|
|
28f7f8 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
27a4da |
From: Peter Jones <pjones@redhat.com>
|
|
|
27a4da |
Date: Tue, 6 Oct 2015 16:09:25 -0400
|
|
|
28f7f8 |
Subject: [PATCH] Make any of the loaders that link in efi mode honor secure
|
|
|
28f7f8 |
boot.
|
|
|
27a4da |
|
|
|
27a4da |
And in this case "honor" means "even if somebody does link this in, they
|
|
|
27a4da |
won't register commands if SB is enabled."
|
|
|
27a4da |
|
|
|
27a4da |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
27a4da |
---
|
|
|
27a4da |
grub-core/Makefile.core.def | 2 ++
|
|
|
27a4da |
grub-core/commands/iorw.c | 7 +++++
|
|
|
27a4da |
grub-core/commands/memrw.c | 7 +++++
|
|
|
27a4da |
grub-core/kern/efi/efi.c | 28 ------------------
|
|
|
27a4da |
grub-core/kern/efi/sb.c | 58 ++++++++++++++++++++++++++++++++++++++
|
|
|
27a4da |
grub-core/loader/efi/appleloader.c | 7 +++++
|
|
|
27a4da |
grub-core/loader/efi/chainloader.c | 1 +
|
|
|
27a4da |
grub-core/loader/i386/bsd.c | 7 +++++
|
|
|
27a4da |
grub-core/loader/i386/linux.c | 7 +++++
|
|
|
27a4da |
grub-core/loader/i386/pc/linux.c | 7 +++++
|
|
|
27a4da |
grub-core/loader/multiboot.c | 7 +++++
|
|
|
27a4da |
grub-core/loader/xnu.c | 7 +++++
|
|
|
27a4da |
include/grub/efi/efi.h | 1 -
|
|
|
27a4da |
include/grub/efi/sb.h | 29 +++++++++++++++++++
|
|
|
27a4da |
include/grub/ia64/linux.h | 0
|
|
|
27a4da |
include/grub/mips/linux.h | 0
|
|
|
27a4da |
include/grub/powerpc/linux.h | 0
|
|
|
27a4da |
include/grub/sparc64/linux.h | 0
|
|
|
28f7f8 |
grub-core/Makefile.am | 1 +
|
|
|
27a4da |
19 files changed, 147 insertions(+), 29 deletions(-)
|
|
|
27a4da |
create mode 100644 grub-core/kern/efi/sb.c
|
|
|
27a4da |
create mode 100644 include/grub/efi/sb.h
|
|
|
27a4da |
create mode 100644 include/grub/ia64/linux.h
|
|
|
27a4da |
create mode 100644 include/grub/mips/linux.h
|
|
|
27a4da |
create mode 100644 include/grub/powerpc/linux.h
|
|
|
27a4da |
create mode 100644 include/grub/sparc64/linux.h
|
|
|
27a4da |
|
|
|
27a4da |
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
|
|
|
28f7f8 |
index 4fc74393335..b340ceeec7f 100644
|
|
|
27a4da |
--- a/grub-core/Makefile.core.def
|
|
|
27a4da |
+++ b/grub-core/Makefile.core.def
|
|
|
27a4da |
@@ -175,6 +175,8 @@ kernel = {
|
|
|
27a4da |
efi = term/efi/console.c;
|
|
|
27a4da |
efi = lib/envblk.c;
|
|
|
27a4da |
|
|
|
27a4da |
+ common = kern/efi/sb.c;
|
|
|
27a4da |
+
|
|
|
27a4da |
x86 = kern/i386/tsc.c;
|
|
|
27a4da |
|
|
|
27a4da |
i386_efi = kern/i386/efi/init.c;
|
|
|
27a4da |
diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
|
|
|
28f7f8 |
index a0c164e54f0..41a7f3f0466 100644
|
|
|
27a4da |
--- a/grub-core/commands/iorw.c
|
|
|
27a4da |
+++ b/grub-core/commands/iorw.c
|
|
|
27a4da |
@@ -23,6 +23,7 @@
|
|
|
27a4da |
#include <grub/env.h>
|
|
|
27a4da |
#include <grub/cpu/io.h>
|
|
|
27a4da |
#include <grub/i18n.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -118,6 +119,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT(memrw)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
cmd_read_byte =
|
|
|
27a4da |
grub_register_extcmd ("inb", grub_cmd_read, 0,
|
|
|
27a4da |
N_("PORT"), N_("Read 8-bit value from PORT."),
|
|
|
27a4da |
