From e8d04bfdc9e103879fa649763f14259b6d376ad6e34f9ef685226877e3ce4674 Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Tue, 10 Mar 2020 06:21:18 +0000 Subject: [PATCH] Accepting request 783045 from home:rwill:branches:Base:System Add secure boot support for s390x. (jsc#SLE-9425) OBS-URL: https://build.opensuse.org/request/show/783045 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=347 --- grub2-s390x-11-secureboot.patch | 153 ++++++++++++++++++++++++++++++++ grub2.changes | 6 ++ grub2.spec | 2 + 3 files changed, 161 insertions(+) create mode 100644 grub2-s390x-11-secureboot.patch diff --git a/grub2-s390x-11-secureboot.patch b/grub2-s390x-11-secureboot.patch new file mode 100644 index 0000000..6a8b177 --- /dev/null +++ b/grub2-s390x-11-secureboot.patch @@ -0,0 +1,153 @@ +--- + grub-core/loader/emu/linux.c | 4 ++-- + util/s390x/dracut-grub2.sh.in | 14 ++++++++++++-- + util/s390x/zipl2grub.conf.in | 1 + + util/s390x/zipl2grub.pl.in | 31 ++++++++++++++++++++++--------- + 4 files changed, 37 insertions(+), 13 deletions(-) + +--- a/grub-core/loader/emu/linux.c ++++ b/grub-core/loader/emu/linux.c +@@ -38,7 +38,7 @@ grub_linux_boot (void) + { + grub_err_t rc = GRUB_ERR_NONE; + char *initrd_param; +- const char *kexec[] = { "kexec", "-l", kernel_path, boot_cmdline, NULL, NULL }; ++ const char *kexec[] = { "kexec", "-la", kernel_path, boot_cmdline, NULL, NULL }; + const char *systemctl[] = { "systemctl", "kexec", NULL }; + int kexecute = grub_util_get_kexecute(); + +@@ -51,7 +51,7 @@ grub_linux_boot (void) + //return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("initrd required!")); + } + +- grub_printf("%serforming 'kexec -l %s %s %s'\n", ++ grub_printf("%serforming 'kexec -la %s %s %s'\n", + (kexecute) ? "P" : "Not p", + kernel_path, initrd_param, boot_cmdline); + +--- a/util/s390x/dracut-grub2.sh.in ++++ b/util/s390x/dracut-grub2.sh.in +@@ -18,6 +18,9 @@ if getargbool 0 initgrub && [ ! -e /grub + done < /proc/mounts + echo $rofs + } ++ checkcat() { ++ [ -r $1 ] && cat $1 ++ } + checkd() { + [ -d $1 ] && echo true || echo false + } +@@ -63,6 +66,7 @@ if getargbool 0 initgrub && [ ! -e /grub + export grub2bootfs=$(checkboot) + export grub2devfs=$(checkd /sysroot/dev/disk) + export grub2snap=$(checksnap) ++ export grub2secure=$(checkcat /sys/firmware/ipl/secure) + debug "" export -p + + _ctty="$(RD_DEBUG= getarg rd.ctty=)" && _ctty="/dev/${_ctty##*/}" +@@ -93,7 +97,7 @@ if getargbool 0 initgrub && [ ! -e /grub + debug "Trying grub2-emu (ro=$grub2rofs, TERM=$TERM, ctty=$_ctty)..." + setsid $CTTY -- chroot /sysroot $bindir/grub2-emu -X -X 0<>$_ctty 1>&0 2>&0 + +- if [ -x /sysroot@libdir@/grub2/zipl-refresh ]; then ++ if [ "$grub2secure" != 1 ]&&[ -x /sysroot@libdir@/grub2/zipl-refresh ]; then + setsid $CTTY -- /sysroot@libdir@/grub2/zipl-refresh 0<>$_ctty 1>&0 2>&0 + if [ $? != 0 ]; then + warn "Not continuing" +@@ -103,12 +107,18 @@ if getargbool 0 initgrub && [ ! -e /grub + sleep 3 + reboot + fi +- else ++ elif [ "$grub2secure" != 1 ]; then + echo " + Attention: 'grub2' failed to start the target kernel and 'zipl-refresh' + is not available. This should never happen. Please contact support." >& $_ctty + warn "Not continuing" + emergency_shell -n grub2-emu-kexec ++ else ++ echo " ++ Attention: 'grub2' failed to start the target kernel and secure boot seems ++ active. Automatic recovery