Automated update of a customized secure boot policy

1. An information handling system comprising:

a memory to store a secure boot policy for a plurality of input/output (I/O) devices in the information handling system;

a baseboard management controller (BMC) to:

perform a firmware update for a first I/O device of the I/O devices; and

in response to the firmware update being completed successfully, create a system management task; and

a basic input/output system (BIOS), during a next boot after the creation of the system management task, the BIOS to:

detect the system management task;

based on the detection of the system management task, calculate a new hash value for a firmware image of the firmware update; and

replace a previous hash value with the new hash value in the secure boot policy, wherein the replacement includes the BIOS further to:

move the previous firmware hash value from an allow list database within the secure boot policy to a deny list database within the secure boot policy; and

add the new firmware hash value to the allow list database.

2. The information handling system of claim 1 , wherein prior to the creation of the system management task, the BMC further to receive a selection to enable an automated secure boot policy update.

3. The information handling system of claim 1 , wherein the BMC further to verify a private key signature of the firmware update package prior to the calculation of the new firmware hash value.

4. The information handling system of claim 1 , wherein the calculation of the new hash value for the firmware image, the BIOS further to calculate a hash value for an option read only memory (ROM) within the firmware image.

5. The information handling system of claim 1 , wherein the system management task includes a unique identifier for the first I/O device.

6. The information handling system of claim 1 , wherein the system management task includes previous hash values of each previous firmware versions that were overwritten.

7. A method comprising:

storing, by a baseboard management controller of an information handling system, a secure boot policy for a plurality of input/output (I/O) devices in the information handling system;

performing a firmware update for the first I/O device;

in response to the firmware update being completed successfully, creating, by the BMC, a system management task; and

during a next boot operation of the information handling system:

detecting, by a basic input/output system (BIOS) of the information handling system, the system management task;

based on the detection of the system management task, calculating, by the BIOS, a new hash value for a firmware image of the firmware update; and

replacing a previous hash value with the new hash value in the secure boot policy wherein the replacing includes;

moving the previous firmware hash value from an allow list database within the secure boot policy to a deny list database within the secure boot policy; and

adding the new firmware hash value to the allow list database.

8. The method of claim 7 , wherein prior to the creation of the system management task, method further comprising: receiving a selection to enable an automated secure boot policy update.

9. The method of claim 7 , further comprising: verify a private key signature of the firmware update package prior to the calculation of the new firmware hash value.

10. The method of claim 7 , wherein the calculating of the new hash value for the firmware image, the method further comprising: calculating a hash value for an option read only memory (ROM) within the firmware image.

11. The method of claim 7 , wherein the system management task includes a unique identifier for the first I/O device.

12. The method of claim 7 , wherein the system management task includes previous hash values of each previous firmware versions that were overwritten.

13. An information handling system comprising:

a memory to store a secure boot policy for a plurality of input/output (I/O) devices in the information handling system;

a baseboard management controller (BMC) to:

verify a private key signature of the firmware update package;

in response to the private key signature being verified, perform a firmware update for a first I/O device of the I/O devices; and

in response to the firmware update being completed successfully, create a system management task; and

a basic input/output system (BIOS), during a next boot after the creation of the system management task, the BIOS to:

detect the system management task;

based on the detection of the system management task, calculate a new hash value for a firmware image of the firmware update, wherein the new hash value for the firmware image includes a hash value for an option read only memory within the firmware image; and

replace a previous hash value with the new hash value in the secure boot policy, wherein the replacement includes the BIOS further to:

move the previous firmware hash value from an allow list database within the secure boot policy to a deny list database within the secure boot policy; and

add the new firmware hash value to the allow list database.

14. The information handling system of claim 13 , wherein the system management task includes a unique identifier for the first I/O device, and previous hash values of each previous firmware versions that were overwritten.