123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763 |
- From 578c95298bcc46e0296f4c786db64c2ff26ce2cc Mon Sep 17 00:00:00 2001
- From: Javier Martinez Canillas <javierm@redhat.com>
- Date: Mon, 28 Sep 2020 20:08:02 +0200
- Subject: [PATCH] kern: Add lockdown support
- When the GRUB starts on a secure boot platform, some commands can be
- used to subvert the protections provided by the verification mechanism and
- could lead to booting untrusted system.
- To prevent that situation, allow GRUB to be locked down. That way the code
- may check if GRUB has been locked down and further restrict the commands
- that are registered or what subset of their functionality could be used.
- The lockdown support adds the following components:
- * The grub_lockdown() function which can be used to lockdown GRUB if,
- e.g., UEFI Secure Boot is enabled.
- * The grub_is_lockdown() function which can be used to check if the GRUB
- was locked down.
- * A verifier that flags OS kernels, the GRUB modules, Device Trees and ACPI
- tables as GRUB_VERIFY_FLAGS_DEFER_AUTH to defer verification to other
- verifiers. These files are only successfully verified if another registered
- verifier returns success. Otherwise, the whole verification process fails.
- For example, PE/COFF binaries verification can be done by the shim_lock
- verifier which validates the signatures using the shim_lock protocol.
- However, the verification is not deferred directly to the shim_lock verifier.
- The shim_lock verifier is hooked into the verification process instead.
- * A set of grub_{command,extcmd}_lockdown functions that can be used by
- code registering command handlers, to only register unsafe commands if
- the GRUB has not been locked down.
- Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
- Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
- [Add changes to generated files]
- Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
- ---
- Makefile.in | 2 ++
- conf/Makefile.common | 2 ++
- docs/grub-dev.texi | 27 +++++++++++++++
- docs/grub.texi | 8 +++++
- grub-core/Makefile.am | 5 ++-
- grub-core/Makefile.core.am | 14 ++++----
- grub-core/Makefile.core.def | 1 +
- grub-core/Makefile.in | 73 ++++++++++++++++++++++++++++++-----------
- grub-core/commands/extcmd.c | 23 +++++++++++++
- grub-core/kern/command.c | 24 ++++++++++++++
- grub-core/kern/lockdown.c | 80 +++++++++++++++++++++++++++++++++++++++++++++
- include/grub/command.h | 5 +++
- include/grub/extcmd.h | 7 ++++
- include/grub/lockdown.h | 44 +++++++++++++++++++++++++
- po/POTFILES.in | 2 ++
- 15 files changed, 290 insertions(+), 27 deletions(-)
- create mode 100644 grub-core/kern/lockdown.c
- create mode 100644 include/grub/lockdown.h
- diff --git a/Makefile.in b/Makefile.in
- index e6a185b..ecb3278 100644
- --- a/Makefile.in
- +++ b/Makefile.in
- @@ -2617,7 +2617,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
- CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' \
- '-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' \
- + '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
- '-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' \
- + '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
- '-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
- diff --git a/conf/Makefile.common b/conf/Makefile.common
- index 6cd71cb..2a1a886 100644
- --- a/conf/Makefile.common
- +++ b/conf/Makefile.common
- @@ -84,7 +84,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
- CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_TERMINAL_LIST += '-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)'
- +CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)'
- +CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
- diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
- index ee389fd..635ec72 100644
- --- a/docs/grub-dev.texi
- +++ b/docs/grub-dev.texi
- @@ -86,6 +86,7 @@ This edition documents version @value{VERSION}.
- * PFF2 Font File Format::
- * Graphical Menu Software Design::
- * Verifiers framework::
- +* Lockdown framework::
- * Copying This Manual:: Copying This Manual
- * Index::
- @end menu
- @@ -2086,6 +2087,32 @@ Optionally at the end of the file @samp{fini}, if it exists, is called with just
- the context. If you return no error during any of @samp{init}, @samp{write} and
- @samp{fini} then the file is considered as having succeded verification.
