|
 |
8e15ce |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
8e15ce |
From: Peter Jones <pjones@redhat.com>
|
|
|
8e15ce |
Date: Tue, 6 Oct 2015 16:09:25 -0400
|
|
|
8e15ce |
Subject: [PATCH] Make any of the loaders that link in efi mode honor secure
|
|
|
8e15ce |
boot.
|
|
|
8e15ce |
|
|
|
8e15ce |
And in this case "honor" means "even if somebody does link this in, they
|
|
|
8e15ce |
won't register commands if SB is enabled."
|
|
|
8e15ce |
|
|
|
8e15ce |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
8e15ce |
---
|
|
|
8e15ce |
grub-core/commands/iorw.c | 7 +++++++
|
|
|
8e15ce |
grub-core/commands/memrw.c | 7 +++++++
|
|
|
8e15ce |
grub-core/kern/dl.c | 3 ++-
|
|
|
8e15ce |
grub-core/kern/efi/efi.c | 34 ----------------------------------
|
|
|
8e15ce |
grub-core/loader/efi/appleloader.c | 7 +++++++
|
|
|
8e15ce |
grub-core/loader/efi/chainloader.c | 1 +
|
|
|
8e15ce |
grub-core/loader/i386/bsd.c | 7 +++++++
|
|
|
8e15ce |
grub-core/loader/i386/linux.c | 7 +++++++
|
|
|
8e15ce |
grub-core/loader/i386/pc/linux.c | 7 +++++++
|
|
|
8e15ce |
grub-core/loader/multiboot.c | 7 +++++++
|
|
|
8e15ce |
grub-core/loader/xnu.c | 7 +++++++
|
|
|
8e15ce |
include/grub/efi/efi.h | 1 -
|
|
|
8e15ce |
include/grub/ia64/linux.h | 0
|
|
|
8e15ce |
include/grub/mips/linux.h | 0
|
|
|
8e15ce |
include/grub/powerpc/linux.h | 0
|
|
|
8e15ce |
include/grub/sparc64/linux.h | 0
|
|
|
8e15ce |
16 files changed, 59 insertions(+), 36 deletions(-)
|
|
|
8e15ce |
create mode 100644 include/grub/ia64/linux.h
|
|
|
8e15ce |
create mode 100644 include/grub/mips/linux.h
|
|
|
8e15ce |
create mode 100644 include/grub/powerpc/linux.h
|
|
|
8e15ce |
create mode 100644 include/grub/sparc64/linux.h
|
|
|
8e15ce |
|
|
|
8e15ce |
diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c
|
|
|
8e15ce |
index 584baec8f91..7b2999b14b5 100644
|
|
|
8e15ce |
--- a/grub-core/commands/iorw.c
|
|
|
8e15ce |
+++ b/grub-core/commands/iorw.c
|
|
|
8e15ce |
@@ -24,6 +24,7 @@
|
|
|
8e15ce |
#include <grub/cpu/io.h>
|
|
|
8e15ce |
#include <grub/i18n.h>
|
|
|
8e15ce |
#include <grub/lockdown.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -119,6 +120,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT(memrw)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
cmd_read_byte =
|
|
|
8e15ce |
grub_register_extcmd ("inb", grub_cmd_read, 0,
|
|
|
8e15ce |
N_("PORT"), N_("Read 8-bit value from PORT."),
|
|
|
8e15ce |
@@ -147,6 +151,9 @@ GRUB_MOD_INIT(memrw)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI(memrw)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_read_byte);
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_read_word);
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_read_dword);
|
|
|
8e15ce |
diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
|
|
|
8e15ce |
index d401a6db0ef..39cf3a06dbd 100644
|
|
|
8e15ce |
--- a/grub-core/commands/memrw.c
|
|
|
8e15ce |
+++ b/grub-core/commands/memrw.c
|
|
|
8e15ce |
@@ -23,6 +23,7 @@
|
|
|
8e15ce |
#include <grub/env.h>
|
|
|
8e15ce |
#include <grub/i18n.h>
|
|
|
8e15ce |
#include <grub/lockdown.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -121,6 +122,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT(memrw)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
cmd_read_byte =
|
|
|
8e15ce |
grub_register_extcmd ("read_byte", grub_cmd_read, 0,
|
|
|
8e15ce |
N_("ADDR"), N_("Read 8-bit value from ADDR."),
|
|
|
8e15ce |
@@ -149,6 +153,9 @@ GRUB_MOD_INIT(memrw)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI(memrw)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_read_byte);
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_read_word);
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_read_dword);
