Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

jloeser · 2023-04-13T07:33:23Z

This adds a section about new SecureBoot support. It only works in combination with the following patchset:

theforeman/foreman#9864
theforeman/smart-proxy#877

RFC: https://community.theforeman.org/t/add-secureboot-support-for-arbitrary-distributions/32601/1

github-actions · 2023-04-13T07:39:58Z

The PR preview for a71639b is available at theforeman-foreman-documentation-preview-pr-2145.surge.sh

The following output files are affected by this PR:

show diff

show diff as HTML

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb · 2023-11-02T13:47:55Z

Converted to draft PR for now because the linked PRs in foreman and smart_proxy have not been merged yet.

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb

Some open questions for Goars or Jan.

@apinnick Do you ACK the capitalization of "Secure Boot"? And should it be "Secure Boot-enabled hosts" or "hosts with Secure Boot enabled"?

Rest LGTM from a writers perspective.

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

apinnick · 2024-02-07T11:56:27Z

@apinnick Do you ACK the capitalization of "Secure Boot"? And should it be "Secure Boot-enabled hosts" or "hosts with Secure Boot enabled"?

@maximiliankolb I prefer "UEFI Secure Boot" because it is a UEFI security feature but I have no objection to "Secure Boot".

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

goarsna · 2024-03-12T14:51:23Z

Hi there,
after discussions with @lzap and others on the community thread, we changed the implementation to a new approach, that extends the existing Grub2 UEFI SecureBoot and Grub2 UEFI HTTPS SecureBoot PXE loaders to support Secure Boot for arbitrary operating systems. With that, I also had to rework the documentation, so another round of review is needed...

For reference as the PRs mentioned in the first post in this PR are not valid anymore:
The PRs this documentation PR belongs to are

Fixes #36834 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders foreman#9864
Fixes #36833 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders smart-proxy#877
Fixes #36940 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders puppet-foreman_proxy#821

Thanks for all your reviews and input!

maximiliankolb

Applied all feedback minus moving the attributes. Kindly re-review @Lennonka

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

guides/common/assembly_using-pxe-to-provision-hosts.adoc

Lennonka

LGTM

maximiliankolb · 2024-03-13T15:01:37Z

Thanks for the ACK. Code in "foreman" has not been merged yet. I'll press the button as soon as the other PRs are accepted too.

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

ekohl · 2024-07-11T10:05:36Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+ifeval::["{client-os}" == "Debian"]
+* Ensure that `ar` and `xz` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-os}" == "Ubuntu"]
+* Ensure that `ar`, `xz`, and `zstd` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-pkg-ext}" == "rpm"]
+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]


Why don't we make these packaging dependencies if they're required?

At the time of packaging/installing Smart Proxy, you don't know yet which Client OS you want to provision/manage with Foreman.

ekohl · 2024-07-11T10:07:38Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]
+
+.Procedure


If this is all common, why don't we ship a helper script that takes several inputs and saves it to the correct places? That makes both the procedure and testing easier. We can also ensure all commands we use are properly ensured via packaging dependencies.

There's precedent for this: https://github.com/theforeman/smart-proxy/blob/develop/sbin/foreman-prepare-realm is installed (here for RPM). Then the documentation refers to this:

foreman-documentation/guides/common/modules/con_configuring-project-to-manage-the-lifecycle-of-a-host-registered-to-a-freeipa-realm.adoc

Lines 29 to 33 in 3259af8

. Create a realm proxy user, `realm-{smart-proxy-context}`, and the relevant roles in {FreeIPA}:

+

[options="nowrap", subs="+quotes,verbatim,attributes"]

----

# foreman-prepare-realm admin realm-{smart-proxy-context}

This is a great idea; I will try and investigate. It's not trivial to get the correct RPM/DEB package and extract the right binary. Two examples from orcharhino docs: Setup Secure Boot for SLES & Setup Secure Boot for Debian. From a user perspective, it would be very handy.

For now, I think docs are the way to go. I will ping you once I have a draft PR in smart-proxy.

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb

Rebased to "master".

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb · 2024-07-16T14:17:12Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+ifeval::["{client-os}" == "Debian"]
+* Ensure that `ar` and `xz` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-os}" == "Ubuntu"]
+* Ensure that `ar`, `xz`, and `zstd` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-pkg-ext}" == "rpm"]
+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]


At the time of packaging/installing Smart Proxy, you don't know yet which Client OS you want to provision/manage with Foreman.

maximiliankolb · 2024-07-16T14:46:15Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]
+
+.Procedure


This is a great idea; I will try and investigate. It's not trivial to get the correct RPM/DEB package and extract the right binary. Two examples from orcharhino docs: Setup Secure Boot for SLES & Setup Secure Boot for Debian. From a user perspective, it would be very handy.