-
- +@node Lockdown framework
- +@chapter Lockdown framework
- +
- +The GRUB can be locked down, which is a restricted mode where some operations
- +are not allowed. For instance, some commands cannot be used when the GRUB is
- +locked down.
- +
- +The function
- +@code{grub_lockdown()} is used to lockdown GRUB and the function
- +@code{grub_is_lockdown()} function can be used to check whether lockdown is
- +enabled or not. When enabled, the function returns @samp{GRUB_LOCKDOWN_ENABLED}
- +and @samp{GRUB_LOCKDOWN_DISABLED} when is not enabled.
- +
- +The following functions can be used to register the commands that can only be
- +used when lockdown is disabled:
- +
- +@itemize
- +
- +@item @code{grub_cmd_lockdown()} registers command which should not run when the
- +GRUB is in lockdown mode.
- +
- +@item @code{grub_cmd_lockdown()} registers extended command which should not run
- +when the GRUB is in lockdown mode.
- +
- +@end itemize
- +
- @node Copying This Manual
- @appendix Copying This Manual
-
- diff --git a/docs/grub.texi b/docs/grub.texi
- index aefe032..a25459f 100644
- --- a/docs/grub.texi
- +++ b/docs/grub.texi
- @@ -5581,6 +5581,7 @@ environment variables and commands are listed in the same order.
- * Using digital signatures:: Booting digitally signed code
- * UEFI secure boot and shim:: Booting digitally signed PE files
- * Measured Boot:: Measuring boot components
- +* Lockdown:: Lockdown when booting on a secure setup
- @end menu
-
- @node Authentication and authorisation
- @@ -5795,6 +5796,13 @@ into @file{core.img} in order to avoid a potential gap in measurement between
-
- Measured boot is currently only supported on EFI platforms.
-
- +@node Lockdown
- +@section Lockdown when booting on a secure setup
- +
- +The GRUB can be locked down when booted on a secure boot environment, for example
- +if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
- +be restricted and some operations/commands cannot be executed.
- +
- @node Platform limitations
- @chapter Platform limitations
-
- diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
- index cc6fc7d..30e23ad 100644
- --- a/grub-core/Makefile.am
- +++ b/grub-core/Makefile.am
- @@ -80,6 +80,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fs.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/i18n.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/kernel.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/list.h
- +KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lockdown.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/misc.h
- if COND_emu
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/compiler-rt-emu.h
- @@ -377,8 +378,10 @@ command.lst: $(MARKER_FILES)
- b=`basename $$pp .marker`; \
- sed -n \
- -e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
- + -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
- -e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
- - -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
- + -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \
- + -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
- done) | sort -u > $@
- platform_DATA += command.lst
- CLEANFILES += command.lst
- diff --git a/grub-core/Makefile.core.am b/grub-core/Makefile.core.am
- index 5623a5e..fbfb627 100644
- --- a/grub-core/Makefile.core.am
- +++ b/grub-core/Makefile.core.am
- @@ -22378,7 +22378,7 @@ endif
- if COND_i386_efi
- platform_PROGRAMS += kernel.exec
- kernel_exec_SOURCES = kern/i386/efi/startup.S
- -kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/i386/efi/init.c bus/pci.c kern/i386/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- +kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/i386/efi/init.c bus/pci.c kern/i386/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
- kernel_exec_LDADD =
- kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
- @@ -22488,7 +22488,7 @@ endif
- if COND_x86_64_efi
- platform_PROGRAMS += kernel.exec
- kernel_exec_SOURCES = kern/x86_64/efi/startup.S
