debian/patches/grub-install-removable-shim.patch

   1 From cb2746b915b7d8b5a3c78fae3d40fc0ccc41b650 Mon Sep 17 00:00:00 2001
   2 From: Steve McIntyre <93sam@debian.org>
   3 Date: Fri, 14 Jun 2019 16:37:11 +0100
   4 Subject: Deal with --force-extra-removable with signed shim too
   5
   6 In this case, we need both the signed shim as /EFI/BOOT/BOOTXXX.EFI
   7 and signed Grub as /EFI/BOOT/grubXXX.efi.
   8
   9 Also install the BOOTXXX.CSV into /EFI/debian, and FBXXX.EFI into
  10 /EFI/BOOT/ so that it can work when needed (*iff* we're updating the
  11 NVRAM).
  12
  13 [cjwatson: Refactored also_install_removable somewhat for brevity and so
  14 that we're using consistent case-insensitive logic.]
  15
  16 Bug-Debian: https://bugs.debian.org/930531
  17 Last-Update: 2019-06-14
  18
  19 Patch-Name: grub-install-removable-shim.patch
  20 ---
  21  util/grub-install.c | 84 ++++++++++++++++++++++++++++++++++++---------
  22  1 file changed, 67 insertions(+), 17 deletions(-)
  23
  24 diff --git a/util/grub-install.c b/util/grub-install.c
  25 index fdec5dd83..666cef3d2 100644
  26 --- a/util/grub-install.c
  27 +++ b/util/grub-install.c
  28 @@ -883,17 +883,13 @@ check_component_exists(const char *dir,
  29  static void
  30  also_install_removable(const char *src,
  31                        const char *base_efidir,
  32 -                      const char *efi_suffix_upper)
  33 +                      const char *efi_file,
  34 +                      int is_needed)
  35  {
  36 -  char *efi_file = NULL;
  37    char *dst = NULL;
  38    char *cur = NULL;
  39    char *found = NULL;
  40
  41 -  if (!efi_suffix_upper)
  42 -    grub_util_error ("%s", _("efi_suffix_upper not set"));
  43 -  efi_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
  44 -
  45    /* We need to install in $base_efidir/EFI/BOOT/$efi_file, but we
  46     * need to cope with case-insensitive stuff here. Build the path one
  47     * component at a time, checking for existing matches each time. */
  48 @@ -927,10 +923,9 @@ also_install_removable(const char *src,
  49    cur = xstrdup (dst);
  50    free (dst);
  51    free (found);
  52 -  grub_install_copy_file (src, cur, 1);
  53 +  grub_install_copy_file (src, cur, is_needed);
  54
  55    free (cur);
  56 -  free (efi_file);
  57  }
  58
  59  int
  60 @@ -2078,11 +2073,14 @@ main (int argc, char *argv[])
  61      case GRUB_INSTALL_PLATFORM_IA64_EFI:
  62        {
  63         char *dst = grub_util_path_concat (2, efidir, efi_file);
  64 +       char *removable_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
  65 +
  66         if (uefi_secure_boot)
  67           {
  68             char *shim_signed = NULL;
  69             char *mok_signed = NULL, *mok_file = NULL;
  70             char *fb_signed = NULL, *fb_file = NULL;
  71 +           char *csv_file = NULL;
  72             char *config_dst;
  73             FILE *config_dst_f;
  74
  75 @@ -2091,11 +2089,15 @@ main (int argc, char *argv[])
  76             mok_file = xasprintf ("mm%s.efi", efi_suffix);
  77             fb_signed = xasprintf ("fb%s.efi.signed", efi_suffix);
  78             fb_file = xasprintf ("fb%s.efi", efi_suffix);
  79 +           csv_file = xasprintf ("BOOT%s.CSV", efi_suffix_upper);
  80 +
  81 +           /* If we have a signed shim binary, install that and all
  82 +              its helpers in the normal vendor path */
  83
  84             if (grub_util_is_regular (shim_signed))
  85               {
  86                 char *chained_base, *chained_dst;
  87 -               char *mok_src, *mok_dst, *fb_src, *fb_dst;
  88 +               char *mok_src, *mok_dst, *fb_src, *fb_dst, *csv_src, *csv_dst;
  89                 if (!removable)
  90                   {
  91                     free (efi_file);
  92 @@ -2107,8 +2109,6 @@ main (int argc, char *argv[])
  93                 chained_base = xasprintf ("grub%s.efi", efi_suffix);
  94                 chained_dst = grub_util_path_concat (2, efidir, chained_base);
  95                 grub_install_copy_file (efi_signed, chained_dst, 1);
  96 -               free (chained_dst);
  97 -               free (chained_base);
  98
  99                 /* Not critical, so not an error if they are not present (as it
 100                    won't be for older releases); but if we have them, make
 101 @@ -2119,8 +2119,6 @@ main (int argc, char *argv[])
