External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-12 12:55:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

conf: Enable secure-boot when enrolled-keys is enabled

Browse Source 
The latter doesn't make sense without the former, so make that
visible in the XML.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Andrea Bolognani 2022-06-15 10:36:42 +02:00
parent 9c7499ce54
commit 6cacfc751e
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/conf/domain_conf.c
View File

@ -4876,6 +4876,16 @@ virDomainDefPostParseMemory(virDomainDef *def,
static void
virDomainDefPostParseOs(virDomainDef *def)
{
if (def->os.firmwareFeatures &&
def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES) {
/* For all non-broken firmware builds, enrolled-keys implies
* secure-boot, and having the Secure Boot keys in the NVRAM file
* when the firmware doesn't support the Secure Boot feature doesn't
* make sense anyway. Reflect this fact explicitly in the XML */
def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] = VIR_TRISTATE_BOOL_YES;
}
if (!def->os.loader)
return;

1
tests/qemuxml2xmloutdata/firmware-auto-efi-enrolled-keys.x86_64-latest.xml
View File

@ -8,6 +8,7 @@
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
<firmware>
<feature enabled='yes' name='enrolled-keys'/>
<feature enabled='yes' name='secure-boot'/>
</firmware>
<boot dev='hd'/>
</os>