- -kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/x86_64/efi/callwrap.S kern/i386/efi/init.c bus/pci.c kern/x86_64/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- +kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/x86_64/efi/callwrap.S kern/i386/efi/init.c bus/pci.c kern/x86_64/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
- kernel_exec_LDADD =
- kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
- @@ -22664,7 +22664,7 @@ endif
- if COND_ia64_efi
- platform_PROGRAMS += kernel.exec
- kernel_exec_SOURCES =
- -kernel_exec_SOURCES += kern/ia64/efi/startup.S kern/ia64/efi/init.c kern/ia64/dl.c kern/ia64/dl_helper.c kern/ia64/cache.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- +kernel_exec_SOURCES += kern/ia64/efi/startup.S kern/ia64/efi/init.c kern/ia64/dl.c kern/ia64/dl_helper.c kern/ia64/cache.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
- kernel_exec_LDADD =
- kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL) -fno-builtin -fpic -minline-int-divide-max-throughput
- @@ -22730,7 +22730,7 @@ endif
- if COND_arm_efi
- platform_PROGRAMS += kernel.exec
- kernel_exec_SOURCES = kern/arm/efi/startup.S
- -kernel_exec_SOURCES += kern/arm/efi/init.c kern/efi/fdt.c kern/arm/dl.c kern/arm/dl_helper.c kern/arm/cache_armv6.S kern/arm/cache_armv7.S kern/arm/cache.c kern/arm/compiler-rt.S lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- +kernel_exec_SOURCES += kern/arm/efi/init.c kern/efi/fdt.c kern/arm/dl.c kern/arm/dl_helper.c kern/arm/cache_armv6.S kern/arm/cache_armv7.S kern/arm/cache.c kern/arm/compiler-rt.S lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
- kernel_exec_LDADD =
- kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
- @@ -22752,7 +22752,7 @@ endif
- if COND_arm64_efi
- platform_PROGRAMS += kernel.exec
- kernel_exec_SOURCES = kern/arm64/efi/startup.S
- -kernel_exec_SOURCES += kern/arm64/efi/init.c kern/efi/fdt.c kern/arm64/cache.c kern/arm64/cache_flush.S kern/arm64/dl.c kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- +kernel_exec_SOURCES += kern/arm64/efi/init.c kern/efi/fdt.c kern/arm64/cache.c kern/arm64/cache_flush.S kern/arm64/dl.c kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
- kernel_exec_LDADD =
- kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
- @@ -22796,7 +22796,7 @@ endif
- if COND_riscv32_efi
- platform_PROGRAMS += kernel.exec
- kernel_exec_SOURCES = kern/riscv/efi/startup.S
- -kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- +kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
- kernel_exec_LDADD =
- kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
- @@ -22818,7 +22818,7 @@ endif
- if COND_riscv64_efi
- platform_PROGRAMS += kernel.exec
- kernel_exec_SOURCES = kern/riscv/efi/startup.S
- -kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- +kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
- nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
- kernel_exec_LDADD =
- kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
- diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
- index 4d380ed..ee8dc55 100644
- --- a/grub-core/Makefile.core.def
- +++ b/grub-core/Makefile.core.def
- @@ -205,6 +205,7 @@ kernel = {
- efi = kern/acpi.c;
- efi = kern/efi/acpi.c;
- efi = kern/efi/sb.c;
- + efi = kern/lockdown.c;
- i386_coreboot = kern/i386/pc/acpi.c;
- i386_multiboot = kern/i386/pc/acpi.c;
- i386_coreboot = kern/acpi.c;
- diff --git a/grub-core/Makefile.in b/grub-core/Makefile.in
- index 09dc802..ac400ea 100644
- --- a/grub-core/Makefile.in
- +++ b/grub-core/Makefile.in
- @@ -10457,13 +10457,14 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- kern/arm64/cache_flush.S kern/arm64/dl.c \
- kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c \
- kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c \
- - kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c \
- - kern/time.c kern/generic/millisleep.c kern/command.c \
- - kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c \
- - kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c \
