api: nodes: add info about current boot mode

report if the node is booted in EFI or Legacy BIOS mode, for the
former also pass along the secure boot state.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/PVE/API2/Nodes.pm b/PVE/API2/Nodes.pm
index f4b70b3d9d5be1d0092dabfebe1d5b19215c5264..c1d5f5ea7a7b1d2c2c907441b163972cd10c8d60 100644 (file)
--- a/PVE/API2/Nodes.pm
+++ b/PVE/API2/Nodes.pm
@@ -35,7 +35,7 @@ use PVE::RRD;
 use PVE::Report;
 use PVE::SafeSyslog;
 use PVE::Storage;
-use PVE::Tools;
+use PVE::Tools qw(file_get_contents);
 use PVE::pvecfg;
 
 use PVE::API2::APT;
@@ -355,6 +355,25 @@ my sub get_current_kernel_info {
     return ($current_kernel, $kernel_version_string);
 }
 
+my sub get_boot_mode_info {
+    my $is_efi_booted = -d "/sys/firmware/efi";
+
+    my $info = {
+       mode => $is_efi_booted ? 'efi' : 'legacy-bios',
+    };
+
+    if ($is_efi_booted) {
+       my $efi_var_sec_boot_entry = eval { file_get_contents("/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c") };
+       if ($@) {
+           warn "Failed to read secure boot state: $@\n";
+       } else {
+           my @secureboot = unpack("CCCCC", $efi_var_sec_boot_entry);
+           $info->{secureboot} = $secureboot[4] == 1 ? 1 : 0;
+       }
+    }
+    return $info;
+}
+
 __PACKAGE__->register_method({
     name => 'status',
     path => 'status',
@@ -394,6 +413,8 @@ __PACKAGE__->register_method({
        $res->{kversion} = $kversion_string;
        $res->{'current-kernel'} = $current_kernel_info;
 
+       $res->{'boot-info'} = get_boot_mode_info();
+
        $res->{cpuinfo} = PVE::ProcFSTools::read_cpuinfo();
 
        my $stat = PVE::ProcFSTools::read_proc_stat();