 102                                                     mok_file);
 103                 grub_install_copy_file (mok_src,
 104                                         mok_dst, 0);
 105 -               free (mok_src);
 106 -               free (mok_dst);
 107
 108                 fb_src = grub_util_path_concat (2, "/usr/lib/shim/",
 109                                                     fb_signed);
 110 @@ -2128,27 +2126,79 @@ main (int argc, char *argv[])
 111                                                     fb_file);
 112                 grub_install_copy_file (fb_src,
 113                                         fb_dst, 0);
 114 +
 115 +               csv_src = grub_util_path_concat (2, "/usr/lib/shim/",
 116 +                                                   csv_file);
 117 +               csv_dst = grub_util_path_concat (2, efidir,
 118 +                                                   csv_file);
 119 +               grub_install_copy_file (csv_src,
 120 +                                       csv_dst, 0);
 121 +
 122 +               /* Install binaries into .../EFI/BOOT too:
 123 +                  the shim binary
 124 +                  the grub binary
 125 +                  the shim fallback binary (not fatal on failure) */
 126 +               if (force_extra_removable)
 127 +                 {
 128 +                   grub_util_info ("Secure boot: installing shim and image into rm path");
 129 +                   also_install_removable (shim_signed, base_efidir, removable_file, 1);
 130 +
 131 +                   also_install_removable (efi_signed, base_efidir, chained_base, 1);
 132 +
 133 +                   /* If we're updating the NVRAM, add fallback too - it
 134 +                       will re-update the NVRAM later if things break */
 135 +                   if (update_nvram)
 136 +                     also_install_removable (fb_src, base_efidir, fb_file, 0);
 137 +                 }
 138 +
 139 +               free (chained_dst);
 140 +               free (chained_base);
 141 +               free (mok_src);
 142 +               free (mok_dst);
 143                 free (fb_src);
 144                 free (fb_dst);
 145 +               free (csv_src);
 146 +               free (csv_dst);
 147               }
 148             else
 149 -             grub_install_copy_file (efi_signed, dst, 1);
 150 +             {
 151 +               /* Tried to install for secure boot, but no signed
 152 +                  shim found. Fall back to just installing the signed
 153 +                  grub binary */
 154 +               grub_util_info ("Secure boot (no shim): installing signed grub binary");
 155 +               grub_install_copy_file (efi_signed, dst, 1);
 156 +               if (force_extra_removable)
 157 +                 {
 158 +                   grub_util_info ("Secure boot (no shim): installing signed grub binary into rm path");
 159 +                   also_install_removable (efi_signed, base_efidir, removable_file, 1);
 160 +                 }
 161 +             }
 162
 163 +           /* In either case, install our grub.cfg */
 164             config_dst = grub_util_path_concat (2, efidir, "grub.cfg");
 165             grub_install_copy_file (load_cfg, config_dst, 1);
 166             config_dst_f = grub_util_fopen (config_dst, "ab");
 167             fprintf (config_dst_f, "configfile $prefix/grub.cfg\n");
 168             fclose (config_dst_f);
 169             free (config_dst);
 170 -           if (force_extra_removable)
 171 -             also_install_removable(efi_signed, base_efidir, efi_suffix_upper);
 172 +
 173 +           free (csv_file);
 174 +           free (fb_file);
 175 +           free (fb_signed);
 176 +           free (mok_file);
 177 +           free (mok_signed);
 178 +           free (shim_signed);
 179           }
 180         else
 181           {
 182 +           /* No secure boot - just install our newly-generated image */
 183 +           grub_util_info ("No Secure Boot: installing core image");
 184             grub_install_copy_file (imgfile, dst, 1);
 185             if (force_extra_removable)
 186 -             also_install_removable(imgfile, base_efidir, efi_suffix_upper);
 187 +             also_install_removable (imgfile, base_efidir, removable_file, 1);
 188           }
 189 +
 190 +       free (removable_file);
 191         free (dst);
 192        }
 193        if (!removable && update_nvram)