|
|
|
8e15ce |
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
|
|
|
8e15ce |
index b7149370950..7afb9e6f724 100644
|
|
|
8e15ce |
--- a/grub-core/kern/dl.c
|
|
|
8e15ce |
+++ b/grub-core/kern/dl.c
|
|
|
8e15ce |
@@ -32,6 +32,7 @@
|
|
|
8e15ce |
#include <grub/env.h>
|
|
|
8e15ce |
#include <grub/cache.h>
|
|
|
8e15ce |
#include <grub/i18n.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
/* Platforms where modules are in a readonly area of memory. */
|
|
|
8e15ce |
#if defined(GRUB_MACHINE_QEMU)
|
|
|
8e15ce |
@@ -704,7 +705,7 @@ grub_dl_load_file (const char *filename)
|
|
|
8e15ce |
grub_dl_t mod = 0;
|
|
|
8e15ce |
|
|
|
8e15ce |
#ifdef GRUB_MACHINE_EFI
|
|
|
8e15ce |
- if (grub_efi_secure_boot ())
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
#if 0
|
|
|
8e15ce |
/* This is an error, but grub2-mkconfig still generates a pile of
|
|
|
8e15ce |
diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
|
|
|
8e15ce |
index 4a2259aa1c7..8cff7be0289 100644
|
|
|
8e15ce |
--- a/grub-core/kern/efi/efi.c
|
|
|
8e15ce |
+++ b/grub-core/kern/efi/efi.c
|
|
|
8e15ce |
@@ -286,40 +286,6 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
|
|
|
8e15ce |
return grub_efi_get_variable_with_attributes (var, guid, datasize_out, data_out, NULL);
|
|
|
8e15ce |
}
|
|
|
8e15ce |
|
|
|
8e15ce |
-grub_efi_boolean_t
|
|
|
8e15ce |
-grub_efi_secure_boot (void)
|
|
|
8e15ce |
-{
|
|
|
8e15ce |
- grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
|
|
|
8e15ce |
- grub_size_t datasize;
|
|
|
8e15ce |
- char *secure_boot = NULL;
|
|
|
8e15ce |
- char *setup_mode = NULL;
|
|
|
8e15ce |
- grub_efi_boolean_t ret = 0;
|
|
|
8e15ce |
-
|
|
|
8e15ce |
- secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
|
|
|
8e15ce |
- if (datasize != 1 || !secure_boot)
|
|
|
8e15ce |
- {
|
|
|
8e15ce |
- grub_dprintf ("secureboot", "No SecureBoot variable\n");
|
|
|
8e15ce |
- goto out;
|
|
|
8e15ce |
- }
|
|
|
8e15ce |
- grub_dprintf ("secureboot", "SecureBoot: %d\n", *secure_boot);
|
|
|
8e15ce |
-
|
|
|
8e15ce |
- setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);
|
|
|
8e15ce |
- if (datasize != 1 || !setup_mode)
|
|
|
8e15ce |
- {
|
|
|
8e15ce |
- grub_dprintf ("secureboot", "No SetupMode variable\n");
|
|
|
8e15ce |
- goto out;
|
|
|
8e15ce |
- }
|
|
|
8e15ce |
- grub_dprintf ("secureboot", "SetupMode: %d\n", *setup_mode);
|
|
|
8e15ce |
-
|
|
|
8e15ce |
- if (*secure_boot && !*setup_mode)
|
|
|
8e15ce |
- ret = 1;
|
|
|
8e15ce |
-
|
|
|
8e15ce |
- out:
|
|
|
8e15ce |
- grub_free (secure_boot);
|
|
|
8e15ce |
- grub_free (setup_mode);
|
|
|
8e15ce |
- return ret;
|
|
|
8e15ce |
-}
|
|
|
8e15ce |
-
|
|
|
8e15ce |
#pragma GCC diagnostic ignored "-Wcast-align"
|
|
|
8e15ce |
|
|
|
8e15ce |
/* Search the mods section from the PE32/PE32+ image. This code uses
|
|
|
8e15ce |
diff --git a/grub-core/loader/efi/appleloader.c b/grub-core/loader/efi/appleloader.c
|
|
|
8e15ce |
index 74888c463ba..585f2b57385 100644
|
|
|
8e15ce |
--- a/grub-core/loader/efi/appleloader.c
|
|
|
8e15ce |
+++ b/grub-core/loader/efi/appleloader.c
|
|
|
8e15ce |
@@ -24,6 +24,7 @@
|
|
|
8e15ce |
#include <grub/misc.h>
|
|
|
8e15ce |
#include <grub/efi/api.h>
|
|
|
8e15ce |
#include <grub/efi/efi.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
#include <grub/command.h>
|
|
|
8e15ce |
#include <grub/i18n.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -227,6 +228,9 @@ static grub_command_t cmd;
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT(appleloader)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
cmd = grub_register_command ("appleloader", grub_cmd_appleloader,
|
|
|
8e15ce |
N_("[OPTS]"),
|
|
|
8e15ce |
/* TRANSLATORS: This command is used on EFI to
|
|
|
8e15ce |
