debian/patches/linuxefi-use-if-secure-boot.patch

   1 From 153f7d223ea89a53e014ce57b5438de593ad1947 Mon Sep 17 00:00:00 2001
   2 From: Colin Watson <cjwatson@ubuntu.com>
   3 Date: Mon, 13 Jan 2014 12:13:20 +0000
   4 Subject: If running under UEFI secure boot, use linuxefi loader
   5
   6 If linuxefi fails to verify the kernel's signature, then refuse to boot.
   7
   8 Author: Steve Langasek <steve.langasek@canonical.com>
   9 Author: Linn Crosetto <linn@hpe.com>
  10 Forwarded: no
  11 Last-Update: 2019-05-24
  12
  13 Patch-Name: linuxefi-use-if-secure-boot.patch
  14 ---
  15  grub-core/loader/i386/efi/linux.c |  2 +-
  16  grub-core/loader/i386/linux.c     | 41 +++++++++++++++++++++++++++++++
  17  2 files changed, 42 insertions(+), 1 deletion(-)
  18
  19 diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c
  20 index dd376ce03..b731b9201 100644
  21 --- a/grub-core/loader/i386/efi/linux.c
  22 +++ b/grub-core/loader/i386/efi/linux.c
  23 @@ -208,7 +208,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  24
  25    if (! grub_linuxefi_secure_validate (kernel, filelen))
  26      {
  27 -      grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), argv[0]);
  28 +      grub_error (GRUB_ERR_ACCESS_DENIED, N_("%s has invalid signature"), argv[0]);
  29        grub_free (kernel);
  30        goto fail;
  31      }
  32 diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
  33 index d0501e229..2eab9bb10 100644
  34 --- a/grub-core/loader/i386/linux.c
  35 +++ b/grub-core/loader/i386/linux.c
  36 @@ -76,6 +76,8 @@ static grub_size_t maximal_cmdline_size;
  37  static struct linux_kernel_params linux_params;
  38  static char *linux_cmdline;
  39  #ifdef GRUB_MACHINE_EFI
  40 +static int using_linuxefi;
  41 +static grub_command_t initrdefi_cmd;
  42  static grub_efi_uintn_t efi_mmap_size;
  43  #else
  44  static const grub_size_t efi_mmap_size = 0;
  45 @@ -651,6 +653,39 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  46
  47    grub_dl_ref (my_mod);
  48
  49 +#ifdef GRUB_MACHINE_EFI
  50 +  using_linuxefi = 0;
  51 +  if (grub_efi_secure_boot ())
  52 +    {
  53 +      /* linuxefi requires a successful signature check and then hand over
  54 +        to the kernel without calling ExitBootServices. */
  55 +      grub_dl_t mod;
  56 +      grub_command_t linuxefi_cmd;
  57 +
  58 +      grub_dprintf ("linux", "Secure Boot enabled: trying linuxefi\n");
  59 +
  60 +      mod = grub_dl_load ("linuxefi");
  61 +      if (mod)
  62 +       {
  63 +         grub_dl_ref (mod);
  64 +         linuxefi_cmd = grub_command_find ("linuxefi");
  65 +         initrdefi_cmd = grub_command_find ("initrdefi");
  66 +         if (linuxefi_cmd && initrdefi_cmd)
  67 +           {
  68 +             (linuxefi_cmd->func) (linuxefi_cmd, argc, argv);
  69 +             if (grub_errno == GRUB_ERR_NONE)
  70 +               {
  71 +                 grub_dprintf ("linux", "Handing off to linuxefi\n");
  72 +                 using_linuxefi = 1;
  73 +                 return GRUB_ERR_NONE;
  74 +               }
  75 +             grub_dprintf ("linux", "linuxefi failed (%d)\n", grub_errno);
  76 +             goto fail;
  77 +           }
  78 +       }
  79 +    }
  80 +#endif
  81 +
  82    if (argc == 0)
  83      {
  84        grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
  85 @@ -1036,6 +1071,12 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
  86    grub_err_t err;
  87    struct grub_linux_initrd_context initrd_ctx = { 0, 0, 0 };
  88
  89 +#ifdef GRUB_MACHINE_EFI
  90 +  /* If we're using linuxefi, just forward to initrdefi.  */
  91 +  if (using_linuxefi && initrdefi_cmd)
  92 +    return (initrdefi_cmd->func) (initrdefi_cmd, argc, argv);
  93 +#endif
  94 +
  95    if (argc == 0)
  96      {
  97        grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));