For now, I think docs are the way to go. I will ping you once I have a draft PR in smart-proxy.

goarsna · 2024-07-16T21:14:52Z

FYI: @nofaralfasi and I had a discussion last week that resulted in some changes we want to implement on the Smart Proxy side which are summarized in the Smart Proxy PR. These changes also will affect this PR. Further updates will follow soonish / in the upcoming weeks (as soon as I have time to work on this again).

apinnick · 2024-07-17T09:17:07Z

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

-Use SecureBoot options to enable a client to download the `shim.efi` bootstrap bootloader that then loads the signed `grubx64.efi`.
-Other PXE loaders like PXELinux UEFI, Grub2 ELF or iPXE Chain, require additional configuration. These workflows are not documented at the moment.
+For BIOS systems, select the *PXELinux BIOS* option to enable a provisioned node to download the `pxelinux.0` file over TFTP.
+For UEFI systems, select the *Grub2 UEFI* option to enable a TFTP client to download `grubx64.efi` file, or select the *Grub2 UEFI HTTP* option to enable an UEFI HTTP client to download `grubx64.efi` with the HTTP Boot feature.


This is outside the scope of this PR. Just FYI.

GRUB is an acronym. The UI labels should be "GRUB2 ..."

ekohl · 2024-07-24T13:46:20Z

Per the last comment, I'm moving this back to draft.

goarsna · 2024-09-09T14:17:50Z

Rebased

goarsna · 2024-09-10T13:21:23Z

I updated the PR to reflect the discussed changes. Thanks @maximiliankolb for marking it as ready.

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

Affects "Grub2 UEFI" PXE loaders * PR in foreman: theforeman/foreman#9864 * PR in smart-proxy: theforeman/smart-proxy#877 * RFC: https://community.theforeman.org/t/add-secureboot-support-for-arbitrary-distributions/32601/1

Lennonka · 2024-09-16T12:50:37Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

@@ -0,0 +1,105 @@
+[id="configuring-{smart-proxy-context}-to-provision-{client-os-context}-on-Secure-Boot-enabled-hosts"]
+= Configuring {SmartProxy} to provision {client-os} on Secure Boot enabled hosts


Suggested change

= Configuring {SmartProxy} to provision {client-os} on Secure Boot enabled hosts

= Configuring {SmartProxy} to provision {client-os} on Secure Booted hosts

Would this be acceptable? It would make the title shorter.

IMO we should leave this as is. Hosts with enabled "Secure Boot" are "securely booted", that's right. But "Secure Boot" is the proper name for the mechanism and the protocol used to achieve this and the term is also used in the UEFI specification (see page 1411).

But i have to admit the title is pretty long 🙈

That's okay. I don't have any other ideas how to make it shorter 😆

"[...] on Secure Booted hosts" doesn't make any sense here. Please keep "[...] Secure Boot enabled hosts" as suggested by @goarsna.

jloeser force-pushed the secureboot-support-poc branch 2 times, most recently from 7be85e5 to 419b2a7 Compare August 25, 2023 12:37

goarsna force-pushed the secureboot-support-poc branch from 419b2a7 to c297863 Compare September 5, 2023 06:43

goarsna reviewed Sep 5, 2023

View reviewed changes

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

maximiliankolb requested changes Sep 5, 2023

View reviewed changes

goarsna reviewed Sep 7, 2023

View reviewed changes

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

This was referenced Oct 17, 2023

Fixes #36834 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders theforeman/foreman#9864

Open

Fixes #36833 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders theforeman/smart-proxy#877

Open

jloeser marked this pull request as ready for review October 17, 2023 13:24

maximiliankolb marked this pull request as draft November 2, 2023 13:47

goarsna mentioned this pull request Dec 4, 2023

Fixes #36940 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders theforeman/puppet-foreman_proxy#821

Open

maximiliankolb requested changes Dec 7, 2023

View reviewed changes

pr-processor bot added the Waiting on contributor Requires an action from the author label Dec 7, 2023

pr-processor bot added Needs re-review and removed Waiting on contributor Requires an action from the author labels Jan 25, 2024

maximiliankolb marked this pull request as ready for review February 7, 2024 10:06

maximiliankolb requested changes Feb 7, 2024

View reviewed changes

pr-processor bot added Waiting on contributor Requires an action from the author and removed Needs re-review labels Feb 7, 2024

apinnick reviewed Feb 7, 2024

View reviewed changes

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

apinnick reviewed Feb 7, 2024

View reviewed changes

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

apinnick reviewed Feb 7, 2024

View reviewed changes

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

pr-processor bot added Needs re-review and removed Waiting on contributor Requires an action from the author labels Feb 8, 2024

maximiliankolb changed the title ~~New PXE loader "Grub2 UEFI SecureBoot (target OS)"~~ Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders Mar 11, 2024

goarsna force-pushed the secureboot-support-poc branch from 7aca375 to 63efbf5 Compare March 12, 2024 14:37

