Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

jloeser · 2023-04-13T07:33:23Z

This adds a section about new SecureBoot support. It only works in combination with the following patchset:

theforeman/foreman#9864
theforeman/smart-proxy#877

RFC: https://community.theforeman.org/t/add-secureboot-support-for-arbitrary-distributions/32601/1

github-actions · 2023-04-13T07:39:58Z

The PR preview for ab8d56e is available at theforeman-foreman-documentation-preview-pr-2145.surge.sh

The following output files are affected by this PR:

show diff

show diff as HTML

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb · 2023-11-02T13:47:55Z

Converted to draft PR for now because the linked PRs in foreman and smart_proxy have not been merged yet.

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb

Some open questions for Goars or Jan.

@apinnick Do you ACK the capitalization of "Secure Boot"? And should it be "Secure Boot-enabled hosts" or "hosts with Secure Boot enabled"?

Rest LGTM from a writers perspective.

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

apinnick · 2024-02-07T11:56:27Z

@apinnick Do you ACK the capitalization of "Secure Boot"? And should it be "Secure Boot-enabled hosts" or "hosts with Secure Boot enabled"?

@maximiliankolb I prefer "UEFI Secure Boot" because it is a UEFI security feature but I have no objection to "Secure Boot".

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc

goarsna · 2024-03-12T14:51:23Z

Hi there,
after discussions with @lzap and others on the community thread, we changed the implementation to a new approach, that extends the existing Grub2 UEFI SecureBoot and Grub2 UEFI HTTPS SecureBoot PXE loaders to support Secure Boot for arbitrary operating systems. With that, I also had to rework the documentation, so another round of review is needed...

For reference as the PRs mentioned in the first post in this PR are not valid anymore:
The PRs this documentation PR belongs to are

Fixes #36834 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders foreman#9864
Fixes #36833 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders smart-proxy#877
Fixes #36940 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders puppet-foreman_proxy#821

Thanks for all your reviews and input!

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

ekohl · 2024-07-11T10:05:36Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+ifeval::["{client-os}" == "Debian"]
+* Ensure that `ar` and `xz` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-os}" == "Ubuntu"]
+* Ensure that `ar`, `xz`, and `zstd` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-pkg-ext}" == "rpm"]
+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]


Why don't we make these packaging dependencies if they're required?

At the time of packaging/installing Smart Proxy, you don't know yet which Client OS you want to provision/manage with Foreman.

ekohl · 2024-07-11T10:07:38Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]
+
+.Procedure


If this is all common, why don't we ship a helper script that takes several inputs and saves it to the correct places? That makes both the procedure and testing easier. We can also ensure all commands we use are properly ensured via packaging dependencies.

There's precedent for this: https://github.com/theforeman/smart-proxy/blob/develop/sbin/foreman-prepare-realm is installed (here for RPM). Then the documentation refers to this:

foreman-documentation/guides/common/modules/con_configuring-project-to-manage-the-lifecycle-of-a-host-registered-to-a-freeipa-realm.adoc

Lines 29 to 33 in 3259af8

. Create a realm proxy user, `realm-{smart-proxy-context}`, and the relevant roles in {FreeIPA}:

+

[options="nowrap", subs="+quotes,verbatim,attributes"]

----

# foreman-prepare-realm admin realm-{smart-proxy-context}

This is a great idea; I will try and investigate. It's not trivial to get the correct RPM/DEB package and extract the right binary. Two examples from orcharhino docs: Setup Secure Boot for SLES & Setup Secure Boot for Debian. From a user perspective, it would be very handy.

For now, I think docs are the way to go. I will ping you once I have a draft PR in smart-proxy.

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb

Rebased to "master".

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb · 2024-07-16T14:17:12Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+ifeval::["{client-os}" == "Debian"]
+* Ensure that `ar` and `xz` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-os}" == "Ubuntu"]
+* Ensure that `ar`, `xz`, and `zstd` are installed on your {SmartProxy}.
+endif::[]
+ifeval::["{client-pkg-ext}" == "rpm"]
+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]


At the time of packaging/installing Smart Proxy, you don't know yet which Client OS you want to provision/manage with Foreman.

maximiliankolb · 2024-07-16T14:46:15Z

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

+* Ensure that `cpio` is installed on your {SmartProxy}.
+endif::[]
+
+.Procedure


This is a great idea; I will try and investigate. It's not trivial to get the correct RPM/DEB package and extract the right binary. Two examples from orcharhino docs: Setup Secure Boot for SLES & Setup Secure Boot for Debian. From a user perspective, it would be very handy.