- - kern/misc.c kern/parser.c kern/partition.c \
- - kern/rescue_parser.c kern/rescue_reader.c kern/term.c \
- - kern/verifiers.c kern/arm/startup.S kern/arm/coreboot/init.c \
- + kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c \
- + kern/compiler-rt.c kern/mm.c kern/time.c \
- + kern/generic/millisleep.c kern/command.c kern/corecmd.c \
- + kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c \
- + kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c \
- + kern/parser.c kern/partition.c kern/rescue_parser.c \
- + kern/rescue_reader.c kern/term.c kern/verifiers.c \
- + kern/arm/startup.S kern/arm/coreboot/init.c \
- kern/arm/coreboot/timer.c kern/arm/coreboot/coreboot.S \
- lib/fdt.c bus/fdt.c term/ps2.c term/arm/pl050.c \
- term/arm/cros.c term/arm/cros_ec.c bus/spi/rk3288_spi.c \
- @@ -10572,6 +10573,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
- +@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
- @@ -10646,6 +10648,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
- +@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
- @@ -10683,6 +10686,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
- +@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
- @@ -10884,6 +10888,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
- +@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
- @@ -11120,6 +11125,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
- +@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
- @@ -11287,6 +11293,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
- +@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
- @COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
- @@ -11379,6 +11386,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
- @COND_arm64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
- @COND_arm64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
- +@COND_arm64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
- @COND_arm64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
- @COND_arm64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
- @COND_arm64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
- @@ -15379,7 +15387,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
- CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' \
- '-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' \
- + '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
- '-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' \
- + '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
- '-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
- CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
- @@ -16387,6 +16397,7 @@ KERNEL_HEADER_FILES = $(top_srcdir)/include/grub/cache.h \
- $(top_srcdir)/include/grub/i18n.h \
- $(top_srcdir)/include/grub/kernel.h \
- $(top_srcdir)/include/grub/list.h \
- + $(top_srcdir)/include/grub/lockdown.h \
- $(top_srcdir)/include/grub/misc.h $(am__append_5794) \
- $(am__append_5795) $(top_srcdir)/include/grub/mm.h \
- $(top_srcdir)/include/grub/parser.h \
- @@ -25594,7 +25605,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
- @COND_arm64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
- @COND_arm64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
- @COND_arm64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
- -@COND_arm64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
- +@COND_arm64_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
- +@COND_arm64_efi_TRUE@ kern/mm.c kern/time.c \
- @COND_arm64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
- @COND_arm64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
- @COND_arm64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
- @@ -25645,7 +25657,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
- @COND_arm_efi_TRUE@ kern/efi/init.c kern/efi/mm.c \
- @COND_arm_efi_TRUE@ term/efi/console.c kern/acpi.c \
- @COND_arm_efi_TRUE@ kern/efi/acpi.c kern/efi/sb.c \
- -@COND_arm_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
- +@COND_arm_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
- +@COND_arm_efi_TRUE@ kern/mm.c kern/time.c \
- @COND_arm_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
- @COND_arm_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
- @COND_arm_efi_TRUE@ kern/dl.c kern/env.c kern/err.c kern/file.c \
- @@ -25725,7 +25738,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
- @COND_i386_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
- @COND_i386_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
- @COND_i386_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
- -@COND_i386_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
- +@COND_i386_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
- +@COND_i386_efi_TRUE@ kern/mm.c kern/time.c \
- @COND_i386_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
- @COND_i386_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
- @COND_i386_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
- @@ -25843,7 +25857,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
- @COND_ia64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
- @COND_ia64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
- @COND_ia64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
- -@COND_ia64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
- +@COND_ia64_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
- +@COND_ia64_efi_TRUE@ kern/mm.c kern/time.c \
- @COND_ia64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
- @COND_ia64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
- @COND_ia64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
- @@ -25956,8 +25971,9 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
- @COND_riscv32_efi_TRUE@ kern/efi/init.c kern/efi/mm.c \
- @COND_riscv32_efi_TRUE@ term/efi/console.c kern/acpi.c \
- @COND_riscv32_efi_TRUE@ kern/efi/acpi.c kern/efi/sb.c \
- -@COND_riscv32_efi_TRUE@ kern/compiler-rt.c kern/mm.c \
- -@COND_riscv32_efi_TRUE@ kern/time.c kern/generic/millisleep.c \
- +@COND_riscv32_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
- +@COND_riscv32_efi_TRUE@ kern/mm.c kern/time.c \
- +@COND_riscv32_efi_TRUE@ kern/generic/millisleep.c \
- @COND_riscv32_efi_TRUE@ kern/command.c kern/corecmd.c \
- @COND_riscv32_efi_TRUE@ kern/device.c kern/disk.c kern/dl.c \
- @COND_riscv32_efi_TRUE@ kern/env.c kern/err.c kern/file.c \
- @@ -25974,9 +25990,9 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
- @COND_riscv64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
- @COND_riscv64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
- @COND_riscv64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c \
- -@COND_riscv64_efi_TRUE@ kern/efi/sb.c kern/compiler-rt.c \
- -@COND_riscv64_efi_TRUE@ kern/mm.c kern/time.c \
- -@COND_riscv64_efi_TRUE@ kern/generic/millisleep.c \
- +@COND_riscv64_efi_TRUE@ kern/efi/sb.c kern/lockdown.c \
- +@COND_riscv64_efi_TRUE@ kern/compiler-rt.c kern/mm.c \
- +@COND_riscv64_efi_TRUE@ kern/time.c kern/generic/millisleep.c \
- @COND_riscv64_efi_TRUE@ kern/command.c kern/corecmd.c \
- @COND_riscv64_efi_TRUE@ kern/device.c kern/disk.c kern/dl.c \
- @COND_riscv64_efi_TRUE@ kern/env.c kern/err.c kern/file.c \
- @@ -26022,8 +26038,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
- @COND_x86_64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
- @COND_x86_64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
- @COND_x86_64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c \
- -@COND_x86_64_efi_TRUE@ kern/efi/sb.c kern/compiler-rt.c \
- -@COND_x86_64_efi_TRUE@ kern/mm.c kern/time.c \
- +@COND_x86_64_efi_TRUE@ kern/efi/sb.c kern/lockdown.c \
- +@COND_x86_64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
- @COND_x86_64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
- @COND_x86_64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
- @COND_x86_64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
- @@ -27994,6 +28010,8 @@ kern/efi/kernel_exec-acpi.$(OBJEXT): kern/efi/$(am__dirstamp) \
