Commit a1b96fcde8 for qemu.org

commit a1b96fcde870e49896cddee40459d5feb1f15694
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Fri Sep 4 10:55:08 2026 +0200

    hw/uefi: improve default config security

    Recent UEFI spec versions do not require a self-signed PK any more.
    There is no good reason to stick to this requirement, but there is one
    reason to remove it:  It is not needed to enable CustomMode then to
    enroll secure boot keys which are not self-signed.

    This commit changes the uefi-vars default configuration to remove the
    self signed platform key requirement and to disable CustomMode.

    Little background on CustomMode:

    This is a special edk2 mode which allows to freely update secure boot
    variables.  This is used by the firmware setup utility to allow the user
    change the secure boot certificates.  The EnrollDefaultKeys.efi utility
    used to depend on CustomMode too.

    Typically enabling CustomMode requires the user being physically
    present.  Implementing such a check in a sensible way for a virtual
    machine is not really possible though.  So OVMF doesn't do that and
    CustomMode can be enabled without that physical presence check.
    Therefore disabling CustomMode (by the qemu variable service blocking
    updates of the EFI variable with EFI_WRITE_PROTECTED) is a nice security
    improvement for secure boot support in virtual machines.

    User-visible change:  Updating secure boot configuration via firmware
    setup utility does not work by default.  Setting the
    "disable-custom-mode=off" property will re-enable this if needed.
    Alternatively the variable store can be prepared on the host machine
    instead of doing it inside the guest.

    Related edk2 commits:
     - 3c01a11daae2 ("OvmfPkg: set PcdRequireSelfSignedPk to FALSE").
     - 0a7ed7ed3457 ("OvmfPkg/EnrollDefaultKeys: do not require CustomMode")

    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-ID: <20260904085509.2267560-3-kraxel@redhat.com>

diff --git a/hw/uefi/var-service-sysbus.c b/hw/uefi/var-service-sysbus.c
index c4acdea275..e5e0441e16 100644
--- a/hw/uefi/var-service-sysbus.c
+++ b/hw/uefi/var-service-sysbus.c
@@ -37,9 +37,9 @@ static const Property uefi_vars_sysbus_properties[] = {
     DEFINE_PROP_BOOL("force-secure-boot", uefi_vars_sysbus_state,
                      state.force_secure_boot, false),
     DEFINE_PROP_BOOL("disable-custom-mode", uefi_vars_sysbus_state,
-                     state.disable_custom_mode, false),
+                     state.disable_custom_mode, true),
     DEFINE_PROP_BOOL("require-self-signed-pk", uefi_vars_sysbus_state,
-                     state.require_self_signed_pk, true),
+                     state.require_self_signed_pk, false),
     DEFINE_PROP_BOOL("use-pio", uefi_vars_sysbus_state,
                      state.use_pio, false),
 };