For now, I think docs are the way to go. I will ping you once I have a draft PR in smart-proxy.

goarsna · 2024-07-16T21:14:52Z

FYI: @nofaralfasi and I had a discussion last week that resulted in some changes we want to implement on the Smart Proxy side which are summarized in the Smart Proxy PR. These changes also will affect this PR. Further updates will follow soonish / in the upcoming weeks (as soon as I have time to work on this again).

apinnick · 2024-07-17T09:17:07Z

guides/common/modules/con_using-pxe-to-provision-hosts.adoc

-Use SecureBoot options to enable a client to download the `shim.efi` bootstrap bootloader that then loads the signed `grubx64.efi`.
-Other PXE loaders like PXELinux UEFI, Grub2 ELF or iPXE Chain, require additional configuration. These workflows are not documented at the moment.
+For BIOS systems, select the *PXELinux BIOS* option to enable a provisioned node to download the `pxelinux.0` file over TFTP.
+For UEFI systems, select the *Grub2 UEFI* option to enable a TFTP client to download `grubx64.efi` file, or select the *Grub2 UEFI HTTP* option to enable an UEFI HTTP client to download `grubx64.efi` with the HTTP Boot feature.


This is outside the scope of this PR. Just FYI.

GRUB is an acronym. The UI labels should be "GRUB2 ..."

ekohl · 2024-07-24T13:46:20Z

Per the last comment, I'm moving this back to draft.

goarsna · 2024-09-09T14:17:50Z

Rebased

goarsna · 2024-09-10T13:21:23Z

I updated the PR to reflect the discussed changes. Thanks @maximiliankolb for marking it as ready.

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

Lennonka

A couple of nitpicks.

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

maximiliankolb

one tiny suggestion, rest LGTM. Thanks for the patience.

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc

Lennonka · 2024-11-22T22:06:53Z

One more thing. I think it would be better to include these under Configuring provisioning resources rather than Using PXE. Would you considering moving them there?

On one hand, I think it belongs to configuring resources before the user starts using them. Also, I'm planning splitting Provisioning hosts into 3 guides and a couple of improvements for all 3 new provisioning guides.
On the other hand, I'm not entirely sure. AFAIK, SB is only supported in PXE and UEFI HTTP boot, not in Discovery or boot disk, so from this perspective, this place also looks right.

Affects "Grub2 UEFI" PXE loaders * PR in foreman: theforeman/foreman#9864 * PR in smart-proxy: theforeman/smart-proxy#877 * RFC: https://community.theforeman.org/t/add-secureboot-support-for-arbitrary-distributions/32601/1

goarsna · 2024-11-28T15:02:38Z

Hey @Lennonka, I would vote for leaving it under "Using PXE...".
As you said in your last sentence, it is only supported in PXE and UEFI HTTP boot and also there the configuration only has to be done in case one wants to use Secure Boot. Putting it under "Configuring Provisioning Resources" could connote that it is a general feature or it is a essential configuration step.

jloeser force-pushed the secureboot-support-poc branch 2 times, most recently from 7be85e5 to 419b2a7 Compare August 25, 2023 12:37

goarsna force-pushed the secureboot-support-poc branch from 419b2a7 to c297863 Compare September 5, 2023 06:43

goarsna reviewed Sep 5, 2023

View reviewed changes

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

maximiliankolb requested changes Sep 5, 2023

View reviewed changes

goarsna reviewed Sep 7, 2023

View reviewed changes

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

This was referenced Oct 17, 2023

Fixes #36834 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders theforeman/foreman#9864

Merged

Fixes #36833 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders theforeman/smart-proxy#877

Merged

jloeser marked this pull request as ready for review October 17, 2023 13:24

maximiliankolb marked this pull request as draft November 2, 2023 13:47

goarsna mentioned this pull request Dec 4, 2023

Fixes #36940 - Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders theforeman/puppet-foreman_proxy#821

Merged

maximiliankolb requested changes Dec 7, 2023

View reviewed changes

pr-processor bot added the Waiting on contributor Requires an action from the author label Dec 7, 2023

pr-processor bot added Needs re-review and removed Waiting on contributor Requires an action from the author labels Jan 25, 2024

maximiliankolb marked this pull request as ready for review February 7, 2024 10:06

maximiliankolb requested changes Feb 7, 2024

View reviewed changes

pr-processor bot added Waiting on contributor Requires an action from the author and removed Needs re-review labels Feb 7, 2024

apinnick reviewed Feb 7, 2024

View reviewed changes

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

apinnick reviewed Feb 7, 2024

View reviewed changes

guides/common/modules/con_using-pxe-to-provision-hosts.adoc Outdated Show resolved Hide resolved

apinnick reviewed Feb 7, 2024

View reviewed changes

guides/common/modules/proc_configuring-server-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

pr-processor bot added Needs re-review and removed Waiting on contributor Requires an action from the author labels Feb 8, 2024

maximiliankolb changed the title ~~New PXE loader "Grub2 UEFI SecureBoot (target OS)"~~ Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders Mar 11, 2024

goarsna force-pushed the secureboot-support-poc branch from 7aca375 to 63efbf5 Compare March 12, 2024 14:37

nofaralfasi reviewed Apr 3, 2024

View reviewed changes

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Show resolved Hide resolved

ekohl requested changes Jul 11, 2024

View reviewed changes

pr-processor bot added the Waiting on contributor Requires an action from the author label Jul 11, 2024

maximiliankolb force-pushed the secureboot-support-poc branch from 6aae85a to 429b413 Compare July 16, 2024 15:02