not available. Please contact support." >& $_ctty ++ warn "Not continuing" ++ emergency_shell -n grub2-emu-kexec + fi + + $grub2snap || umount /sysroot/.snapshots +--- a/util/s390x/zipl2grub.conf.in ++++ b/util/s390x/zipl2grub.conf.in +@@ -45,6 +45,7 @@ defaultmenu = menu + timeout = 60 + default = 1 + prompt = 0 ++ secure = @SUSE_SECURE_BOOT@ + 1 = grub2 + 2 = skip-grub2 + 3 = grub2-mem1G +--- a/util/s390x/zipl2grub.pl.in ++++ b/util/s390x/zipl2grub.pl.in +@@ -21,6 +21,7 @@ my $miss = 0; + my $cfg = ""; + my %fsdev = (); + my %fstype = (); ++my %SBL = (); # key/value of $sysconfbl + + my %C = ( + GRUB_CMDLINE_LINUX_DEFAULT => "quiet splash=silent", +@@ -251,6 +252,15 @@ if ( -r $default ) { + } + close( IN); + } ++if ( -r $sysconfbl ) { ++ open( IN, "< $sysconfbl") || die; ++ while ( ) { ++ next if ( m{^\s*#} ); ++ next unless ( m{^\s*([^=#\s]+)="(.*)"(?:\s*|\s+#.*)$} ); ++ $SBL{$1} = $2; ++ } ++ close( IN); ++} + if ( -r "/etc/fstab" ) { + my $regex = qr{^(\S+)\s+(\S+)\s+(\S+)\s+\S+\s+\S+\s+\S+\s*(?:#.*)?$}; + open( IN, "< /etc/fstab") || die; +@@ -313,21 +323,21 @@ if ( ! exists( $C{GRUB_DEVICE}) ) { + } + } + if ( $C{GRUB_CMDLINE_LINUX_DEFAULT} eq "quiet splash=silent" && +- -r $sysconfbl) { +- open( IN, "< $sysconfbl") || die; +- while ( ) { +- next if ( m{^\s*#} ); +- if ( m{^DEFAULT_APPEND=".*"(?:\s*|\s+#.*)$} ) { +- $C{GRUB_CMDLINE_LINUX_DEFAULT} = $1; +- } +- } +- close( IN); ++ exists( $SBL{DEFAULT_APPEND}) ) { ++ $C{GRUB_CMDLINE_LINUX_DEFAULT} = $SBL{DEFAULT_APPEND}; + } + + if ( ! exists( $C{GRUB_DEVICE})) { + Panic( 0, "$C: Default not ready and no fallback. Please retry later!\n"); + } + ++if ( !exists( $C{SUSE_SECURE_BOOT}) ) { ++ $C{SUSE_SECURE_BOOT} = "0"; ++ if ( exists( $SBL{SECURE_BOOT}) && $SBL{SECURE_BOOT} =~ m{^(yes|true|1)$} ) { ++ $C{SUSE_SECURE_BOOT} = "1"; ++ } ++} ++ + if ( ! exists( $C{GRUB_EMU_CONMODE}) && exists( $C{GRUB_CONMODE}) ) { + # GRUB_CONMODE is used for 'grub2-emu' as well + $C{GRUB_EMU_CONMODE} = $C{GRUB_CONMODE}; +@@ -360,6 +370,9 @@ if ( $debug && $verbose > 2 ) { + foreach ( sort( keys( %C)) ) { + printf( "%s=\"%s\"\n", $_, $C{$_}); + } ++ foreach ( sort( keys( %SBL)) ) { ++ printf( "SBL: %s=\"%s\"\n", $_, $SBL{$_}); ++ } + } + + open( IN, "< $in") || diff --git a/grub2.changes b/grub2.changes index 74c9e09..52d78ab 100644 --- a/grub2.changes +++ b/grub2.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Fri Feb 28 16:36:57 UTC 2020 - rw@suse.com + +- Add secure boot support for s390x. (jsc#SLE-9425) + * grub2-s390x-11-secureboot.patch + ------------------------------------------------------------------- Tue Feb 18 08:43:30 UTC 2020 - Michael Chang diff --git a/grub2.spec b/grub2.spec index 9af7ddd..ba088f4 100644 --- a/grub2.spec +++ b/grub2.spec @@ -279,6 +279,7 @@ Patch421: 0002-AUDIT-0-http-boot-tracker-bug.patch # and/or use fallback entry if default kernel entry removed (bsc#1065349) Patch430: grub2-mkconfig-default-entry-correction.patch Patch431: grub2-s390x-10-keep-network-at-kexec.patch +Patch432: grub2-s390x-11-secureboot.patch # Support for UEFI Secure Boot on AArch64 (FATE#326541) Patch450: grub2-secureboot-install-signed-grub.patch Patch501: grub2-btrfs-help-on-snapper-rollback.patch @@ -553,6 +554,7 @@ swap partition while in resuming %patch421 -p1 %patch430 -p1 %patch431 -p1 +%patch432 -p1 %patch450 -p1 %patch501 -p1 %patch510 -p1