@@ -238,5 +242,8 @@ GRUB_MOD_INIT(appleloader)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI(appleloader)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_unregister_command (cmd);
|
|
|
8e15ce |
}
|
|
|
8e15ce |
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
|
|
|
8e15ce |
index b54cf6986fc..3ff305b1d32 100644
|
|
|
8e15ce |
--- a/grub-core/loader/efi/chainloader.c
|
|
|
8e15ce |
+++ b/grub-core/loader/efi/chainloader.c
|
|
|
8e15ce |
@@ -34,6 +34,7 @@
|
|
|
8e15ce |
#include <grub/efi/disk.h>
|
|
|
8e15ce |
#include <grub/efi/pe32.h>
|
|
|
8e15ce |
#include <grub/efi/linux.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
#include <grub/command.h>
|
|
|
8e15ce |
#include <grub/i18n.h>
|
|
|
8e15ce |
#include <grub/net.h>
|
|
|
8e15ce |
diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c
|
|
|
8e15ce |
index 5f3290ce17b..54befc26626 100644
|
|
|
8e15ce |
--- a/grub-core/loader/i386/bsd.c
|
|
|
8e15ce |
+++ b/grub-core/loader/i386/bsd.c
|
|
|
8e15ce |
@@ -40,6 +40,7 @@
|
|
|
8e15ce |
#ifdef GRUB_MACHINE_PCBIOS
|
|
|
8e15ce |
#include <grub/machine/int.h>
|
|
|
8e15ce |
#endif
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -2137,6 +2138,9 @@ static grub_command_t cmd_netbsd_module_elf, cmd_openbsd_ramdisk;
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT (bsd)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
/* Net and OpenBSD kernels are often compressed. */
|
|
|
8e15ce |
grub_dl_load ("gzio");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -2176,6 +2180,9 @@ GRUB_MOD_INIT (bsd)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI (bsd)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_freebsd);
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_openbsd);
|
|
|
8e15ce |
grub_unregister_extcmd (cmd_netbsd);
|
|
|
8e15ce |
diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
|
|
|
8e15ce |
index dccf3bb3005..4aeb0e4b9a6 100644
|
|
|
8e15ce |
--- a/grub-core/loader/i386/linux.c
|
|
|
8e15ce |
+++ b/grub-core/loader/i386/linux.c
|
|
|
8e15ce |
@@ -37,6 +37,7 @@
|
|
|
8e15ce |
#include <grub/linux.h>
|
|
|
8e15ce |
#include <grub/machine/kernel.h>
|
|
|
8e15ce |
#include <grub/safemath.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -1138,6 +1139,9 @@ static grub_command_t cmd_linux, cmd_initrd;
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT(linux)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
cmd_linux = grub_register_command ("linux", grub_cmd_linux,
|
|
|
8e15ce |
0, N_("Load Linux."));
|
|
|
8e15ce |
cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd,
|
|
|
8e15ce |
@@ -1147,6 +1151,9 @@ GRUB_MOD_INIT(linux)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI(linux)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_unregister_command (cmd_linux);
|
|
|
8e15ce |
grub_unregister_command (cmd_initrd);
|
|
|
8e15ce |
}
|
|
|
8e15ce |
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
|
|
|
8e15ce |
index 4b1750e360e..e3fa1221e81 100644
|
|
|
8e15ce |
--- a/grub-core/loader/i386/pc/linux.c
|
|
|
8e15ce |
+++ b/grub-core/loader/i386/pc/linux.c
|
|
|
8e15ce |
@@ -36,6 +36,7 @@
|
|
|
8e15ce |
#include <grub/lib/cmdline.h>
|
|
|
8e15ce |
#include <grub/linux.h>
|
|
|
8e15ce |
#include <grub/safemath.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -487,6 +488,9 @@ static grub_command_t cmd_linux, cmd_linux16, cmd_initrd, cmd_initrd16;
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT(linux16)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
cmd_linux =
|
|
|
8e15ce |
grub_register_command ("linux", grub_cmd_linux,
|
|
|
8e15ce |
0, N_("Load Linux."));
|
|
|
8e15ce |
@@ -504,6 +508,9 @@ GRUB_MOD_INIT(linux16)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI(linux16)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_unregister_command (cmd_linux);
