[pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment

[pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment

[Fiona Ebner]

Make it possible to enroll via the API and UI by setting the
ms-cert=2023 marker on the EFI disk.

The previous Microsoft UEFI CA 2011 will expire in June 2026, so there
should be a way to update that can be automated and done while guests
are running.

pve-manager needs a dependency bump for qemu-server for the API call
to have the desired effect (or the marker will just get set without
actually enrolling).

qemu-server:

Fiona Ebner (4):
  qm enroll-efi-keys: do not remove EFI disk when config was modified
    during operation
  ovmf: enroll ms 2023 cert: pass along parsed drive
  config: apply pending: code style: avoid some line bloat
  config: apply pending: efi: enroll Microsoft UEFI CA 2023 when setting
    ms-cert=2023 option

 src/PVE/CLI/qm.pm          | 19 ++++++-------------
 src/PVE/QemuServer.pm      | 20 +++++++++++++-------
 src/PVE/QemuServer/OVMF.pm | 27 ++++++++++++++++++++-------
 3 files changed, 39 insertions(+), 27 deletions(-)


manager:

Fiona Ebner (2):
  ui: qemu: hd efi: fix typo in warning
  ui: qemu: hardware: efi: allow enrolling Microsoft UEFI CA 2023

 www/manager6/qemu/HDEfi.js        |  2 +-
 www/manager6/qemu/HardwareView.js | 78 +++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+), 1 deletion(-)


Summary over all repositories:
  5 files changed, 118 insertions(+), 28 deletions(-)

-- 
Generated by git-murpp 0.5.0


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH qemu-server 1/6] qm enroll-efi-keys: do not remove EFI disk when config was modified during operation

[Fiona Ebner]

The EFI disk is already pre-existing and should not be removed in case
the VM configuration was modified during the enrollment operation.
It's not critical if the new certs are enrolled but the marker is not
written to the configuration. Worst case, the operation is just done
again, where virt-fw-vars will just skip enrollment after detecting
that the new certs are already on the disk.

Fixes: 95eb95c3 ("qm enroll-efi-keys: move potential blocking operation out of lock")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/CLI/qm.pm | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm
index 60fe318e..ca57409f 100755
--- a/src/PVE/CLI/qm.pm
+++ b/src/PVE/CLI/qm.pm
@@ -744,14 +744,7 @@ __PACKAGE__->register_method({
                 my $locked_conf = PVE::QemuConfig->load_config($vmid);
 
                 eval { PVE::Tools::assert_if_modified($conf->{digest}, $locked_conf->{digest}) };
-                if (my $err = $@) {
-                    eval {
-                        my $drive = PVE::QemuServer::Drive::parse_drive('efidisk0', $updated);
-                        PVE::Storage::vdisk_free($storecfg, $drive->{file});
-                    };
-                    warn "failed to clean-up prepared efidisk volume - $@" if $@;
-                    die "VM ${vmid}: $err";
-                }
+                die "VM ${vmid}: $@" if $@;
 
                 $locked_conf->{efidisk0} = $updated;
                 PVE::QemuConfig->write_config($vmid, $locked_conf);
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH qemu-server 2/6] ovmf: enroll ms 2023 cert: pass along parsed drive

[Fiona Ebner]

This makes the following changes easier.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/CLI/qm.pm          | 10 +++++-----
 src/PVE/QemuServer.pm      |  3 ++-
 src/PVE/QemuServer/OVMF.pm | 11 ++++-------
 3 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm
index ca57409f..adf90f3c 100755
--- a/src/PVE/CLI/qm.pm
+++ b/src/PVE/CLI/qm.pm
@@ -30,7 +30,7 @@ use PVE::Tools qw(extract_param file_get_contents);
 use PVE::API2::Qemu::Agent;
 use PVE::API2::Qemu;
 use PVE::QemuConfig;
-use PVE::QemuServer::Drive qw(is_valid_drivename);
+use PVE::QemuServer::Drive qw(is_valid_drivename parse_drive print_drive);
 use PVE::QemuServer::Helpers;
 use PVE::QemuServer::Agent;
 use PVE::QemuServer::ImportDisk;
@@ -729,9 +729,9 @@ __PACKAGE__->register_method({
 
         my $storecfg = PVE::Storage::config();
 