@@ -146,6 +150,9 @@ GRUB_MOD_INIT(memrw)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI(memrw)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
grub_unregister_extcmd (cmd_read_byte);
|
|
|
27a4da |
grub_unregister_extcmd (cmd_read_word);
|
|
|
27a4da |
grub_unregister_extcmd (cmd_read_dword);
|
|
|
27a4da |
diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
|
|
|
28f7f8 |
index 98769eadb34..088cbe9e2bc 100644
|
|
|
27a4da |
--- a/grub-core/commands/memrw.c
|
|
|
27a4da |
+++ b/grub-core/commands/memrw.c
|
|
|
27a4da |
@@ -22,6 +22,7 @@
|
|
|
27a4da |
#include <grub/extcmd.h>
|
|
|
27a4da |
#include <grub/env.h>
|
|
|
27a4da |
#include <grub/i18n.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -120,6 +121,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT(memrw)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
cmd_read_byte =
|
|
|
27a4da |
grub_register_extcmd ("read_byte", grub_cmd_read, 0,
|
|
|
27a4da |
N_("ADDR"), N_("Read 8-bit value from ADDR."),
|
|
|
27a4da |
@@ -148,6 +152,9 @@ GRUB_MOD_INIT(memrw)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI(memrw)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
grub_unregister_extcmd (cmd_read_byte);
|
|
|
27a4da |
grub_unregister_extcmd (cmd_read_word);
|
|
|
27a4da |
grub_unregister_extcmd (cmd_read_dword);
|
|
|
27a4da |
diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
|
|
|
28f7f8 |
index c80d85b677e..7dfe2ef1455 100644
|
|
|
27a4da |
--- a/grub-core/kern/efi/efi.c
|
|
|
27a4da |
+++ b/grub-core/kern/efi/efi.c
|
|
|
27a4da |
@@ -260,34 +260,6 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
|
|
|
27a4da |
return NULL;
|
|
|
27a4da |
}
|
|
|
27a4da |
|
|
|
27a4da |
-grub_efi_boolean_t
|
|
|
27a4da |
-grub_efi_secure_boot (void)
|
|
|
27a4da |
-{
|
|
|
27a4da |
- grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
|
|
|
27a4da |
- grub_size_t datasize;
|
|
|
27a4da |
- char *secure_boot = NULL;
|
|
|
27a4da |
- char *setup_mode = NULL;
|
|
|
27a4da |
- grub_efi_boolean_t ret = 0;
|
|
|
27a4da |
-
|
|
|
27a4da |
- secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
|
|
|
27a4da |
-
|
|
|
27a4da |
- if (datasize != 1 || !secure_boot)
|
|
|
27a4da |
- goto out;
|
|
|
27a4da |
-
|
|
|
27a4da |
- setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);
|
|
|
27a4da |
-
|
|
|
27a4da |
- if (datasize != 1 || !setup_mode)
|
|
|
27a4da |
- goto out;
|
|
|
27a4da |
-
|
|
|
27a4da |
- if (*secure_boot && !*setup_mode)
|
|
|
27a4da |
- ret = 1;
|
|
|
27a4da |
-
|
|
|
27a4da |
- out:
|
|
|
27a4da |
- grub_free (secure_boot);
|
|
|
27a4da |
- grub_free (setup_mode);
|
|
|
27a4da |
- return ret;
|
|
|
27a4da |
-}
|
|
|
27a4da |
-
|
|
|
27a4da |
#pragma GCC diagnostic ignored "-Wcast-align"
|
|
|
27a4da |
|
|
|
27a4da |
/* Search the mods section from the PE32/PE32+ image. This code uses
|
|
|
27a4da |
diff --git a/grub-core/kern/efi/sb.c b/grub-core/kern/efi/sb.c
|
|
|
27a4da |
new file mode 100644
|
|
|
28f7f8 |
index 00000000000..a41b6c5b851
|
|
|
27a4da |
--- /dev/null
|
|
|
27a4da |
+++ b/grub-core/kern/efi/sb.c
|
|
|
27a4da |
@@ -0,0 +1,58 @@
|
|
|
27a4da |
+/*
|
|
|
27a4da |
+ * GRUB -- GRand Unified Bootloader
|
|
|
27a4da |
+ * Copyright (C) 2014 Free Software Foundation, Inc.
