0036-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch 1.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. From d90367471779c240e002e62edfb6b31fc85b4908 Mon Sep 17 00:00:00 2001
  2. From: Javier Martinez Canillas <javierm@redhat.com>
  3. Date: Tue, 2 Feb 2021 19:59:48 +0100
  4. Subject: [PATCH] kern/lockdown: Set a variable if the GRUB is locked down
  5. It may be useful for scripts to determine whether the GRUB is locked
  6. down or not. Add the lockdown variable which is set to "y" when the GRUB
  7. is locked down.
  8. Suggested-by: Dimitri John Ledkov <xnox@ubuntu.com>
  9. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
  10. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  12. ---
  13. docs/grub.texi | 3 +++
  14. grub-core/kern/lockdown.c | 4 ++++
  15. 2 files changed, 7 insertions(+)
  16. diff --git a/docs/grub.texi b/docs/grub.texi
  17. index a25459f..bdbb329 100644
  18. --- a/docs/grub.texi
  19. +++ b/docs/grub.texi
  20. @@ -5803,6 +5803,9 @@ The GRUB can be locked down when booted on a secure boot environment, for exampl
  21. if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
  22. be restricted and some operations/commands cannot be executed.
  23. +The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
  24. +Otherwise it does not exit.
  25. +
  26. @node Platform limitations
  27. @chapter Platform limitations
  28. diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c
  29. index 1e56c0b..0bc70fd 100644
  30. --- a/grub-core/kern/lockdown.c
  31. +++ b/grub-core/kern/lockdown.c
  32. @@ -18,6 +18,7 @@
  33. */
  34. #include <grub/dl.h>
  35. +#include <grub/env.h>
  36. #include <grub/file.h>
  37. #include <grub/lockdown.h>
  38. #include <grub/verify.h>
  39. @@ -71,6 +72,9 @@ grub_lockdown (void)
  40. lockdown = GRUB_LOCKDOWN_ENABLED;
  41. grub_verifier_register (&lockdown_verifier);
  42. +
  43. + grub_env_set ("lockdown", "y");
  44. + grub_env_export ("lockdown");
  45. }
  46. int
  47. --
  48. 2.14.2