pr-processor bot added Waiting on contributor Requires an action from the author Needs re-review and removed Waiting on contributor Requires an action from the author labels Mar 12, 2024

maximiliankolb reviewed Mar 13, 2024

View reviewed changes

Lennonka approved these changes Mar 13, 2024

View reviewed changes

pr-processor bot removed the Needs re-review label Mar 13, 2024

Lennonka added the Waiting for code Requires merge of related code in another repository before it can be merged label Mar 25, 2024

nofaralfasi reviewed Apr 3, 2024

View reviewed changes

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Show resolved Hide resolved

ekohl requested changes Jul 11, 2024

View reviewed changes

pr-processor bot added the Waiting on contributor Requires an action from the author label Jul 11, 2024

maximiliankolb force-pushed the secureboot-support-poc branch from 6aae85a to 429b413 Compare July 16, 2024 15:02

pr-processor bot added Needs re-review and removed Waiting on contributor Requires an action from the author labels Jul 16, 2024

maximiliankolb reviewed Jul 16, 2024

View reviewed changes

maximiliankolb force-pushed the secureboot-support-poc branch from 429b413 to 96d95e9 Compare July 17, 2024 07:17

apinnick reviewed Jul 17, 2024

View reviewed changes

ekohl marked this pull request as draft July 24, 2024 13:45

goarsna force-pushed the secureboot-support-poc branch from 96d95e9 to f6c2951 Compare September 9, 2024 14:15

goarsna force-pushed the secureboot-support-poc branch from f6c2951 to 83ed4dc Compare September 9, 2024 14:35

maximiliankolb marked this pull request as ready for review September 10, 2024 13:20

goarsna reviewed Sep 10, 2024

View reviewed changes

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

pr-processor bot removed the Needs re-review label Sep 10, 2024

Add Secure Boot support for arbitrary Client OS

a71639b

Affects "Grub2 UEFI" PXE loaders * PR in foreman: theforeman/foreman#9864 * PR in smart-proxy: theforeman/smart-proxy#877 * RFC: https://community.theforeman.org/t/add-secureboot-support-for-arbitrary-distributions/32601/1

goarsna force-pushed the secureboot-support-poc branch from 83ed4dc to a71639b Compare September 12, 2024 07:09

Lennonka reviewed Sep 16, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

jloeser commented Apr 13, 2023 •

edited by maximiliankolb

Loading

github-actions bot commented Apr 13, 2023 •

edited

Loading

maximiliankolb commented Nov 2, 2023

maximiliankolb left a comment

apinnick commented Feb 7, 2024

goarsna commented Mar 12, 2024

maximiliankolb left a comment

Lennonka left a comment

maximiliankolb commented Mar 13, 2024

ekohl Jul 11, 2024

maximiliankolb Jul 16, 2024

ekohl Jul 11, 2024

maximiliankolb Jul 16, 2024

maximiliankolb left a comment

maximiliankolb Jul 16, 2024

maximiliankolb Jul 16, 2024

goarsna commented Jul 16, 2024

apinnick Jul 17, 2024

ekohl commented Jul 24, 2024

goarsna commented Sep 9, 2024

goarsna commented Sep 10, 2024

Lennonka Sep 16, 2024

goarsna Sep 18, 2024 •

edited

Loading

Lennonka Sep 18, 2024

jloeser Sep 30, 2024

	. Create a realm proxy user, `realm-{smart-proxy-context}`, and the relevant roles in {FreeIPA}:
	+
	[options="nowrap", subs="+quotes,verbatim,attributes"]
	----
	# foreman-prepare-realm admin realm-{smart-proxy-context}

		@@ -0,0 +1,105 @@
		[id="configuring-{smart-proxy-context}-to-provision-{client-os-context}-on-Secure-Boot-enabled-hosts"]
		= Configuring {SmartProxy} to provision {client-os} on Secure Boot enabled hosts

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

Are you sure you want to change the base?

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

Conversation

jloeser commented Apr 13, 2023 • edited by maximiliankolb Loading

github-actions bot commented Apr 13, 2023 • edited Loading

maximiliankolb commented Nov 2, 2023

maximiliankolb left a comment

Choose a reason for hiding this comment

apinnick commented Feb 7, 2024

goarsna commented Mar 12, 2024

maximiliankolb left a comment

Choose a reason for hiding this comment

Lennonka left a comment

Choose a reason for hiding this comment

maximiliankolb commented Mar 13, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maximiliankolb left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

goarsna commented Jul 16, 2024

Choose a reason for hiding this comment

ekohl commented Jul 24, 2024

goarsna commented Sep 9, 2024

goarsna commented Sep 10, 2024

Choose a reason for hiding this comment

goarsna Sep 18, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jloeser commented Apr 13, 2023 •

edited by maximiliankolb

Loading

github-actions bot commented Apr 13, 2023 •

edited

Loading

goarsna Sep 18, 2024 •

edited

Loading