How to install keys for Secure Boot on ThinkPad X1 3rd gen?

nagmat84 · Apprentice Joined: 27 Mar 2007 Posts: 271

I want to enable Secure Boot on a ThinkPad X1 Carbon 3rd gen., but no matter what I do, I always hit a dead-end. I have already setup Secure Boot on two other laptops (which had a more modern UEFI firmware) and I am starting to believe that I might have found a bug in the firmware which actually makes it impossible to install custom signature keys into the NVRAM. I am still hoping that someone has managed to do it and could share the trick.

Model, firmware and version:

Laptop manufacturer: Lenovo
Laptop type: ThinkPad X1 Carbon, 3rd gen., 20BTS08N00
FW manufacturer: Phoenix
FW type: SecureCore for ThinkPad
FW version: 1.34, N14ET56W, 2021-08-31 (latest available version)

Basically, I want to follow the following steps:

Create my own PK, KEK(s) and DBK(s)
Sign refind.efi (my boot manager), kernels and kernel modules
Extract the original OEM keys from the laptop firmware
Merge the extracted OEM keys and my own keys into a combined key list
Install the combined key list into the NVRAM

Step 1 and 2 are no problem. I have already done that before. I have binary packages ready on my own build server. Likewise, step 4 shouldn't be a problem either if I ever get beyond step 3. Step 3 and 5 are posing problems. However, I might be able to workaround step 3 using another distro than Gentoo.

The laptop firmware supports three settings with two options each.

"Secure Boot" can be enabled or disabled.
If Secure Boot is disabled, the EFI variables PK, KEK, db and dbx are not available at all. So Secure Boot must be enabled.
"Platform Mode" can be "Setup Mode" or "User Mode"
If the Platform Mode is in Setup Mode, the EFI variables PK, KEK, db and dbx are writable and signature verification is not enforced. In that mode, the FW also allows to boot an unsigned EFI binary. In "User Mode", the EFI variables PK, KEK, db and dbx are read-only. Signature verification is enforced.
"Secure Boot Mode" can be "Standard Mode" or "Custom Mode"
This setting is rather implicit. "Standard Mode" means that the default key lists are in place. "Custom Mode" means that the key lists are not the default lists which are shipped with the firmware.

However, I cannot toggle the Platform Mode directly, but only implicitly via three different actions:

Restore Factory Keys
This action puts the Platform Mode into User Mode, but also restores the default lists for PK, KEK, db and dbx. After that signature verification is enforced, but also any custom signature key is lost.
Reset to Setup Mode
This action puts the Platform Mode into Setup Mode, but also erases the lists PK, KEK, db and dbx. After that signature verification is disabled, but there is also no key left (even the OEMs keys are erased).
Clear All Secure Boot Keys
Seems to have the same effect as "Reset To Setup Mode".

Now, for the problem in step #3. In order to be able to extract the OEM keys, I must boot the laptop in Platform Mode "User Mode". This means I need an EFI kernel signed with one of the default Microsoft keys. The UEFI FW does not seem to allow booting an unsigned EFI kernel (with signature verification disabled), but with the keys still being in place for extraction. I downloaded Gentoo minimal installation image and the Gentoo Live image. None of them seems to support a signed EFI kernel. I haven't tried another distro (i.e. Ubuntu) yet. I assume that Ubuntu offers a Ubuntu Live Image with signed EFI kernels. But I am wondering if there is a "Gentoo way" to do it.

Now for the problem in step #5. This is actually the more severe problem. After I had put the Platform Mode into "Setup Mode" I was able to install my own key lists into the empty EFI variables. Now, I somehow need to switch the Platform mode back into "User Mode". Initially, I expected that to happen automatically upon the next boot, when the UEFI firmware recognizes that the key lists are not empty anymore. However, the FW remains in "Setup Mode" and signature verification remains disabled. (I was able to verify that by booting an unsigned EFI binary). The only way to switch back to "User Mode" seems to be via the action "Restore Factory Keys". However, this overwrites my custom key lists with the default ones. (I was able to verify that because I was only able to boot Windows, everything else failed with a "signature violation" from the FW). At this point I am lost in a dead-end. It looks like a vicious circle. This leads to my question: How do I install my custom key lists in Setup Mode and then switch back to User Mode in order to enforce signature verification without loosing my custom key lists?

In case it helps:

pietinger · Posted: Thu May 02, 2024 1:53 pm Post subject:

As far as I understand you will need:

Secure Boot + Platform Mode -> "Setup Mode" + Secure Boot Mode -> "Standard Mode"

Are you now able to boot with an unsigned kernel AND then read the keys with:

GDH-gentoo · Posted: Thu May 02, 2024 2:23 pm Post subject:

With respect to #5, this document from Lenovo says that you need to use "Restore Factory Keys" indeed to change the Platform Mode back to User Mode.

This other document suggests that firmware keys should be modified setting "Secure Boot Customization" to "Custom". And, since it is not mentioned, leaving "Platform Mode" alone I presume. There's even a Key Management menu, apparently.

With respect to #3, firmware keys are stored in EFI variables, and if I understand correctly, you can just disable Secure Boot, and once you have booted (nonsecurely), there are programs that can retrieve firmware keys by accessing the efivarfs filesystem.

Disclaimer: I don't use Secure Boot, and, because of the appalling number of bad implementations of the UEFI specification that one finds in the wild, if I did want to use Secure Boot for booting GNU/Linux, I'd use the Shim and Machine Owner Keys (MOKs).
_________________

nagmat84 · Apprentice Joined: 27 Mar 2007 Posts: 271

sMueggli · Guru Joined: 03 Sep 2022 Posts: 496

Can't you download the OEM keys from the Internet? They are public keys and I am pretty sure that Microsoft has published them. Maybe the other vendor keys are also published.

And why do you "need" the OEM keys? If you are setting up your own keys, why do you need OEM keys?

GDH-gentoo · Posted: Thu May 02, 2024 3:24 pm Post subject:

nagmat84 · Apprentice Joined: 27 Mar 2007 Posts: 271

GDH-gentoo · Posted: Thu May 02, 2024 3:43 pm Post subject:

nagmat84 · Apprentice Joined: 27 Mar 2007 Posts: 271

GDH-gentoo · Posted: Thu May 02, 2024 5:12 pm Post subject:

Nowa · Posted: Fri May 03, 2024 9:43 am Post subject:

nagmat84 · Apprentice Joined: 27 Mar 2007 Posts: 271

I finally got it to work. However, I do not know why; more precisely, I do not know what I did different this time.

I put the UEFI FW into "Setup Mode"+"Custom Mode" via the action "Reset to Setup Mode"
I installed my self-signed PK key via efi-updatevar -f custom_pk.auth PK; this immediately disabled "Setup Mode" and let the FW switch to "User Mode"
Upon next boot, the UEFI FW was in "User Mode" + "Custom Mode"

The automatic transition from "Setup Mode" to "User Mode" was what I did expect in the first place. I don't know why it happened this time as expected and why it had not been happened before during the previous unsuccessful attempts.