mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-08 05:26:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't read OEM config data if Secure Boot is enabled

Browse Source 
We don't want untrusted configuration to be read if we're in Secure Boot
mode, so skip the OEM config when Secure Boot is enabled and in User Mode.
This commit is contained in:
Matthew Garrett 2015-04-17 17:32:24 -07:00
parent 3e33136871
commit 9fe7952578
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
build_library/grub.cfg
View File

@ -18,11 +18,22 @@ set linux_console=""
# Anything else the OEM adds should use this variable.
set linux_append=""
set secure_boot="0"
if [ "$grub_platform" = "efi" ]; then
getenv -e SecureBoot -g 8be4df61-93ca-11d2-aa0d-00e098032b8c -b sb
getenv -e SetupMode -g 8be4df61-93ca-11d2-aa0d-00e098032b8c -b setupmode
if [ "$sb" = "01" -a "$setupmode" = "00" ]; then
set secure_boot="1"
fi
fi
# Search for the OEM partition, load additional configuration if found.
search --no-floppy --set oem --part-label OEM --hint "$root"
if [ -n "$oem" -a -f "($oem)/grub.cfg" ]; then
if [ "$secure_boot" = "0" ]; then
search --no-floppy --set oem --part-label OEM --hint "$root"
if [ -n "$oem" -a -f "($oem)/grub.cfg" ]; then
source "($oem)/grub.cfg"
fi
fi
# If no specific console has been set by the OEM then select based on

2
build_library/grub_install.sh
View File

@ -41,7 +41,7 @@ case "${FLAGS_target}" in
CORE_NAME="core.img"
;;
x86_64-efi)
CORE_MODULES+=( serial linuxefi efi_gop )
CORE_MODULES+=( serial linuxefi efi_gop getenv )
CORE_NAME="core.efi"
;;
x86_64-xen)