grub2/grub2-s390x-11-secureboot.patch

154 lines
4.8 KiB
Diff

---
grub-core/loader/emu/linux.c | 4 ++--
util/s390x/dracut-grub2.sh.in | 14 ++++++++++++--
util/s390x/zipl2grub.conf.in | 1 +
util/s390x/zipl2grub.pl.in | 31 ++++++++++++++++++++++---------
4 files changed, 37 insertions(+), 13 deletions(-)
--- a/grub-core/loader/emu/linux.c
+++ b/grub-core/loader/emu/linux.c
@@ -38,7 +38,7 @@ grub_linux_boot (void)
{
grub_err_t rc = GRUB_ERR_NONE;
char *initrd_param;
- const char *kexec[] = { "kexec", "-l", kernel_path, boot_cmdline, NULL, NULL };
+ const char *kexec[] = { "kexec", "-la", kernel_path, boot_cmdline, NULL, NULL };
const char *systemctl[] = { "systemctl", "kexec", NULL };
int kexecute = grub_util_get_kexecute();
@@ -51,7 +51,7 @@ grub_linux_boot (void)
//return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("initrd required!"));
}
- grub_printf("%serforming 'kexec -l %s %s %s'\n",
+ grub_printf("%serforming 'kexec -la %s %s %s'\n",
(kexecute) ? "P" : "Not p",
kernel_path, initrd_param, boot_cmdline);
--- a/util/s390x/dracut-grub2.sh.in
+++ b/util/s390x/dracut-grub2.sh.in
@@ -18,6 +18,9 @@ if getargbool 0 initgrub && [ ! -e /grub
done < /proc/mounts
echo $rofs
}
+ checkcat() {
+ [ -r $1 ] && cat $1
+ }
checkd() {
[ -d $1 ] && echo true || echo false
}
@@ -63,6 +66,7 @@ if getargbool 0 initgrub && [ ! -e /grub
export grub2bootfs=$(checkboot)
export grub2devfs=$(checkd /sysroot/dev/disk)
export grub2snap=$(checksnap)
+ export grub2secure=$(checkcat /sys/firmware/ipl/secure)
debug "" export -p
_ctty="$(RD_DEBUG= getarg rd.ctty=)" && _ctty="/dev/${_ctty##*/}"
@@ -93,7 +97,7 @@ if getargbool 0 initgrub && [ ! -e /grub
debug "Trying grub2-emu (ro=$grub2rofs, TERM=$TERM, ctty=$_ctty)..."
setsid $CTTY -- chroot /sysroot $bindir/grub2-emu -X -X 0<>$_ctty 1>&0 2>&0
- if [ -x /sysroot@libdir@/grub2/zipl-refresh ]; then
+ if [ "$grub2secure" != 1 ]&&[ -x /sysroot@libdir@/grub2/zipl-refresh ]; then
setsid $CTTY -- /sysroot@libdir@/grub2/zipl-refresh 0<>$_ctty 1>&0 2>&0
if [ $? != 0 ]; then
warn "Not continuing"
@@ -103,12 +107,18 @@ if getargbool 0 initgrub && [ ! -e /grub
sleep 3
reboot
fi
- else
+ elif [ "$grub2secure" != 1 ]; then
echo "
Attention: 'grub2' failed to start the target kernel and 'zipl-refresh'
is not available. This should never happen. Please contact support." >& $_ctty
warn "Not continuing"
emergency_shell -n grub2-emu-kexec
+ else
+ echo "
+ Attention: 'grub2' failed to start the target kernel and secure boot seems
+ active. Automatic recovery not available. Please contact support." >& $_ctty
+ warn "Not continuing"
+ emergency_shell -n grub2-emu-kexec
fi
$grub2snap || umount /sysroot/.snapshots
--- a/util/s390x/zipl2grub.conf.in
+++ b/util/s390x/zipl2grub.conf.in
@@ -45,6 +45,7 @@ defaultmenu = menu
timeout = 60
default = 1
prompt = 0
+ secure = @SUSE_SECURE_BOOT@
1 = grub2
2 = skip-grub2
3 = grub2-mem1G
--- a/util/s390x/zipl2grub.pl.in
+++ b/util/s390x/zipl2grub.pl.in
@@ -21,6 +21,7 @@ my $miss = 0;
my $cfg = "";
my %fsdev = ();
my %fstype = ();
+my %SBL = (); # key/value of $sysconfbl
my %C = (
GRUB_CMDLINE_LINUX_DEFAULT => "quiet splash=silent",
@@ -251,6 +252,15 @@ if ( -r $default ) {
}
close( IN);
}
+if ( -r $sysconfbl ) {
+ open( IN, "< $sysconfbl") || die;
+ while ( <IN> ) {
+ next if ( m{^\s*#} );
+ next unless ( m{^\s*([^=#\s]+)="(.*)"(?:\s*|\s+#.*)$} );
+ $SBL{$1} = $2;
+ }
+ close( IN);
+}
if ( -r "/etc/fstab" ) {
my $regex = qr{^(\S+)\s+(\S+)\s+(\S+)\s+\S+\s+\S+\s+\S+\s*(?:#.*)?$};
open( IN, "< /etc/fstab") || die;
@@ -313,21 +323,21 @@ if ( ! exists( $C{GRUB_DEVICE}) ) {
}
}
if ( $C{GRUB_CMDLINE_LINUX_DEFAULT} eq "quiet splash=silent" &&
- -r $sysconfbl) {
- open( IN, "< $sysconfbl") || die;
- while ( <IN> ) {
- next if ( m{^\s*#} );
- if ( m{^DEFAULT_APPEND=".*"(?:\s*|\s+#.*)$} ) {
- $C{GRUB_CMDLINE_LINUX_DEFAULT} = $1;
- }
- }
- close( IN);
+ exists( $SBL{DEFAULT_APPEND}) ) {
+ $C{GRUB_CMDLINE_LINUX_DEFAULT} = $SBL{DEFAULT_APPEND};
}
if ( ! exists( $C{GRUB_DEVICE})) {
Panic( 0, "$C: Default not ready and no fallback. Please retry later!\n");
}
+if ( !exists( $C{SUSE_SECURE_BOOT}) ) {
+ $C{SUSE_SECURE_BOOT} = "0";
+ if ( exists( $SBL{SECURE_BOOT}) && $SBL{SECURE_BOOT} =~ m{^(yes|true|1)$} ) {
+ $C{SUSE_SECURE_BOOT} = "1";
+ }
+}
+
if ( ! exists( $C{GRUB_EMU_CONMODE}) && exists( $C{GRUB_CONMODE}) ) {
# GRUB_CONMODE is used for 'grub2-emu' as well
$C{GRUB_EMU_CONMODE} = $C{GRUB_CONMODE};
@@ -360,6 +370,9 @@ if ( $debug && $verbose > 2 ) {
foreach ( sort( keys( %C)) ) {
printf( "%s=\"%s\"\n", $_, $C{$_});
}
+ foreach ( sort( keys( %SBL)) ) {
+ printf( "SBL: %s=\"%s\"\n", $_, $SBL{$_});
+ }
}
open( IN, "< $in") ||