-        my $updated = PVE::QemuServer::OVMF::ensure_ms_2023_cert_enrolled(
-            $storecfg, $vmid, $conf->{efidisk0},
-        );
+        my $efidisk = parse_drive('efidisk0', $conf->{efidisk0});
+        my $updated =
+            PVE::QemuServer::OVMF::ensure_ms_2023_cert_enrolled($storecfg, $vmid, $efidisk);
 
         if (!$updated) {
             print "skipping - no pre-enrolled keys or already got ms-cert=2023 marker\n";
@@ -746,7 +746,7 @@ __PACKAGE__->register_method({
                 eval { PVE::Tools::assert_if_modified($conf->{digest}, $locked_conf->{digest}) };
                 die "VM ${vmid}: $@" if $@;
 
-                $locked_conf->{efidisk0} = $updated;
+                $locked_conf->{efidisk0} = print_drive($updated);
                 PVE::QemuConfig->write_config($vmid, $locked_conf);
                 print "successfully updated efidisk\n";
             },
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index d634251b..86f1347c 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -5424,7 +5424,8 @@ my sub check_efi_vars {
     return if !$conf->{ostype};
     return if $conf->{ostype} ne 'win10' && $conf->{ostype} ne 'win11';
 
-    if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($conf->{efidisk0})) {
+    my $efidisk = parse_drive('efidisk0', $conf->{efidisk0});
+    if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($efidisk)) {
         # TODO: make the first print a log_warn with PVE 9.2 to make it more noticeable!
         print "EFI disk without 'ms-cert=2023' option, suggesting that the Microsoft UEFI 2023"
             . " certificate is not enrolled yet. The UEFI 2011 certificate expires in June 2026!\n";
diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index e5f4cf02..4aa98100 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -279,9 +279,8 @@ sub print_ovmf_commandline {
 }
 
 sub should_enroll_ms_2023_cert {
-    my ($efidisk_str) = @_;
+    my ($efidisk) = @_;
 
-    my $efidisk = parse_drive('efidisk0', $efidisk_str);
     return if !$efidisk->{'pre-enrolled-keys'};
     return if $efidisk->{'ms-cert'} && $efidisk->{'ms-cert'} eq '2023';
 
@@ -289,11 +288,9 @@ sub should_enroll_ms_2023_cert {
 }
 
 sub ensure_ms_2023_cert_enrolled {
-    my ($storecfg, $vmid, $efidisk_str) = @_;
+    my ($storecfg, $vmid, $efidisk) = @_;
 
-    return if !should_enroll_ms_2023_cert($efidisk_str);
-
-    my $efidisk = parse_drive('efidisk0', $efidisk_str);
+    return if !should_enroll_ms_2023_cert($efidisk);
 
     print "efidisk0: enrolling Microsoft UEFI CA 2023\n";
 
@@ -317,7 +314,7 @@ sub ensure_ms_2023_cert_enrolled {
     die "efidisk0: enrolling Microsoft UEFI CA 2023 failed - $err" if $err;
 
     $efidisk->{'ms-cert'} = '2023';
-    return print_drive($efidisk);
+    return $efidisk;
 }
 
 1;
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH qemu-server 3/6] config: apply pending: code style: avoid some line bloat

[Fiona Ebner]

Also in preparation to re-use the parsed drive.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/QemuServer.pm | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 86f1347c..dfa74c4b 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -4986,12 +4986,8 @@ sub vmconfig_apply_pending {
         next if $opt eq 'delete'; # just to be sure
         eval {
             if (defined($conf->{$opt}) && is_valid_drivename($opt)) {
-                vmconfig_register_unused_drive(
-                    $storecfg,
-                    $vmid,
-                    $conf,
-                    parse_drive($opt, $conf->{$opt}),
-                );
+                my $old_drive = parse_drive($opt, $conf->{$opt});
+                vmconfig_register_unused_drive($storecfg, $vmid, $conf, $old_drive);
             } elsif (defined($conf->{pending}->{$opt}) && $opt =~ m/^net\d+$/) {
                 my $new_net = PVE::QemuServer::Network::parse_net($conf->{pending}->{$opt});
                 if ($conf->{$opt}) {
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH qemu-server 4/6] config: apply pending: efi: enroll Microsoft UEFI CA 2023 when setting ms-cert=2023 option

[Fiona Ebner]

Like this, the 'qm enroll-efi-keys' operation can be done via API too.

The previous Microsoft UEFI CA 2011 will expire in June 2026, so there
should be a way to update that can be automated and done while guests
are running.

