add access_denied, see if this helps identify when we have shim acces…

…s denied with newer ovmf

test/harness

@@ -92,6 +92,13 @@ def denied_boot(_name, _tdata, result):
     raise TestError("boot was not denied")
 
 
+def access_denied(_name, _tdata, result):
+    """Validate that shell refused to boot shim"""
+    if result.is_denied() is True:
+        return
+    rase TestError("shim access was not denied")
+
+
 def load_test_data(testfile):
     testdata = yaml.safe_load(read_file(testfile))
 
@@ -151,6 +158,7 @@ CHECKS = {
     "booted-expected-cli": booted_expected_cli,
     "warned-cmdline": warned_cmdline,
     "denied-boot": denied_boot,
+    "access-denied": access_denied,
 }
 
 
@@ -892,6 +900,7 @@ class TestResult:
     re_cmdline = re.compile(r"KERNEL COMMAND LINE: (?P<value>[^\n]*)\n")
     re_rejected = re.compile(r"Custom kernel command line rejected\n")
     re_warned = re.compile(r"Custom kernel would be rejected in secure mode\n")
+    re_denied = re.compile(r"failed to load.*: Access Denied\n")
 
     def __init__(self, rdir):
         self.rdir = rdir
@@ -919,6 +928,10 @@ class TestResult:
     def is_warned(self):
         return self.re_warned.search(self.serial) is not None
 
+    @functools.lru_cache
+    def is_denied(self):
+        return self.re_denied.search(self.serial) is not None
+
 
 class TestError(Exception):
     pass

test/tests.yaml

@@ -10,6 +10,7 @@
 #     - booted-expected-cli: the kernel booted and had the provided 'expected'.
 #     - denied-boot: stubby refused to boot kernel.
 #     - warned-cmdline: stubby warned that secureboot would not allow.
+#     - access-denied: uefi shell refuses to run shim.efi
 #
 # notes:
 #   sb-shim -> secureboot=true  shim=yes