Blame SOURCES/0144-grub-install-disable-support-for-EFI-platforms.patch

5593c8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
5593c8
From: Jan Hlavac <jhlavac@redhat.com>
5593c8
Date: Fri, 20 Nov 2020 23:51:47 +0100
5593c8
Subject: [PATCH] grub-install: disable support for EFI platforms
5593c8
5593c8
For each platform, GRUB is shipped as a kernel image and a set of
5593c8
modules. These files are then used by the grub-install utility to
5593c8
install GRUB on a specific device. However, in order to support UEFI
5593c8
Secure Boot, the resulting EFI binary must be signed by a recognized
5593c8
private key. For this reason, for EFI platforms, most distributions also
5593c8
ship prebuilt EFI binaries signed by a distribution-specific private
5593c8
key. In this case, however, the grub-install utility should not be used
5593c8
because it would overwrite the signed EFI binary.
5593c8
5593c8
The current fix is suboptimal because it preserves all EFI-related code.
5593c8
A better solution could be to modularize the code and provide a
5593c8
build-time option.
5593c8
5593c8
Resolves: rhbz#1737444
5593c8
5593c8
Signed-off-by: Jan Hlavac <jhlavac@redhat.com>
fd0330
[rharwood: drop man page]
5593c8
---
5593c8
 util/grub-install.c | 37 ++++++++++++++++---------------------
5593c8
 docs/grub.texi      |  7 +++++++
fd0330
 2 files changed, 23 insertions(+), 21 deletions(-)
5593c8
5593c8
diff --git a/util/grub-install.c b/util/grub-install.c
fd0330
index a2bec7446c..5babc7af55 100644
5593c8
--- a/util/grub-install.c
5593c8
+++ b/util/grub-install.c
5593c8
@@ -899,6 +899,22 @@ main (int argc, char *argv[])
5593c8
 
5593c8
   platform = grub_install_get_target (grub_install_source_directory);
5593c8
 
5593c8
+  switch (platform)
5593c8
+    {
5593c8
+    case GRUB_INSTALL_PLATFORM_ARM_EFI:
5593c8
+    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
5593c8
+    case GRUB_INSTALL_PLATFORM_I386_EFI:
5593c8
+    case GRUB_INSTALL_PLATFORM_IA64_EFI:
5593c8
+    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
5593c8
+      is_efi = 1;
5593c8
+      grub_util_error (_("this utility cannot be used for EFI platforms"
5593c8
+                         " because it does not support UEFI Secure Boot"));
5593c8
+      break;
5593c8
+    default:
5593c8
+      is_efi = 0;
5593c8
+      break;
5593c8
+    }
5593c8
+
5593c8
   {
5593c8
     char *platname = grub_install_get_platform_name (platform);
5593c8
     fprintf (stderr, _("Installing for %s platform.\n"), platname);
5593c8
@@ -1011,28 +1027,7 @@ main (int argc, char *argv[])
5593c8
   grub_hostfs_init ();
5593c8
   grub_host_init ();
5593c8
 
5593c8
-  switch (platform)
5593c8
-    {
5593c8
-    case GRUB_INSTALL_PLATFORM_I386_EFI:
5593c8
-    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
5593c8
-    case GRUB_INSTALL_PLATFORM_ARM_EFI:
5593c8
-    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
5593c8
-    case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
5593c8
-    case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
5593c8
-    case GRUB_INSTALL_PLATFORM_IA64_EFI:
5593c8
-      is_efi = 1;
5593c8
-      break;
5593c8
-    default:
5593c8
-      is_efi = 0;
5593c8
-      break;
5593c8
-
5593c8
-      /* pacify warning.  */
5593c8
-    case GRUB_INSTALL_PLATFORM_MAX:
5593c8
-      break;
5593c8
-    }
5593c8
-
5593c8
   /* Find the EFI System Partition.  */
5593c8
-
5593c8
   if (is_efi)
5593c8
     {
5593c8
       grub_fs_t fs;
5593c8
diff --git a/docs/grub.texi b/docs/grub.texi
fd0330
index 04ed6ac1f0..4870faaa00 100644
5593c8
--- a/docs/grub.texi
5593c8
+++ b/docs/grub.texi
5593c8
@@ -6509,6 +6509,13 @@ grub2-install @var{install_device}
5593c8
 The device name @var{install_device} is an OS device name or a GRUB
5593c8
 device name.
5593c8
 
5593c8
+In order to support UEFI Secure Boot, the resulting GRUB EFI binary must
5593c8
+be signed by a recognized private key. For this reason, for EFI
5593c8
+platforms, most distributions also ship prebuilt GRUB EFI binaries
5593c8
+signed by a distribution-specific private key. In this case, however,
5593c8
+@command{grub2-install} should not be used because it would overwrite
5593c8
+the signed EFI binary.
5593c8
+
5593c8
 @command{grub2-install} accepts the following options:
5593c8
 
5593c8
 @table @option