Suggested-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/QemuServer.pm      |  9 +++++++++
 src/PVE/QemuServer/OVMF.pm | 16 ++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index dfa74c4b..6492d706 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -4988,6 +4988,15 @@ sub vmconfig_apply_pending {
             if (defined($conf->{$opt}) && is_valid_drivename($opt)) {
                 my $old_drive = parse_drive($opt, $conf->{$opt});
                 vmconfig_register_unused_drive($storecfg, $vmid, $conf, $old_drive);
+                if ($opt eq 'efidisk0') {
+                    my $new_drive = parse_drive($opt, $conf->{pending}->{$opt});
+                    PVE::QemuServer::OVMF::drive_change(
+                        $storecfg,
+                        $vmid,
+                        $old_drive,
+                        $new_drive,
+                    );
+                }
             } elsif (defined($conf->{pending}->{$opt}) && $opt =~ m/^net\d+$/) {
                 my $new_net = PVE::QemuServer::Network::parse_net($conf->{pending}->{$opt});
                 if ($conf->{$opt}) {
diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index 4aa98100..58415899 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -317,4 +317,20 @@ sub ensure_ms_2023_cert_enrolled {
     return $efidisk;
 }
 
+sub drive_change {
+    my ($storecfg, $vmid, $old_drive, $new_drive) = @_;
+
+    return if $old_drive->{file} ne $new_drive->{file};
+
+    # Note that changing away from ms-cert=2023 is allowed, the marker is not the source of truth.
+    return if $old_drive->{'ms-cert'} && $old_drive->{'ms-cert'} eq '2023';
+
+    return if !$new_drive->{'ms-cert'} || $new_drive->{'ms-cert'} ne '2023';
+
+    # The ms-cert marker was newly changed to 2023, ensure it's enrolled. Clear it first to avoid
+    # detecting as already enrolled.
+    delete $new_drive->{'ms-cert'};
+    ensure_ms_2023_cert_enrolled($storecfg, $vmid, $new_drive);
+}
+
 1;
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH manager 5/6] ui: qemu: hd efi: fix typo in warning

[Fiona Ebner]

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 www/manager6/qemu/HDEfi.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/www/manager6/qemu/HDEfi.js b/www/manager6/qemu/HDEfi.js
index 6371ebe4..1ae63add 100644
--- a/www/manager6/qemu/HDEfi.js
+++ b/www/manager6/qemu/HDEfi.js
@@ -80,7 +80,7 @@ Ext.define('PVE.qemu.EFIDiskInputPanel', {
             },
             {
                 xtype: 'label',
-                text: gettext("Warning: The VM currently does not uses 'OVMF (UEFI)' as BIOS."),
+                text: gettext("Warning: The VM currently does not use 'OVMF (UEFI)' as BIOS."),
                 userCls: 'pmx-hint',
                 hidden: me.usesEFI,
             },
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH manager 6/6] ui: qemu: hardware: efi: allow enrolling Microsoft UEFI CA 2023

[Fiona Ebner]

When the following conditions are met:
- no pending change on the EFI disk
- OS type Windows 10 or 11
- EFI disk has pre-enrolled-keys
- There is no ms-cert=2023 marker yet
suggest enrolling the new Microsoft UEFI CA 2023.

The previous Microsoft UEFI CA 2011 will expire in June 2026, so there
needs to be an easy way to update.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 www/manager6/qemu/HardwareView.js | 78 +++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/www/manager6/qemu/HardwareView.js b/www/manager6/qemu/HardwareView.js
index cf5e2a0f..3025da74 100644
--- a/www/manager6/qemu/HardwareView.js
+++ b/www/manager6/qemu/HardwareView.js
@@ -442,6 +442,63 @@ Ext.define('PVE.qemu.HardwareView', {
             handler: run_editor,
         });
 
