"Delete System76 and Microsoft keys (Use your own)" doesn't actually delete them

[gentoo-root]

After choosing "Delete System76 and Microsoft keys (Use your own)" in the firmware setup menu, both System76 and Microsoft keys can still be seen with sbkeysync from Linux.

The code hints that only PK is deleted and the computer is immediately rebooted, but the keys of System76 and Microsoft are not actually deleted:

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr

Line 108 in 42a443d

key = KEY_SECURE_BOOT_DELETE_PK;

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c

Lines 4521 to 4523 in 42a443d

	case KEY_SECURE_BOOT_DELETE_PK:
	Status = DeletePlatformKey();
	break;

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c

Lines 4842 to 4858 in 42a443d

	case KEY_SECURE_BOOT_DELETE_PK:
	//GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);
	//if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {
	// IfrNvData->DeletePk = TRUE;
	// IfrNvData->HasPk = FALSE;
	// *ActionRequest = EFI_BROWSER_ACTION_REQUEST_SUBMIT;
	//} else {
	// IfrNvData->DeletePk = FALSE;
	// IfrNvData->HasPk = TRUE;
	// *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
	//}
	//if (SetupMode != NULL) {
	// FreePool (SetupMode);
	//}
	// XXX: Is this safe?
	gRT->ResetSystem(EfiResetCold, Status, 0, NULL);
	break;

I would expect all these steps to be performed to actually delete vendor keys:

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c

Lines 4181 to 4210 in 42a443d

	// Clear all the keys and databases
	Status = DeleteDb ();
	if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
	DEBUG ((DEBUG_ERROR, "Fail to clear DB: %r\n", Status));
	return Status;
	}
	Status = DeleteDbx ();
	if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
	DEBUG ((DEBUG_ERROR, "Fail to clear DBX: %r\n", Status));
	return Status;
	}
	Status = DeleteDbt ();
	if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
	DEBUG ((DEBUG_ERROR, "Fail to clear DBT: %r\n", Status));
	return Status;
	}
	Status = DeleteKEK ();
	if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
	DEBUG ((DEBUG_ERROR, "Fail to clear KEK: %r\n", Status));
	return Status;
	}
	Status = DeletePlatformKey ();
	if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
	DEBUG ((DEBUG_ERROR, "Fail to clear PK: %r\n", Status));
	return Status;
	}

[crawfxrd]

Yes, only the PK is deleted. The KEKs are still there.

---

State after clean flash, before enabling Secure Boot:

$ sbkeysync --verbose --dry-run
Filesystem keystore:
firmware keys:
  PK:
  KEK:
  db:
  dbx:
filesystem keys:
  PK:
  KEK:
  db:
  dbx:
New keys in filesystem:

State after restoring default keys:

(NOTE: Restoring default keys does not enroll the DBX; This doesn't seem to happen unless you enable Secure Boot. DBX should probably always be enrolled.)

$ sbkeysync --verbose --dry-run
Filesystem keystore:
firmware keys:
  PK:
    /C=US/ST=Colorado/L=Denver/O=System76/CN=System76 Secure Boot Platform Key
  KEK:
    /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation KEK CA 2011
    /C=US/ST=Colorado/L=Denver/O=System76/CN=System76 Secure Boot Key Exchange Key
  db:
    /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
    /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011
    /C=US/ST=Colorado/L=Denver/O=System76/CN=System76 Secure Boot Database Key
  dbx:
filesystem keys:
  PK:
  KEK:
  db:
  dbx:
New keys in filesystem:

State after deleting default keys:

$ sbkeysync --verbose --dry-run
Filesystem keystore:
firmware keys:
  PK:
  KEK:
    /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation KEK CA 2011
    /C=US/ST=Colorado/L=Denver/O=System76/CN=System76 Secure Boot Key Exchange Key
  db:
    /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
    /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011
    /C=US/ST=Colorado/L=Denver/O=System76/CN=System76 Secure Boot Database Key
  dbx:
    <snip>
filesystem keys:
  PK:
  KEK:
  db:
  dbx:
New keys in filesystem: