Blame SOURCES/0008-Make-any-of-the-loaders-that-link-in-efi-mode-honor-.patch

8e15ce
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
8e15ce
From: Peter Jones <pjones@redhat.com>
8e15ce
Date: Tue, 6 Oct 2015 16:09:25 -0400
8e15ce
Subject: [PATCH] Make any of the loaders that link in efi mode honor secure
8e15ce
 boot.
8e15ce
8e15ce
And in this case "honor" means "even if somebody does link this in, they
8e15ce
won't register commands if SB is enabled."
8e15ce
8e15ce
Signed-off-by: Peter Jones <pjones@redhat.com>
8e15ce
---
8e15ce
 grub-core/commands/iorw.c          |  7 +++++++
8e15ce
 grub-core/commands/memrw.c         |  7 +++++++
8e15ce
 grub-core/kern/dl.c                |  3 ++-
8e15ce
 grub-core/kern/efi/efi.c           | 34 ----------------------------------
8e15ce
 grub-core/loader/efi/appleloader.c |  7 +++++++
8e15ce
 grub-core/loader/efi/chainloader.c |  1 +
8e15ce
 grub-core/loader/i386/bsd.c        |  7 +++++++
8e15ce
 grub-core/loader/i386/linux.c      |  7 +++++++
8e15ce
 grub-core/loader/i386/pc/linux.c   |  7 +++++++
8e15ce
 grub-core/loader/multiboot.c       |  7 +++++++
8e15ce
 grub-core/loader/xnu.c             |  7 +++++++
8e15ce
 include/grub/efi/efi.h             |  1 -
8e15ce
 include/grub/ia64/linux.h          |  0
8e15ce
 include/grub/mips/linux.h          |  0
8e15ce
 include/grub/powerpc/linux.h       |  0
8e15ce
 include/grub/sparc64/linux.h       |  0
8e15ce
 16 files changed, 59 insertions(+), 36 deletions(-)
8e15ce
 create mode 100644 include/grub/ia64/linux.h
8e15ce
 create mode 100644 include/grub/mips/linux.h
8e15ce
 create mode 100644 include/grub/powerpc/linux.h
8e15ce
 create mode 100644 include/grub/sparc64/linux.h
8e15ce
8e15ce
diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
8e15ce
index 584baec8f91..7b2999b14b5 100644
8e15ce
--- a/grub-core/commands/iorw.c
8e15ce
+++ b/grub-core/commands/iorw.c
8e15ce
@@ -24,6 +24,7 @@
8e15ce
 #include <grub/cpu/io.h>
8e15ce
 #include <grub/i18n.h>
8e15ce
 #include <grub/lockdown.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 GRUB_MOD_LICENSE ("GPLv3+");
8e15ce
 
8e15ce
@@ -119,6 +120,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
8e15ce
 
8e15ce
 GRUB_MOD_INIT(memrw)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   cmd_read_byte =
8e15ce
     grub_register_extcmd ("inb", grub_cmd_read, 0,
8e15ce
 			  N_("PORT"), N_("Read 8-bit value from PORT."),
8e15ce
@@ -147,6 +151,9 @@ GRUB_MOD_INIT(memrw)
8e15ce
 
8e15ce
 GRUB_MOD_FINI(memrw)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   grub_unregister_extcmd (cmd_read_byte);
8e15ce
   grub_unregister_extcmd (cmd_read_word);
8e15ce
   grub_unregister_extcmd (cmd_read_dword);
8e15ce
diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
8e15ce
index d401a6db0ef..39cf3a06dbd 100644
8e15ce
--- a/grub-core/commands/memrw.c
8e15ce
+++ b/grub-core/commands/memrw.c
8e15ce
@@ -23,6 +23,7 @@
8e15ce
 #include <grub/env.h>
8e15ce
 #include <grub/i18n.h>
8e15ce
 #include <grub/lockdown.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 GRUB_MOD_LICENSE ("GPLv3+");
8e15ce
 
8e15ce
@@ -121,6 +122,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
8e15ce
 
8e15ce
 GRUB_MOD_INIT(memrw)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   cmd_read_byte =
8e15ce
     grub_register_extcmd ("read_byte", grub_cmd_read, 0,
8e15ce
 			  N_("ADDR"), N_("Read 8-bit value from ADDR."),
8e15ce
@@ -149,6 +153,9 @@ GRUB_MOD_INIT(memrw)
8e15ce
 
8e15ce
 GRUB_MOD_FINI(memrw)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   grub_unregister_extcmd (cmd_read_byte);
8e15ce
   grub_unregister_extcmd (cmd_read_word);
8e15ce
   grub_unregister_extcmd (cmd_read_dword);
8e15ce
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
8e15ce
index b7149370950..7afb9e6f724 100644
8e15ce
--- a/grub-core/kern/dl.c
8e15ce
+++ b/grub-core/kern/dl.c
8e15ce
@@ -32,6 +32,7 @@
8e15ce
 #include <grub/env.h>
8e15ce
 #include <grub/cache.h>
8e15ce
 #include <grub/i18n.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 /* Platforms where modules are in a readonly area of memory.  */
8e15ce
 #if defined(GRUB_MACHINE_QEMU)
8e15ce
@@ -704,7 +705,7 @@ grub_dl_load_file (const char *filename)
8e15ce
   grub_dl_t mod = 0;
8e15ce
 
8e15ce
 #ifdef GRUB_MACHINE_EFI
8e15ce
-  if (grub_efi_secure_boot ())
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
     {
8e15ce
 #if 0
8e15ce
       /* This is an error, but grub2-mkconfig still generates a pile of
8e15ce
diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
8e15ce
index 4a2259aa1c7..8cff7be0289 100644
8e15ce
--- a/grub-core/kern/efi/efi.c
8e15ce
+++ b/grub-core/kern/efi/efi.c
8e15ce
@@ -286,40 +286,6 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
8e15ce
   return grub_efi_get_variable_with_attributes (var, guid, datasize_out, data_out, NULL);
8e15ce
 }
8e15ce
 
8e15ce
-grub_efi_boolean_t
8e15ce
-grub_efi_secure_boot (void)
8e15ce
-{
8e15ce
-  grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
8e15ce
-  grub_size_t datasize;
8e15ce
-  char *secure_boot = NULL;
8e15ce
-  char *setup_mode = NULL;
8e15ce
-  grub_efi_boolean_t ret = 0;
8e15ce
-
8e15ce
-  secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
8e15ce
-  if (datasize != 1 || !secure_boot)
8e15ce
-    {
8e15ce
-      grub_dprintf ("secureboot", "No SecureBoot variable\n");
8e15ce
-      goto out;
8e15ce
-    }
8e15ce
-  grub_dprintf ("secureboot", "SecureBoot: %d\n", *secure_boot);
8e15ce
-
8e15ce
-  setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);
8e15ce
-  if (datasize != 1 || !setup_mode)
8e15ce
-    {
8e15ce
-      grub_dprintf ("secureboot", "No SetupMode variable\n");
8e15ce
-      goto out;
8e15ce
-    }
8e15ce
-  grub_dprintf ("secureboot", "SetupMode: %d\n", *setup_mode);
8e15ce
-
8e15ce
-  if (*secure_boot && !*setup_mode)
8e15ce
-    ret = 1;
8e15ce
-
8e15ce
- out:
8e15ce
-  grub_free (secure_boot);
8e15ce
-  grub_free (setup_mode);
8e15ce
-  return ret;
8e15ce
-}
8e15ce
-
8e15ce
 #pragma GCC diagnostic ignored "-Wcast-align"
8e15ce
 
8e15ce
 /* Search the mods section from the PE32/PE32+ image. This code uses
8e15ce
diff --git a/grub-core/loader/efi/appleloader.c b/grub-core/loader/efi/appleloader.c
8e15ce
index 74888c463ba..585f2b57385 100644
8e15ce
--- a/grub-core/loader/efi/appleloader.c
8e15ce
+++ b/grub-core/loader/efi/appleloader.c
8e15ce
@@ -24,6 +24,7 @@
8e15ce
 #include <grub/misc.h>
8e15ce
 #include <grub/efi/api.h>
8e15ce
 #include <grub/efi/efi.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 #include <grub/command.h>
8e15ce
 #include <grub/i18n.h>
8e15ce
 
8e15ce
@@ -227,6 +228,9 @@ static grub_command_t cmd;
8e15ce
 
8e15ce
 GRUB_MOD_INIT(appleloader)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   cmd = grub_register_command ("appleloader", grub_cmd_appleloader,
8e15ce
 			       N_("[OPTS]"),
8e15ce
 			       /* TRANSLATORS: This command is used on EFI to
8e15ce
@@ -238,5 +242,8 @@ GRUB_MOD_INIT(appleloader)
8e15ce
 
8e15ce
 GRUB_MOD_FINI(appleloader)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   grub_unregister_command (cmd);
8e15ce
 }
8e15ce
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
8e15ce
index b54cf6986fc..3ff305b1d32 100644
8e15ce
--- a/grub-core/loader/efi/chainloader.c
8e15ce
+++ b/grub-core/loader/efi/chainloader.c
8e15ce
@@ -34,6 +34,7 @@
8e15ce
 #include <grub/efi/disk.h>
8e15ce
 #include <grub/efi/pe32.h>
8e15ce
 #include <grub/efi/linux.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 #include <grub/command.h>
8e15ce
 #include <grub/i18n.h>
8e15ce
 #include <grub/net.h>
8e15ce
diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c
8e15ce
index 5f3290ce17b..54befc26626 100644
8e15ce
--- a/grub-core/loader/i386/bsd.c
8e15ce
+++ b/grub-core/loader/i386/bsd.c
8e15ce
@@ -40,6 +40,7 @@
8e15ce
 #ifdef GRUB_MACHINE_PCBIOS
8e15ce
 #include <grub/machine/int.h>
8e15ce
 #endif
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 GRUB_MOD_LICENSE ("GPLv3+");
8e15ce
 
8e15ce
@@ -2137,6 +2138,9 @@ static grub_command_t cmd_netbsd_module_elf, cmd_openbsd_ramdisk;
8e15ce
 
8e15ce
 GRUB_MOD_INIT (bsd)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   /* Net and OpenBSD kernels are often compressed.  */
8e15ce
   grub_dl_load ("gzio");
8e15ce
 
8e15ce
@@ -2176,6 +2180,9 @@ GRUB_MOD_INIT (bsd)
8e15ce
 
8e15ce
 GRUB_MOD_FINI (bsd)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   grub_unregister_extcmd (cmd_freebsd);
8e15ce
   grub_unregister_extcmd (cmd_openbsd);
8e15ce
   grub_unregister_extcmd (cmd_netbsd);
8e15ce
diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
8e15ce
index dccf3bb3005..4aeb0e4b9a6 100644
8e15ce
--- a/grub-core/loader/i386/linux.c
8e15ce
+++ b/grub-core/loader/i386/linux.c
8e15ce
@@ -37,6 +37,7 @@
8e15ce
 #include <grub/linux.h>
8e15ce
 #include <grub/machine/kernel.h>
8e15ce
 #include <grub/safemath.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 GRUB_MOD_LICENSE ("GPLv3+");
8e15ce
 
8e15ce
@@ -1138,6 +1139,9 @@ static grub_command_t cmd_linux, cmd_initrd;
8e15ce
 
8e15ce
 GRUB_MOD_INIT(linux)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   cmd_linux = grub_register_command ("linux", grub_cmd_linux,
8e15ce
 				     0, N_("Load Linux."));
8e15ce
   cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd,
8e15ce
@@ -1147,6 +1151,9 @@ GRUB_MOD_INIT(linux)
8e15ce
 
8e15ce
 GRUB_MOD_FINI(linux)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   grub_unregister_command (cmd_linux);
8e15ce
   grub_unregister_command (cmd_initrd);
8e15ce
 }
8e15ce
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
8e15ce
index 4b1750e360e..e3fa1221e81 100644
8e15ce
--- a/grub-core/loader/i386/pc/linux.c
8e15ce
+++ b/grub-core/loader/i386/pc/linux.c
8e15ce
@@ -36,6 +36,7 @@
8e15ce
 #include <grub/lib/cmdline.h>
8e15ce
 #include <grub/linux.h>
8e15ce
 #include <grub/safemath.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 GRUB_MOD_LICENSE ("GPLv3+");
8e15ce
 
8e15ce
@@ -487,6 +488,9 @@ static grub_command_t cmd_linux, cmd_linux16, cmd_initrd, cmd_initrd16;
8e15ce
 
8e15ce
 GRUB_MOD_INIT(linux16)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   cmd_linux =
8e15ce
     grub_register_command ("linux", grub_cmd_linux,
8e15ce
 			   0, N_("Load Linux."));
8e15ce
@@ -504,6 +508,9 @@ GRUB_MOD_INIT(linux16)
8e15ce
 