|
|
|
27a4da |
+ *
|
|
|
27a4da |
+ * GRUB is free software: you can redistribute it and/or modify
|
|
|
27a4da |
+ * it under the terms of the GNU General Public License as published by
|
|
|
27a4da |
+ * the Free Software Foundation, either version 3 of the License, or
|
|
|
27a4da |
+ * (at your option) any later version.
|
|
|
27a4da |
+ *
|
|
|
27a4da |
+ * GRUB is distributed in the hope that it will be useful,
|
|
|
27a4da |
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
27a4da |
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
27a4da |
+ * GNU General Public License for more details.
|
|
|
27a4da |
+ *
|
|
|
27a4da |
+ * You should have received a copy of the GNU General Public License
|
|
|
27a4da |
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
|
|
27a4da |
+ */
|
|
|
27a4da |
+
|
|
|
27a4da |
+#include <grub/err.h>
|
|
|
27a4da |
+#include <grub/mm.h>
|
|
|
27a4da |
+#include <grub/types.h>
|
|
|
27a4da |
+#include <grub/cpu/linux.h>
|
|
|
27a4da |
+#include <grub/efi/efi.h>
|
|
|
27a4da |
+#include <grub/efi/pe32.h>
|
|
|
27a4da |
+#include <grub/efi/linux.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
+
|
|
|
27a4da |
+int
|
|
|
27a4da |
+grub_efi_secure_boot (void)
|
|
|
27a4da |
+{
|
|
|
27a4da |
+#ifdef GRUB_MACHINE_EFI
|
|
|
27a4da |
+ grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
|
|
|
27a4da |
+ grub_size_t datasize;
|
|
|
27a4da |
+ char *secure_boot = NULL;
|
|
|
27a4da |
+ char *setup_mode = NULL;
|
|
|
27a4da |
+ grub_efi_boolean_t ret = 0;
|
|
|
27a4da |
+
|
|
|
27a4da |
+ secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
|
|
|
27a4da |
+
|
|
|
27a4da |
+ if (datasize != 1 || !secure_boot)
|
|
|
27a4da |
+ goto out;
|
|
|
27a4da |
+
|
|
|
27a4da |
+ setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);
|
|
|
27a4da |
+
|
|
|
27a4da |
+ if (datasize != 1 || !setup_mode)
|
|
|
27a4da |
+ goto out;
|
|
|
27a4da |
+
|
|
|
27a4da |
+ if (*secure_boot && !*setup_mode)
|
|
|
27a4da |
+ ret = 1;
|
|
|
27a4da |
+
|
|
|
27a4da |
+ out:
|
|
|
27a4da |
+ grub_free (secure_boot);
|
|
|
27a4da |
+ grub_free (setup_mode);
|
|
|
27a4da |
+ return ret;
|
|
|
27a4da |
+#else
|
|
|
27a4da |
+ return 0;
|
|
|
27a4da |
+#endif
|
|
|
27a4da |
+}
|
|
|
27a4da |
diff --git a/grub-core/loader/efi/appleloader.c b/grub-core/loader/efi/appleloader.c
|
|
|
28f7f8 |
index 74888c463ba..69c2a10d351 100644
|
|
|
27a4da |
--- a/grub-core/loader/efi/appleloader.c
|
|
|
27a4da |
+++ b/grub-core/loader/efi/appleloader.c
|
|
|
27a4da |
@@ -24,6 +24,7 @@
|
|
|
27a4da |
#include <grub/misc.h>
|
|
|
27a4da |
#include <grub/efi/api.h>
|
|
|
27a4da |
#include <grub/efi/efi.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
#include <grub/command.h>
|
|
|
27a4da |
#include <grub/i18n.h>
|
|
|
27a4da |
|
|
|
27a4da |
@@ -227,6 +228,9 @@ static grub_command_t cmd;
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT(appleloader)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
cmd = grub_register_command ("appleloader", grub_cmd_appleloader,
|
|
|
27a4da |
N_("[OPTS]"),
|
|
|
27a4da |
/* TRANSLATORS: This command is used on EFI to
|
|
|
27a4da |
@@ -238,5 +242,8 @@ GRUB_MOD_INIT(appleloader)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI(appleloader)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
grub_unregister_command (cmd);
|
|
|
27a4da |
}
|
|
|
27a4da |
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
|
|
|
28f7f8 |