pr-processor bot added Needs re-review and removed Waiting on contributor Requires an action from the author labels Jul 16, 2024

maximiliankolb reviewed Jul 16, 2024

View reviewed changes

maximiliankolb force-pushed the secureboot-support-poc branch from 429b413 to 96d95e9 Compare July 17, 2024 07:17

apinnick reviewed Jul 17, 2024

View reviewed changes

ekohl marked this pull request as draft July 24, 2024 13:45

goarsna force-pushed the secureboot-support-poc branch from 96d95e9 to f6c2951 Compare September 9, 2024 14:15

goarsna force-pushed the secureboot-support-poc branch from f6c2951 to 83ed4dc Compare September 9, 2024 14:35

maximiliankolb marked this pull request as ready for review September 10, 2024 13:20

goarsna reviewed Sep 10, 2024

View reviewed changes

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

pr-processor bot removed the Needs re-review label Sep 10, 2024

goarsna force-pushed the secureboot-support-poc branch from 83ed4dc to a71639b Compare September 12, 2024 07:09

Lennonka reviewed Sep 16, 2024

View reviewed changes

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Show resolved Hide resolved

Lennonka approved these changes Nov 18, 2024

View reviewed changes

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

goarsna force-pushed the secureboot-support-poc branch from a71639b to 1f29aba Compare November 20, 2024 14:05

maximiliankolb approved these changes Nov 21, 2024

View reviewed changes

guides/common/modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc Outdated Show resolved Hide resolved

maximiliankolb added style review done No issues from docs style/grammar perspective and removed Waiting for code Requires merge of related code in another repository before it can be merged labels Nov 21, 2024

Add Secure Boot support for arbitrary Client OS

ab8d56e

Affects "Grub2 UEFI" PXE loaders * PR in foreman: theforeman/foreman#9864 * PR in smart-proxy: theforeman/smart-proxy#877 * RFC: https://community.theforeman.org/t/add-secureboot-support-for-arbitrary-distributions/32601/1

goarsna force-pushed the secureboot-support-poc branch from 1f29aba to ab8d56e Compare November 28, 2024 14:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

jloeser commented Apr 13, 2023 •

edited by maximiliankolb

Loading

github-actions bot commented Apr 13, 2023 •

edited

Loading

maximiliankolb commented Nov 2, 2023

maximiliankolb left a comment

apinnick commented Feb 7, 2024

goarsna commented Mar 12, 2024

ekohl Jul 11, 2024

maximiliankolb Jul 16, 2024

ekohl Jul 11, 2024

maximiliankolb Jul 16, 2024

maximiliankolb left a comment

maximiliankolb Jul 16, 2024

maximiliankolb Jul 16, 2024

goarsna commented Jul 16, 2024

apinnick Jul 17, 2024

ekohl commented Jul 24, 2024

goarsna commented Sep 9, 2024

goarsna commented Sep 10, 2024

Lennonka left a comment

maximiliankolb left a comment

Lennonka commented Nov 22, 2024 •

edited

Loading

goarsna commented Nov 28, 2024

	. Create a realm proxy user, `realm-{smart-proxy-context}`, and the relevant roles in {FreeIPA}:
	+
	[options="nowrap", subs="+quotes,verbatim,attributes"]
	----
	# foreman-prepare-realm admin realm-{smart-proxy-context}

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

Are you sure you want to change the base?

Add SecureBoot support for arbitrary operating systems to "Grub2 UEFI" PXE loaders #2145

Conversation

jloeser commented Apr 13, 2023 • edited by maximiliankolb Loading

github-actions bot commented Apr 13, 2023 • edited Loading

maximiliankolb commented Nov 2, 2023

maximiliankolb left a comment

Choose a reason for hiding this comment

apinnick commented Feb 7, 2024

goarsna commented Mar 12, 2024

ekohl Jul 11, 2024

Choose a reason for hiding this comment

maximiliankolb Jul 16, 2024

Choose a reason for hiding this comment

ekohl Jul 11, 2024

Choose a reason for hiding this comment

maximiliankolb Jul 16, 2024

Choose a reason for hiding this comment

maximiliankolb left a comment

Choose a reason for hiding this comment

maximiliankolb Jul 16, 2024

Choose a reason for hiding this comment

maximiliankolb Jul 16, 2024

Choose a reason for hiding this comment

goarsna commented Jul 16, 2024

apinnick Jul 17, 2024

Choose a reason for hiding this comment

ekohl commented Jul 24, 2024

goarsna commented Sep 9, 2024

goarsna commented Sep 10, 2024

Lennonka left a comment

Choose a reason for hiding this comment

maximiliankolb left a comment

Choose a reason for hiding this comment

Lennonka commented Nov 22, 2024 • edited Loading

goarsna commented Nov 28, 2024

jloeser commented Apr 13, 2023 •

edited by maximiliankolb

Loading

github-actions bot commented Apr 13, 2023 •

edited

Loading

Lennonka commented Nov 22, 2024 •

edited

Loading