123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657 |
- From d90367471779c240e002e62edfb6b31fc85b4908 Mon Sep 17 00:00:00 2001
- From: Javier Martinez Canillas <javierm@redhat.com>
- Date: Tue, 2 Feb 2021 19:59:48 +0100
- Subject: [PATCH] kern/lockdown: Set a variable if the GRUB is locked down
- It may be useful for scripts to determine whether the GRUB is locked
- down or not. Add the lockdown variable which is set to "y" when the GRUB
- is locked down.
- Suggested-by: Dimitri John Ledkov <xnox@ubuntu.com>
- Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
- Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
- Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
- ---
- docs/grub.texi | 3 +++
- grub-core/kern/lockdown.c | 4 ++++
- 2 files changed, 7 insertions(+)
- diff --git a/docs/grub.texi b/docs/grub.texi
- index a25459f..bdbb329 100644
- --- a/docs/grub.texi
- +++ b/docs/grub.texi
- @@ -5803,6 +5803,9 @@ The GRUB can be locked down when booted on a secure boot environment, for exampl
- if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
- be restricted and some operations/commands cannot be executed.
-
- +The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
- +Otherwise it does not exit.
- +
- @node Platform limitations
- @chapter Platform limitations
-
- diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c
- index 1e56c0b..0bc70fd 100644
- --- a/grub-core/kern/lockdown.c
- +++ b/grub-core/kern/lockdown.c
- @@ -18,6 +18,7 @@
- */
-
- #include <grub/dl.h>
- +#include <grub/env.h>
- #include <grub/file.h>
- #include <grub/lockdown.h>
- #include <grub/verify.h>
- @@ -71,6 +72,9 @@ grub_lockdown (void)
- lockdown = GRUB_LOCKDOWN_ENABLED;
-
- grub_verifier_register (&lockdown_verifier);
- +
- + grub_env_set ("lockdown", "y");
- + grub_env_export ("lockdown");
- }
-
- int
- --
- 2.14.2
|