index 87a91e16f17..aee8e6becf6 100644
|
|
|
27a4da |
--- a/grub-core/loader/efi/chainloader.c
|
|
|
27a4da |
+++ b/grub-core/loader/efi/chainloader.c
|
|
|
27a4da |
@@ -34,6 +34,7 @@
|
|
|
27a4da |
#include <grub/efi/disk.h>
|
|
|
27a4da |
#include <grub/efi/pe32.h>
|
|
|
27a4da |
#include <grub/efi/linux.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
#include <grub/command.h>
|
|
|
27a4da |
#include <grub/i18n.h>
|
|
|
27a4da |
#include <grub/net.h>
|
|
|
27a4da |
diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c
|
|
|
28f7f8 |
index 8f691e0e2d1..b671f59b62a 100644
|
|
|
27a4da |
--- a/grub-core/loader/i386/bsd.c
|
|
|
27a4da |
+++ b/grub-core/loader/i386/bsd.c
|
|
|
27a4da |
@@ -38,6 +38,7 @@
|
|
|
27a4da |
#ifdef GRUB_MACHINE_PCBIOS
|
|
|
27a4da |
#include <grub/machine/int.h>
|
|
|
27a4da |
#endif
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -2111,6 +2112,9 @@ static grub_command_t cmd_netbsd_module_elf, cmd_openbsd_ramdisk;
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT (bsd)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
/* Net and OpenBSD kernels are often compressed. */
|
|
|
27a4da |
grub_dl_load ("gzio");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -2150,6 +2154,9 @@ GRUB_MOD_INIT (bsd)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI (bsd)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
grub_unregister_extcmd (cmd_freebsd);
|
|
|
27a4da |
grub_unregister_extcmd (cmd_openbsd);
|
|
|
27a4da |
grub_unregister_extcmd (cmd_netbsd);
|
|
|
27a4da |
diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
|
|
|
28f7f8 |
index 2ae176315b6..bd37c69b5d0 100644
|
|
|
27a4da |
--- a/grub-core/loader/i386/linux.c
|
|
|
27a4da |
+++ b/grub-core/loader/i386/linux.c
|
|
|
27a4da |
@@ -35,6 +35,7 @@
|
|
|
27a4da |
#include <grub/i18n.h>
|
|
|
27a4da |
#include <grub/lib/cmdline.h>
|
|
|
27a4da |
#include <grub/linux.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -1137,6 +1138,9 @@ static grub_command_t cmd_linux, cmd_initrd;
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT(linux)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
cmd_linux = grub_register_command ("linux", grub_cmd_linux,
|
|
|
27a4da |
0, N_("Load Linux."));
|
|
|
27a4da |
cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd,
|
|
|
27a4da |
@@ -1146,6 +1150,9 @@ GRUB_MOD_INIT(linux)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI(linux)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
grub_unregister_command (cmd_linux);
|
|
|
27a4da |
grub_unregister_command (cmd_initrd);
|
|
|
27a4da |
}
|
|
|
27a4da |
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
|
|
|
28f7f8 |
index b481e466846..b19527e8e17 100644
|
|
|
27a4da |
--- a/grub-core/loader/i386/pc/linux.c
|
|
|
27a4da |
+++ b/grub-core/loader/i386/pc/linux.c
|
|
|
27a4da |
@@ -35,6 +35,7 @@
|
|
|
27a4da |
#include <grub/i386/floppy.h>
|
|
|
27a4da |
#include <grub/lib/cmdline.h>
|
|
|
27a4da |
#include <grub/linux.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -469,6 +470,9 @@ static grub_command_t cmd_linux, cmd_initrd;
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT(linux16)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
cmd_linux =
|
|
|
27a4da |
grub_register_command ("linux16", grub_cmd_linux,
|
|
|
27a4da |
0, N_("Load Linux."));
|
|
|
27a4da |
@@ -480,6 +484,9 @@ GRUB_MOD_INIT(linux16)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI(linux16)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