+        let runEfiEnroll = function () {
+            let rec = sm.getSelection()[0];
+            if (!rec) {
+                return;
+            }
+
+            let efidisk = PVE.Parser.parsePropertyString(rec.data.value, 'file');
+            efidisk['ms-cert'] = '2023';
+
+            let params = {};
+            params[rec.data.key] = PVE.Parser.printPropertyString(efidisk);
+            Proxmox.Utils.API2Request({
+                url: `/api2/extjs/${baseurl}`,
+                waitMsgTarget: me,
+                method: 'POST',
+                params: params,
+                callback: () => me.reload(),
+                failure: (response) => Ext.Msg.alert('Error', response.htmlStatus),
+                success: function (response, options) {
+                    if (response.result.data !== null) {
+                        Ext.create('Proxmox.window.TaskProgress', {
+                            autoShow: true,
+                            upid: response.result.data,
+                            listeners: {
+                                destroy: () => me.reload(),
+                            },
+                        });
+                    }
+                },
+            });
+        };
+
+        let efiEnrollButton = new Proxmox.button.Button({
+            text: gettext('Enroll MS 2023 Cert'),
+            selModel: sm,
+            disabled: true,
+            hidden: true,
+            handler: runEfiEnroll,
+            confirmMsg:
+                gettext(
+                    'If the VM uses BitLocker, run the following command inside Windows Powershell:',
+                ) +
+                '<br><code>manage-bde -protectors -disable &lt;drive&gt;</code><br>' +
+                Ext.String.format(
+                    // TRANSLATORS: for a shell command: "placeholder could be 'concrete value'"
+                    gettext("For example, {0} could be '{1}'."),
+                    '<code>&lt;drive&gt;</code>',
+                    '<code>C:</code>',
+                ) +
+                '<br>' +
+                gettext('This is required for each drive with BitLocker before proceeding!') +
+                '<br>' +
+                gettext(
+                    'Otherwise, you will be prompted for the BitLocker recovery key on the next boot!',
+                ),
+        });
+
         let move_menuitem = new Ext.menu.Item({
             text: gettext('Move Storage'),
             tooltip: gettext('Move disk to another storage'),
@@ -616,6 +673,8 @@ Ext.define('PVE.qemu.HardwareView', {
             let selection_model = me.getSelectionModel();
             let rec = selection_model.getSelection()[0];
 
+            let isWin10or11 = false;
+
             counts = {}; // en/disable hardwarebuttons
             let hasCloudInit = false;
             me.rstore.getData().items.forEach(function ({ id, data }) {
@@ -629,6 +688,10 @@ Ext.define('PVE.qemu.HardwareView', {
                     let type = match[1];
                     counts[type] = (counts[type] || 0) + 1;
                 }
+
+                if (id === 'ostype' && (data.value === 'win10' || data.value === 'win11')) {
+                    isWin10or11 = true;
+                }
             });
 
             // heuristic only for disabling some stuff, the backend has the final word.
@@ -655,6 +718,7 @@ Ext.define('PVE.qemu.HardwareView', {
             if (!rec) {
                 remove_btn.disable();
                 edit_btn.disable();
+                efiEnrollButton.disable();
                 diskaction_btn.disable();
                 revert_btn.disable();
                 return;
@@ -686,6 +750,16 @@ Ext.define('PVE.qemu.HardwareView', {
             );
             remove_btn.RESTMethod = isUnusedDisk || (isDisk && isRunning) ? 'POST' : 'PUT';
 
+            let suggestEfiEnroll = false;
+            if (isEfi) {
+                let drive = PVE.Parser.parsePropertyString(value, 'file');
+                suggestEfiEnroll =
+                    !pending &&
+                    isWin10or11 &&
+                    PVE.Parser.parseBoolean(drive['pre-enrolled-keys'], false) &&
+                    drive['ms-cert'] !== '2023';
+            }
+
             edit_btn.setDisabled(
                 deleted ||
                     !row.editor ||
@@ -694,6 +768,9 @@ Ext.define('PVE.qemu.HardwareView', {
                     (isDisk && !diskCap),
             );
 
+            efiEnrollButton.setDisabled(!suggestEfiEnroll);
+            efiEnrollButton.setHidden(!suggestEfiEnroll);
+
             diskaction_btn.setDisabled(
                 pending || !diskCap || isCloudInit || !(isDisk || isEfi || tpmMoveable),
             );
@@ -822,6 +899,7 @@ Ext.define('PVE.qemu.HardwareView', {
                 },
                 remove_btn,
                 edit_btn,
+                efiEnrollButton,
                 diskaction_btn,
                 revert_btn,
             ],
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment

[Fiona Ebner]

Am 11.12.25 um 1:32 PM schrieb Fiona Ebner:
> Make it possible to enroll via the API and UI by setting the
> ms-cert=2023 marker on the EFI disk.
> 
> The previous Microsoft UEFI CA 2011 will expire in June 2026, so there
> should be a way to update that can be automated and done while guests
> are running.
> 
> pve-manager needs a dependency bump for qemu-server for the API call
> to have the desired effect (or the marker will just get set without
> actually enrolling).

Ping. Would be nice to have this in earlier rather than later. I will
backport it for Proxmox VE 8 once there is an applied version :)


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel