
|
||||
Developer impact
|
||||
----------------
|
||||
|
||||
None
|
||||
|
||||
Implementation
|
||||
==============
|
||||
|
||||
Assignee(s)
|
||||
-----------
|
||||
|
||||
Primary assignee:
|
||||
Shivanand Tendulker (stendulker@gmail.com)
|
||||
|
||||
Work Items
|
||||
----------
|
||||
|
||||
1. Add support for grub2/shim as a alternate UEFI bootloaders for Ironic pxe
|
||||
driver.
|
||||
|
||||
2. Implement secure boot for pxe_ilo driver.
|
||||
|
||||
Dependencies
|
||||
============
|
||||
|
||||
Signed user images.
|
||||
The necessary DiskImageBuilder changes has been done to
|
||||
build signed Ubuntu and Fedora images.
|
||||
|
||||
Testing
|
||||
=======
|
||||
|
||||
Unit tests would be added for all newly added code.
|
||||
|
||||
Upgrades and Backwards Compatibility
|
||||
====================================
|
||||
|
||||
None. grub2 would be alternate bootloader, which user can use only if it needs
|
||||
UEFI secure boot functionality.
|
||||
|
||||
Documentation Impact
|
||||
====================
|
||||
|
||||
Newly added functionality would be appropriately documented.
|
||||
|
||||
References
|
||||
==========
|
||||
|
||||
1. UEFI specification http://www.uefi.org
|
||||
2. Proliantutils module - https://pypi.python.org/pypi/proliantutils
|
||||
3. HP UEFI System Utilities User Guide - http://www.hp.com/ctg/Manual/c04398276.pdf
|
||||
4. Secure Boot for Linux on HP Proliant servers http://h20195.www2.hp.com/V2/getpdf.aspx/4AA5-4496ENW.pdf
|
||||
|
||||
Loading…
Reference in New Issue
Block a user