8e15ce
 GRUB_MOD_FINI(linux16)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   grub_unregister_command (cmd_linux);
8e15ce
   grub_unregister_command (cmd_linux16);
8e15ce
   grub_unregister_command (cmd_initrd);
8e15ce
diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c
8e15ce
index facb13f3d36..47e481f4576 100644
8e15ce
--- a/grub-core/loader/multiboot.c
8e15ce
+++ b/grub-core/loader/multiboot.c
8e15ce
@@ -50,6 +50,7 @@
8e15ce
 #include <grub/video.h>
8e15ce
 #include <grub/memory.h>
8e15ce
 #include <grub/i18n.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 GRUB_MOD_LICENSE ("GPLv3+");
8e15ce
 
8e15ce
@@ -444,6 +445,9 @@ static grub_command_t cmd_multiboot, cmd_module;
8e15ce
 
8e15ce
 GRUB_MOD_INIT(multiboot)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   cmd_multiboot =
8e15ce
 #ifdef GRUB_USE_MULTIBOOT2
8e15ce
     grub_register_command ("multiboot2", grub_cmd_multiboot,
8e15ce
@@ -464,6 +468,9 @@ GRUB_MOD_INIT(multiboot)
8e15ce
 
8e15ce
 GRUB_MOD_FINI(multiboot)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   grub_unregister_command (cmd_multiboot);
8e15ce
   grub_unregister_command (cmd_module);
8e15ce
 }
8e15ce
diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
8e15ce
index 1c0cf6a430a..baa54e652ab 100644
8e15ce
--- a/grub-core/loader/xnu.c
8e15ce
+++ b/grub-core/loader/xnu.c
8e15ce
@@ -35,6 +35,7 @@
8e15ce
 #include <grub/i18n.h>
8e15ce
 #include <grub/verify.h>
8e15ce
 #include <grub/safemath.h>
8e15ce
+#include <grub/efi/sb.h>
8e15ce
 
8e15ce
 GRUB_MOD_LICENSE ("GPLv3+");
8e15ce
 
8e15ce
@@ -1497,6 +1498,9 @@ static grub_extcmd_t cmd_splash;
8e15ce
 
8e15ce
 GRUB_MOD_INIT(xnu)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
   cmd_kernel = grub_register_command ("xnu_kernel", grub_cmd_xnu_kernel, 0,
8e15ce
 				      N_("Load XNU image."));
8e15ce
   cmd_kernel64 = grub_register_command ("xnu_kernel64", grub_cmd_xnu_kernel64,
8e15ce
@@ -1540,6 +1544,9 @@ GRUB_MOD_INIT(xnu)
8e15ce
 
8e15ce
 GRUB_MOD_FINI(xnu)
8e15ce
 {
8e15ce
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
8e15ce
+    return;
8e15ce
+
8e15ce
 #ifndef GRUB_MACHINE_EMU
8e15ce
   grub_unregister_command (cmd_resume);
8e15ce
 #endif
8e15ce
diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
8e15ce
index 6295df85f3f..585fa6662b6 100644
8e15ce
--- a/include/grub/efi/efi.h
8e15ce
+++ b/include/grub/efi/efi.h
8e15ce
@@ -91,7 +91,6 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
8e15ce
 				     const grub_efi_guid_t *guid,
8e15ce
 				     void *data,
8e15ce
 				     grub_size_t datasize);
8e15ce
-grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);
8e15ce
 int
8e15ce
 EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
8e15ce
 					     const grub_efi_device_path_t *dp2);
8e15ce
diff --git a/include/grub/ia64/linux.h b/include/grub/ia64/linux.h
8e15ce
new file mode 100644
8e15ce
index 00000000000..e69de29bb2d
8e15ce
diff --git a/include/grub/mips/linux.h b/include/grub/mips/linux.h
8e15ce
new file mode 100644
8e15ce
index 00000000000..e69de29bb2d
8e15ce
diff --git a/include/grub/powerpc/linux.h b/include/grub/powerpc/linux.h
8e15ce
new file mode 100644
8e15ce
index 00000000000..e69de29bb2d
8e15ce
diff --git a/include/grub/sparc64/linux.h b/include/grub/sparc64/linux.h
8e15ce
new file mode 100644
8e15ce
index 00000000000..e69de29bb2d