81 lines
3.3 KiB
Diff
81 lines
3.3 KiB
Diff
From 72d766c5a17fc31902b367e949c4d90193f823b9 Mon Sep 17 00:00:00 2001
|
|
From: Franck Bui <fbui@suse.com>
|
|
Date: Fri, 22 Mar 2024 12:07:34 +0100
|
|
Subject: [PATCH 1/1] Drop support for efivar SystemdOptions
|
|
|
|
Upstream deprecated it and plan to drop it in the future.
|
|
|
|
Let's get ahead and drop it now as this feature might be used to gain access to
|
|
encrypted SLEM systems with unattended disk unlock and with secure boot
|
|
disabled.
|
|
|
|
[fbui: fixes bsc#1220338]
|
|
---
|
|
src/basic/efivars.c | 27 ++++++--------------------
|
|
src/boot/bootctl-systemd-efi-options.c | 4 ++++
|
|
2 files changed, 10 insertions(+), 21 deletions(-)
|
|
|
|
diff --git a/src/basic/efivars.c b/src/basic/efivars.c
|
|
index 9011ae29a3..01ab7e5092 100644
|
|
--- a/src/basic/efivars.c
|
|
+++ b/src/basic/efivars.c
|
|
@@ -351,29 +351,14 @@ SecureBootMode efi_get_secure_boot_mode(void) {
|
|
}
|
|
|
|
static int read_efi_options_variable(char **ret) {
|
|
- int r;
|
|
|
|
- /* In SecureBoot mode this is probably not what you want. As your cmdline is cryptographically signed
|
|
- * like when using Type #2 EFI Unified Kernel Images (https://uapi-group.org/specifications/specs/boot_loader_specification)
|
|
- * The user's intention is then that the cmdline should not be modified. You want to make sure that
|
|
- * the system starts up as exactly specified in the signed artifact.
|
|
- *
|
|
- * (NB: For testing purposes, we still check the $SYSTEMD_EFI_OPTIONS env var before accessing this
|
|
- * cache, even when in SecureBoot mode.) */
|
|
- if (is_efi_secure_boot()) {
|
|
- /* Let's be helpful with the returned error and check if the variable exists at all. If it
|
|
- * does, let's return a recognizable error (EPERM), and if not ENODATA. */
|
|
-
|
|
- if (access(EFIVAR_PATH(EFI_SYSTEMD_VARIABLE(SystemdOptions)), F_OK) < 0)
|
|
- return errno == ENOENT ? -ENODATA : -errno;
|
|
-
|
|
- return -EPERM;
|
|
- }
|
|
+ /* For SUSE distros, support for SystemdOptions has already been dropped as it might be a security
|
|
+ * concern for systems with unattended disk unlock and with disabled secure boot. */
|
|
|
|
- r = efi_get_variable_string(EFI_SYSTEMD_VARIABLE(SystemdOptions), ret);
|
|
- if (r == -ENOENT)
|
|
- return -ENODATA;
|
|
- return r;
|
|
+ if (access(EFIVAR_PATH(EFI_SYSTEMD_VARIABLE(SystemdOptions)), F_OK) < 0)
|
|
+ return errno == ENOENT ? -ENODATA : -errno;
|
|
+
|
|
+ return log_warning_errno(SYNTHETIC_ERRNO(EPERM), "Boot options passed via SystemdOptions EFI variable is no more supported, ignoring: %m");
|
|
}
|
|
|
|
int cache_efi_options_variable(void) {
|
|
diff --git a/src/boot/bootctl-systemd-efi-options.c b/src/boot/bootctl-systemd-efi-options.c
|
|
index 7f8308fc3d..216b99546f 100644
|
|
--- a/src/boot/bootctl-systemd-efi-options.c
|
|
+++ b/src/boot/bootctl-systemd-efi-options.c
|
|
@@ -6,6 +6,7 @@
|
|
#include "efi-loader.h"
|
|
|
|
int verb_systemd_efi_options(int argc, char *argv[], void *userdata) {
|
|
+#if 0
|
|
int r;
|
|
|
|
/* This is obsolete and subject to removal */
|
|
@@ -40,4 +41,7 @@ int verb_systemd_efi_options(int argc, char *argv[], void *userdata) {
|
|
}
|
|
|
|
return 0;
|
|
+#else
|
|
+ return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Support for the SystemdOptions EFI variable has been dropped.");
|
|
+#endif
|
|
}
|
|
--
|
|
2.35.3
|
|
|