- kern/efi/$(DEPDIR)/$(am__dirstamp)
- kern/efi/kernel_exec-sb.$(OBJEXT): kern/efi/$(am__dirstamp) \
- kern/efi/$(DEPDIR)/$(am__dirstamp)
- +kern/kernel_exec-lockdown.$(OBJEXT): kern/$(am__dirstamp) \
- + kern/$(DEPDIR)/$(am__dirstamp)
- kern/kernel_exec-compiler-rt.$(OBJEXT): kern/$(am__dirstamp) \
- kern/$(DEPDIR)/$(am__dirstamp)
- kern/kernel_exec-mm.$(OBJEXT): kern/$(am__dirstamp) \
- @@ -30945,6 +30963,7 @@ distclean-compile:
- @AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-file.Po@am__quote@
- @AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-fs.Po@am__quote@
- @AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-list.Po@am__quote@
- +@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-lockdown.Po@am__quote@
- @AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-main.Po@am__quote@
- @AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-misc.Po@am__quote@
- @AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-mm.Po@am__quote@
- @@ -35293,6 +35312,20 @@ kern/efi/kernel_exec-sb.obj: kern/efi/sb.c
- @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
- @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/efi/kernel_exec-sb.obj `if test -f 'kern/efi/sb.c'; then $(CYGPATH_W) 'kern/efi/sb.c'; else $(CYGPATH_W) '$(srcdir)/kern/efi/sb.c'; fi`
-
- +kern/kernel_exec-lockdown.o: kern/lockdown.c
- +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-lockdown.o -MD -MP -MF kern/$(DEPDIR)/kernel_exec-lockdown.Tpo -c -o kern/kernel_exec-lockdown.o `test -f 'kern/lockdown.c' || echo '$(srcdir)/'`kern/lockdown.c
- +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-lockdown.Tpo kern/$(DEPDIR)/kernel_exec-lockdown.Po
- +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='kern/lockdown.c' object='kern/kernel_exec-lockdown.o' libtool=no @AMDEPBACKSLASH@
- +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
- +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/kernel_exec-lockdown.o `test -f 'kern/lockdown.c' || echo '$(srcdir)/'`kern/lockdown.c
- +
- +kern/kernel_exec-lockdown.obj: kern/lockdown.c
- +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-lockdown.obj -MD -MP -MF kern/$(DEPDIR)/kernel_exec-lockdown.Tpo -c -o kern/kernel_exec-lockdown.obj `if test -f 'kern/lockdown.c'; then $(CYGPATH_W) 'kern/lockdown.c'; else $(CYGPATH_W) '$(srcdir)/kern/lockdown.c'; fi`
- +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-lockdown.Tpo kern/$(DEPDIR)/kernel_exec-lockdown.Po
- +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='kern/lockdown.c' object='kern/kernel_exec-lockdown.obj' libtool=no @AMDEPBACKSLASH@
- +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
- +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/kernel_exec-lockdown.obj `if test -f 'kern/lockdown.c'; then $(CYGPATH_W) 'kern/lockdown.c'; else $(CYGPATH_W) '$(srcdir)/kern/lockdown.c'; fi`
- +
- kern/kernel_exec-compiler-rt.o: kern/compiler-rt.c
- @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-compiler-rt.o -MD -MP -MF kern/$(DEPDIR)/kernel_exec-compiler-rt.Tpo -c -o kern/kernel_exec-compiler-rt.o `test -f 'kern/compiler-rt.c' || echo '$(srcdir)/'`kern/compiler-rt.c
- @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-compiler-rt.Tpo kern/$(DEPDIR)/kernel_exec-compiler-rt.Po
- @@ -46650,8 +46683,10 @@ command.lst: $(MARKER_FILES)
- b=`basename $$pp .marker`; \
- sed -n \
- -e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
- + -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
- -e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
- - -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
- + -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \
- + -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
- done) | sort -u > $@
-
- partmap.lst: $(MARKER_FILES)
- diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
- index 69574e2..90a5ca2 100644
- --- a/grub-core/commands/extcmd.c
- +++ b/grub-core/commands/extcmd.c
- @@ -19,6 +19,7 @@
-
- #include <grub/mm.h>
- #include <grub/list.h>
- +#include <grub/lockdown.h>
- #include <grub/misc.h>
- #include <grub/extcmd.h>
- #include <grub/script_sh.h>
- @@ -110,6 +111,28 @@ grub_register_extcmd (const char *name, grub_extcmd_func_t func,
- summary, description, parser, 1);
- }
-
- +static grub_err_t
- +grub_extcmd_lockdown (grub_extcmd_context_t ctxt __attribute__ ((unused)),
- + int argc __attribute__ ((unused)),
- + char **argv __attribute__ ((unused)))
- +{
- + return grub_error (GRUB_ERR_ACCESS_DENIED,
- + N_("%s: the command is not allowed when lockdown is enforced"),
- + ctxt->extcmd->cmd->name);
- +}
- +
- +grub_extcmd_t
- +grub_register_extcmd_lockdown (const char *name, grub_extcmd_func_t func,
- + grub_command_flags_t flags, const char *summary,
- + const char *description,
- + const struct grub_arg_option *parser)
- +{
- + if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED)
- + func = grub_extcmd_lockdown;
- +
- + return grub_register_extcmd (name, func, flags, summary, description, parser);
- +}
- +
- void
- grub_unregister_extcmd (grub_extcmd_t ext)
- {
- diff --git a/grub-core/kern/command.c b/grub-core/kern/command.c
- index acd7218..4aabcd4 100644
- --- a/grub-core/kern/command.c
- +++ b/grub-core/kern/command.c
- @@ -17,6 +17,7 @@
- * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
- */
-
- +#include <grub/lockdown.h>
- #include <grub/mm.h>
- #include <grub/command.h>
-
- @@ -77,6 +78,29 @@ grub_register_command_prio (const char *name,
- return cmd;
- }
-
- +static grub_err_t
- +grub_cmd_lockdown (grub_command_t cmd __attribute__ ((unused)),
- + int argc __attribute__ ((unused)),
- + char **argv __attribute__ ((unused)))
- +
- +{
- + return grub_error (GRUB_ERR_ACCESS_DENIED,
- + N_("%s: the command is not allowed when lockdown is enforced"),
- + cmd->name);
- +}
- +
- +grub_command_t
- +grub_register_command_lockdown (const char *name,
- + grub_command_func_t func,
- + const char *summary,
- + const char *description)
- +{
- + if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED)
- + func = grub_cmd_lockdown;
- +
- + return grub_register_command_prio (name, func, summary, description, 0);
- +}
- +
- void
- grub_unregister_command (grub_command_t cmd)
- {
- diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c
- new file mode 100644
- index 0000000..1e56c0b
- --- /dev/null
- +++ b/grub-core/kern/lockdown.c
- @@ -0,0 +1,80 @@
- +/*
- + * GRUB -- GRand Unified Bootloader
- + * Copyright (C) 2020 Free Software Foundation, Inc.
- + *
- + * GRUB is free software: you can redistribute it and/or modify
- + * it under the terms of the GNU General Public License as published by
- + * the Free Software Foundation, either version 3 of the License, or
- + * (at your option) any later version.
- + *
- + * GRUB is distributed in the hope that it will be useful,
- + * but WITHOUT ANY WARRANTY; without even the implied warranty of
- + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- + * GNU General Public License for more details.
- + *
- + * You should have received a copy of the GNU General Public License
- + * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
- + *
- + */
- +
- +#include <grub/dl.h>
- +#include <grub/file.h>
- +#include <grub/lockdown.h>
- +#include <grub/verify.h>
- +
- +static int lockdown = GRUB_LOCKDOWN_DISABLED;
- +
- +static grub_err_t
- +lockdown_verifier_init (grub_file_t io __attribute__ ((unused)),
- + enum grub_file_type type,
- + void **context __attribute__ ((unused)),
- + enum grub_verify_flags *flags)
- +{
- + *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
- +
- + switch (type & GRUB_FILE_TYPE_MASK)
- + {
- + case GRUB_FILE_TYPE_GRUB_MODULE:
- + case GRUB_FILE_TYPE_LINUX_KERNEL:
- + case GRUB_FILE_TYPE_MULTIBOOT_KERNEL:
- + case GRUB_FILE_TYPE_XEN_HYPERVISOR:
- + case GRUB_FILE_TYPE_BSD_KERNEL:
- + case GRUB_FILE_TYPE_XNU_KERNEL:
- + case GRUB_FILE_TYPE_PLAN9_KERNEL:
- + case GRUB_FILE_TYPE_NTLDR:
- + case GRUB_FILE_TYPE_TRUECRYPT:
- + case GRUB_FILE_TYPE_FREEDOS:
- + case GRUB_FILE_TYPE_PXECHAINLOADER:
- + case GRUB_FILE_TYPE_PCCHAINLOADER:
- + case GRUB_FILE_TYPE_COREBOOT_CHAINLOADER:
- + case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE:
- + case GRUB_FILE_TYPE_ACPI_TABLE:
- + case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE:
- + *flags = GRUB_VERIFY_FLAGS_DEFER_AUTH;
- +
- + /* Fall through. */
- +
- + default:
- + return GRUB_ERR_NONE;
- + }
- +}
- +
- +struct grub_file_verifier lockdown_verifier =
- + {
- + .name = "lockdown_verifier",
- + .init = lockdown_verifier_init,
- + };
- +
- +void
- +grub_lockdown (void)
- +{
- + lockdown = GRUB_LOCKDOWN_ENABLED;
- +
- + grub_verifier_register (&lockdown_verifier);
- +}
- +
- +int
- +grub_is_lockdown (void)
- +{
- + return lockdown;
- +}
- diff --git a/include/grub/command.h b/include/grub/command.h
- index eee4e84..2a6f7f8 100644
- --- a/include/grub/command.h
- +++ b/include/grub/command.h
- @@ -86,6 +86,11 @@ EXPORT_FUNC(grub_register_command_prio) (const char *name,
- const char *summary,
- const char *description,
- int prio);
- +grub_command_t
- +EXPORT_FUNC(grub_register_command_lockdown) (const char *name,
- + grub_command_func_t func,
- + const char *summary,
- + const char *description);
- void EXPORT_FUNC(grub_unregister_command) (grub_command_t cmd);
-
- static inline grub_command_t
- diff --git a/include/grub/extcmd.h b/include/grub/extcmd.h
- index 19fe592..fe9248b 100644
- --- a/include/grub/extcmd.h
- +++ b/include/grub/extcmd.h
- @@ -62,6 +62,13 @@ grub_extcmd_t EXPORT_FUNC(grub_register_extcmd) (const char *name,
- const char *description,
- const struct grub_arg_option *parser);
-
- +grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_lockdown) (const char *name,
- + grub_extcmd_func_t func,
- + grub_command_flags_t flags,
- + const char *summary,
- + const char *description,
- + const struct grub_arg_option *parser);
- +
- grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_prio) (const char *name,
- grub_extcmd_func_t func,
- grub_command_flags_t flags,
- diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
- new file mode 100644
- index 0000000..40531fa
- --- /dev/null
- +++ b/include/grub/lockdown.h
- @@ -0,0 +1,44 @@
- +/*
- + * GRUB -- GRand Unified Bootloader
- + * Copyright (C) 2020 Free Software Foundation, Inc.
- + *
- + * GRUB is free software: you can redistribute it and/or modify
- + * it under the terms of the GNU General Public License as published by
- + * the Free Software Foundation, either version 3 of the License, or
- + * (at your option) any later version.
- + *
- + * GRUB is distributed in the hope that it will be useful,
- + * but WITHOUT ANY WARRANTY; without even the implied warranty of
- + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- + * GNU General Public License for more details.
- + *
- + * You should have received a copy of the GNU General Public License
- + * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
- + */
- +
- +#ifndef GRUB_LOCKDOWN_H
- +#define GRUB_LOCKDOWN_H 1
- +
- +#include <grub/symbol.h>
- +
- +#define GRUB_LOCKDOWN_DISABLED 0
- +#define GRUB_LOCKDOWN_ENABLED 1
- +
- +#ifdef GRUB_MACHINE_EFI
- +extern void
- +EXPORT_FUNC (grub_lockdown) (void);
- +extern int
- +EXPORT_FUNC (grub_is_lockdown) (void);
- +#else
- +static inline void
- +grub_lockdown (void)
- +{
- +}
- +
- +static inline int
- +grub_is_lockdown (void)
- +{
- + return GRUB_LOCKDOWN_DISABLED;
- +}
- +#endif
- +#endif /* ! GRUB_LOCKDOWN_H */
- diff --git a/po/POTFILES.in b/po/POTFILES.in
- index 49755d3..5e26845 100644
- --- a/po/POTFILES.in
- +++ b/po/POTFILES.in
- @@ -309,6 +309,7 @@
- ./grub-core/kern/ieee1275/mmap.c
- ./grub-core/kern/ieee1275/openfw.c
- ./grub-core/kern/list.c
- +./grub-core/kern/lockdown.c
- ./grub-core/kern/main.c
- ./grub-core/kern/mips/arc/init.c
- ./grub-core/kern/mips/dl.c
- @@ -1207,6 +1208,7 @@
- ./include/grub/linux.h
- ./include/grub/list.h
- ./include/grub/loader.h
- +./include/grub/lockdown.h
- ./include/grub/lvm.h
- ./include/grub/macho.h
- ./include/grub/machoload.h
- --
- 2.14.2
|