grub_unregister_command (cmd_linux);
|
|
|
27a4da |
grub_unregister_command (cmd_initrd);
|
|
|
27a4da |
}
|
|
|
27a4da |
diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c
|
|
|
28f7f8 |
index 4b71f336353..e4e696e8f89 100644
|
|
|
27a4da |
--- a/grub-core/loader/multiboot.c
|
|
|
27a4da |
+++ b/grub-core/loader/multiboot.c
|
|
|
27a4da |
@@ -42,6 +42,7 @@
|
|
|
27a4da |
#include <grub/video.h>
|
|
|
27a4da |
#include <grub/memory.h>
|
|
|
27a4da |
#include <grub/i18n.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -383,6 +384,9 @@ static grub_command_t cmd_multiboot, cmd_module;
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT(multiboot)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
cmd_multiboot =
|
|
|
27a4da |
#ifdef GRUB_USE_MULTIBOOT2
|
|
|
27a4da |
grub_register_command ("multiboot2", grub_cmd_multiboot,
|
|
|
27a4da |
@@ -403,6 +407,9 @@ GRUB_MOD_INIT(multiboot)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI(multiboot)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
grub_unregister_command (cmd_multiboot);
|
|
|
27a4da |
grub_unregister_command (cmd_module);
|
|
|
27a4da |
}
|
|
|
27a4da |
diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
|
|
|
28f7f8 |
index cdd9715cedd..faffccc9744 100644
|
|
|
27a4da |
--- a/grub-core/loader/xnu.c
|
|
|
27a4da |
+++ b/grub-core/loader/xnu.c
|
|
|
27a4da |
@@ -33,6 +33,7 @@
|
|
|
27a4da |
#include <grub/extcmd.h>
|
|
|
27a4da |
#include <grub/env.h>
|
|
|
27a4da |
#include <grub/i18n.h>
|
|
|
27a4da |
+#include <grub/efi/sb.h>
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
27a4da |
|
|
|
27a4da |
@@ -1466,6 +1467,9 @@ static grub_extcmd_t cmd_splash;
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_INIT(xnu)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
cmd_kernel = grub_register_command ("xnu_kernel", grub_cmd_xnu_kernel, 0,
|
|
|
27a4da |
N_("Load XNU image."));
|
|
|
27a4da |
cmd_kernel64 = grub_register_command ("xnu_kernel64", grub_cmd_xnu_kernel64,
|
|
|
27a4da |
@@ -1506,6 +1510,9 @@ GRUB_MOD_INIT(xnu)
|
|
|
27a4da |
|
|
|
27a4da |
GRUB_MOD_FINI(xnu)
|
|
|
27a4da |
{
|
|
|
27a4da |
+ if (grub_efi_secure_boot())
|
|
|
27a4da |
+ return;
|
|
|
27a4da |
+
|
|
|
27a4da |
#ifndef GRUB_MACHINE_EMU
|
|
|
27a4da |
grub_unregister_command (cmd_resume);
|
|
|
27a4da |
#endif
|
|
|
27a4da |
diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
|
|
|
28f7f8 |
index 22456327e13..9a2da0eb38d 100644
|
|
|
27a4da |
--- a/include/grub/efi/efi.h
|
|
|
27a4da |
+++ b/include/grub/efi/efi.h
|
|
|
27a4da |
@@ -76,7 +76,6 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
|
|
|
27a4da |
const grub_efi_guid_t *guid,
|
|
|
27a4da |
void *data,
|
|
|
27a4da |
grub_size_t datasize);
|
|
|
27a4da |
-grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);
|
|
|
27a4da |
int
|
|
|
27a4da |
EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
|
|
|
27a4da |
const grub_efi_device_path_t *dp2);
|
|
|
27a4da |
diff --git a/include/grub/efi/sb.h b/include/grub/efi/sb.h
|
|
|
27a4da |
new file mode 100644
|
|
|
28f7f8 |
index 00000000000..9629fbb0f9e
|
|
|
27a4da |
--- /dev/null
|
|
|
27a4da |
+++ b/include/grub/efi/sb.h
|
|
|
27a4da |
@@ -0,0 +1,29 @@
|
|
|
27a4da |
+/* sb.h - declare functions for EFI Secure Boot support */
|
|
|
27a4da |
+/*
|
|
|
27a4da |
+ * GRUB -- GRand Unified Bootloader
|
|
|
27a4da |
+ * Copyright (C) 2006,2007,2008,2009 Free Software Foundation, Inc.