|
|
|
8e15ce |
grub_unregister_command (cmd_linux16);
|
|
|
8e15ce |
grub_unregister_command (cmd_initrd);
|
|
|
8e15ce |
diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c
|
|
|
8e15ce |
index facb13f3d36..47e481f4576 100644
|
|
|
8e15ce |
--- a/grub-core/loader/multiboot.c
|
|
|
8e15ce |
+++ b/grub-core/loader/multiboot.c
|
|
|
8e15ce |
@@ -50,6 +50,7 @@
|
|
|
8e15ce |
#include <grub/video.h>
|
|
|
8e15ce |
#include <grub/memory.h>
|
|
|
8e15ce |
#include <grub/i18n.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -444,6 +445,9 @@ static grub_command_t cmd_multiboot, cmd_module;
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT(multiboot)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
cmd_multiboot =
|
|
|
8e15ce |
#ifdef GRUB_USE_MULTIBOOT2
|
|
|
8e15ce |
grub_register_command ("multiboot2", grub_cmd_multiboot,
|
|
|
8e15ce |
@@ -464,6 +468,9 @@ GRUB_MOD_INIT(multiboot)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI(multiboot)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
grub_unregister_command (cmd_multiboot);
|
|
|
8e15ce |
grub_unregister_command (cmd_module);
|
|
|
8e15ce |
}
|
|
|
8e15ce |
diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
|
|
|
8e15ce |
index 1c0cf6a430a..baa54e652ab 100644
|
|
|
8e15ce |
--- a/grub-core/loader/xnu.c
|
|
|
8e15ce |
+++ b/grub-core/loader/xnu.c
|
|
|
8e15ce |
@@ -35,6 +35,7 @@
|
|
|
8e15ce |
#include <grub/i18n.h>
|
|
|
8e15ce |
#include <grub/verify.h>
|
|
|
8e15ce |
#include <grub/safemath.h>
|
|
|
8e15ce |
+#include <grub/efi/sb.h>
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
8e15ce |
|
|
|
8e15ce |
@@ -1497,6 +1498,9 @@ static grub_extcmd_t cmd_splash;
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_INIT(xnu)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
cmd_kernel = grub_register_command ("xnu_kernel", grub_cmd_xnu_kernel, 0,
|
|
|
8e15ce |
N_("Load XNU image."));
|
|
|
8e15ce |
cmd_kernel64 = grub_register_command ("xnu_kernel64", grub_cmd_xnu_kernel64,
|
|
|
8e15ce |
@@ -1540,6 +1544,9 @@ GRUB_MOD_INIT(xnu)
|
|
|
8e15ce |
|
|
|
8e15ce |
GRUB_MOD_FINI(xnu)
|
|
|
8e15ce |
{
|
|
|
8e15ce |
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
|
|
8e15ce |
+ return;
|
|
|
8e15ce |
+
|
|
|
8e15ce |
#ifndef GRUB_MACHINE_EMU
|
|
|
8e15ce |
grub_unregister_command (cmd_resume);
|
|
|
8e15ce |
#endif
|
|
|
8e15ce |
diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
|
|
|
8e15ce |
index 6295df85f3f..585fa6662b6 100644
|
|
|
8e15ce |
--- a/include/grub/efi/efi.h
|
|
|
8e15ce |
+++ b/include/grub/efi/efi.h
|
|
|
8e15ce |
@@ -91,7 +91,6 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
|
|
|
8e15ce |
const grub_efi_guid_t *guid,
|
|
|
8e15ce |
void *data,
|
|
|
8e15ce |
grub_size_t datasize);
|
|
|
8e15ce |
-grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);
|
|
|
8e15ce |
int
|
|
|
8e15ce |
EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
|
|
|
8e15ce |
const grub_efi_device_path_t *dp2);
|
|
|
8e15ce |
diff --git a/include/grub/ia64/linux.h b/include/grub/ia64/linux.h
|
|
|
8e15ce |
new file mode 100644
|
|
|
8e15ce |
index 00000000000..e69de29bb2d
|
|
|
8e15ce |
diff --git a/include/grub/mips/linux.h b/include/grub/mips/linux.h
|
|
|
8e15ce |
new file mode 100644
|
|
|
8e15ce |
index 00000000000..e69de29bb2d
|
|
|
8e15ce |
diff --git a/include/grub/powerpc/linux.h b/include/grub/powerpc/linux.h
|
|
|
8e15ce |
new file mode 100644
|
|
|
8e15ce |
index 00000000000..e69de29bb2d
|
|
|
8e15ce |
diff --git a/include/grub/sparc64/linux.h b/include/grub/sparc64/linux.h
|
|
|
8e15ce |
new file mode 100644
|
|
|
8e15ce |
index 00000000000..e69de29bb2d
|