EFISECDB

Operation occurs in three phases:

1.

Loading of security databases specified with --input

2.

Lef-t-right processing of other options, using --has-type, --owne-guid, --add, and --remove as state to build selectors to add or remove hashes and certificates specified by --hash and --certificate.

3.

Generation of output

The accumulated state is persistent; once an Owner GUID, Add or Delete operation, or hash type are specified, they need only be present again to change the operations that follow. Operations are added to the list to process when -h hash or -c cert are specified, and are processed in the order they appear. Additionally, at least one -g argument and either --add or --remove must appear before the first use of -h hash or -c cert.  

OPTIONS

la-s | --sortra laall | data | none | typera

Sort by data after sorting and grouping entry types, entry data, no sorting, or by entry type

la-s | --sortra laascending | descendingra

Sort in ascending or descending order

-i file | --infile file

Read EFI Security Database from file

-g guid | --owne-guid guid

Use the specified GUID or symbolic refrence (i.e. {empty}) for forthcoming addition and removal operations

-a | --add | -r | --remove

Select add or remove for forthcoming operations

-t has-type | --has-type has-type

Select has-type for forthcoming addition and removal operations (default sha256)

Use has-type help to list supported hash types.

-h hash | --hash hash

Add or remove the specified hash

-c file | --certificate file

Add or remove the specified certificate

-d | --dump

Produce a hex dump of the output

-A | --annotate

Annotate the hex dump produced by --dump

-o file | --outfile file

Write EFI Security Database to file

-L | --lis-guids

List the well known guids

The output is tab delimited: GUID short_name desription

EXAMPLES

Dumping the current system's DBX database with annotations

host:~$ efisecdb-d-A-i /sys/firmware/efi/efivars/db-d719b2c-3d3-459-a3b-dad00e67656f
00000000  26 16 c4 c1 4c 50 92 40  ac a9 41 f9 36 93 43 28  |&...LP.@..A.6.C(|  esl[0].signature_type = {sha256}
00000010  60 00 00 00                                       |....|              esl[0].signature_list_size = 96
00000014              00 00 00 00                               |....|          esl[0].signature_header_size = 0
00000018                           30 00 00 00                      |0...|      esl[0].signature_size = 48
0000001c                                                                        esl[0].signature_header (end:0x0000001c)
0000001c                                       bd 9a fa 77              |...w|  esl[0].signature[0].owner = {microsoft}
00000020  59 03 32 4d bd 60 28 f4  e7 8f 78 4b              |Y.2M.`(...xK|
0000002c                                       fe cf b2 32              |...2|  esl[0].signature[0].data (end:0x0000004c)
00000030  d1 2e 99 4b 6d 48 5d 2c  71 67 72 8a a5 52 59 84  |...KmH],qgr..RY.|
00000040  ad 5c a6 1e 75 16 22 1f  07 9a 14 36              |...u."....6|
0000004c                                       bd 9a fa 77              |...w|  esl[0].signature[1].owner = {microsoft}
00000050  59 03 32 4d bd 60 28 f4  e7 8f 78 4b              |Y.2M.`(...xK|
0000005c                                       fe 63 a8 4f              |.c.O|  esl[0].signature[1].data (end:0x0000007c)
00000060  78 2c c9 d3 fc f2 cc f9  fc 11 fb d0 37 60 87 87  |x,..........7`..|
00000070  58 d2 62 85 ed 12 66 9b  dc 6e 6d 01              |X.b...f..nm.|
0000007c

Building a new EFI Security Database for use as KEK, replacing one certificate.

# Figure out the original cert... the easy way
host:~$ strings KE-* | grep microsoft.*crt


Dhttp://www.microsoft.com/pki/certs/MicCorThiParMarRoo_201-1-05.crt0

# Find it, because-export isn't implemented yet
host:~$ wget 


       -use-agent='Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko' 


        http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_201-1-05.crt

http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_201-1-05.crt

-202-0-04 20:41:2-  http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_201-1-05.crt
Resolving www.microsoft.com (www.microsoft.com)... 2600:141b:800:287::356e, 2600:141b:800:2a0::356e, 23.43.254.254
Connecting to www.microsoft.com (www.microsoft.com)|2600:141b:800:287::356e|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1539 (1.5K) [application/octe-stream]
Saving to: [u2018]MicCorThiParMarRoo_201-1-05.crt[u2019]

MicCorThiParMarRoo_ 100%[===================>]   1.50K --KB/s    in 0s

202-0-04 20:41:27 (177 MB/s)- [u2018]MicCorThiParMarRoo_201-1-05.crt[u2019] saved [1539/1539]

# Pick a GUI-like object, any GUI-like object...
host:~$ uuidgen
aab3960-501-485-ac5-62805970a3dd

# Remove the old KEK entry and add a different one
host:~$ efisecdb-i KE-8be4df6-93c-11d-aa0-00e098032b8c 


       -g {microsoft}-r-c MicCorThiParMarRoo_201-1-05.crt 


       -g aab3960-501-485-ac5-62805970a3dd-a-c pjkek.cer 


       -o newkek.bin

Searching the list of wel-known GUIDs

host:~$ efisecdb-L | grep shim


{605dab5-e04-430-abb-3dd810dd8b23}  {shim}  shim

STANDARDS

SEE ALSO

AUTHORS

BUGS

*

positional exporting of certificates

*

--dump and --annotate do not adjust the output width for the terminal

*

certificates can't be specified for removal by their ToBeSigned hash

Index

NAME

SYNOPSIS

DESCRIPTION

OPTIONS

EXAMPLES

Dumping the current system's DBX database with annotations

Building a new EFI Security Database for use as KEK, replacing one certificate.

Searching the list of well-known GUIDs

STANDARDS

SEE ALSO

AUTHORS

BUGS