|
|
|
27a4da |
+ *
|
|
|
27a4da |
+ * GRUB is free software: you can redistribute it and/or modify
|
|
|
27a4da |
+ * it under the terms of the GNU General Public License as published by
|
|
|
27a4da |
+ * the Free Software Foundation, either version 3 of the License, or
|
|
|
27a4da |
+ * (at your option) any later version.
|
|
|
27a4da |
+ *
|
|
|
27a4da |
+ * GRUB is distributed in the hope that it will be useful,
|
|
|
27a4da |
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
27a4da |
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
27a4da |
+ * GNU General Public License for more details.
|
|
|
27a4da |
+ *
|
|
|
27a4da |
+ * You should have received a copy of the GNU General Public License
|
|
|
27a4da |
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
|
|
27a4da |
+ */
|
|
|
27a4da |
+
|
|
|
27a4da |
+#ifndef GRUB_EFI_SB_HEADER
|
|
|
27a4da |
+#define GRUB_EFI_SB_HEADER 1
|
|
|
27a4da |
+
|
|
|
27a4da |
+#include <grub/types.h>
|
|
|
27a4da |
+#include <grub/dl.h>
|
|
|
27a4da |
+
|
|
|
27a4da |
+/* Functions. */
|
|
|
27a4da |
+int EXPORT_FUNC (grub_efi_secure_boot) (void);
|
|
|
27a4da |
+
|
|
|
27a4da |
+#endif /* ! GRUB_EFI_SB_HEADER */
|
|
|
27a4da |
diff --git a/include/grub/ia64/linux.h b/include/grub/ia64/linux.h
|
|
|
27a4da |
new file mode 100644
|
|
|
28f7f8 |
index 00000000000..e69de29bb2d
|
|
|
27a4da |
diff --git a/include/grub/mips/linux.h b/include/grub/mips/linux.h
|
|
|
27a4da |
new file mode 100644
|
|
|
28f7f8 |
index 00000000000..e69de29bb2d
|
|
|
27a4da |
diff --git a/include/grub/powerpc/linux.h b/include/grub/powerpc/linux.h
|
|
|
27a4da |
new file mode 100644
|
|
|
28f7f8 |
index 00000000000..e69de29bb2d
|
|
|
27a4da |
diff --git a/include/grub/sparc64/linux.h b/include/grub/sparc64/linux.h
|
|
|
27a4da |
new file mode 100644
|
|
|
28f7f8 |
index 00000000000..e69de29bb2d
|
|
|
28f7f8 |
diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
|
|
|
28f7f8 |
index cb7fd9f98e8..be29e327f77 100644
|
|
|
28f7f8 |
--- a/grub-core/Makefile.am
|
|
|
28f7f8 |
+++ b/grub-core/Makefile.am
|
|
|
28f7f8 |
@@ -67,6 +67,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/command.h
|
|
|
28f7f8 |
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/device.h
|
|
|
28f7f8 |
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/disk.h
|
|
|
28f7f8 |
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/dl.h
|
|
|
28f7f8 |
+KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/efi/sb.h
|
|
|
28f7f8 |
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/env.h
|
|
|
28f7f8 |
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/env_private.h
|
|
|
28f7f8 |
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/err.h
|