morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

efi: honour SYSTEMD_EFI_OPTIONS even if we wouldn't honour SystemdOptions EFI var due to SecureBoot

Browse Source 
Fixes: #14864
This commit is contained in:
Lennart Poettering
2020-04-30 10:08:54 +02:00
parent f46ba93944
commit 484f4e5b2d
2 changed files with 25 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/basic/efivars.c
View File

@@ -313,6 +313,29 @@ int systemd_efi_options_variable(char **line) {
return 0;
}
/* In SecureBoot mode this is probably not what you want. As your cmdline is cryptographically signed
* like when using Type #2 EFI Unified Kernel Images (https://systemd.io/BOOT_LOADER_SPECIFICATION/)
* The user's intention is then that the cmdline should not be modified. You want to make sure that
* the system starts up as exactly specified in the signed artifact.
*
* (NB: to make testing purposes we still check the $SYSTEMD_EFI_OPTIONS env var above, even when in
* SecureBoot mode.) */
if (is_efi_secure_boot()) {
_cleanup_free_ char *k;
k = efi_variable_path(EFI_VENDOR_SYSTEMD, "SystemdOptions");
if (!k)
return -ENOMEM;
/* Let's be helpful with the returned error and check if the variable exists at all. If it
* does, let's return a recognizable error (EPERM), and if not ENODATA. */
if (access(k, F_OK) < 0)
return errno == -ENOENT ? -ENODATA : -errno;
return -EPERM;
}
r = efi_get_variable_string(EFI_VENDOR_SYSTEMD, "SystemdOptions", line);
if (r == -ENOENT)
return -ENODATA;

16
src/basic/proc-cmdline.c
View File

@@ -39,18 +39,6 @@ int proc_cmdline(char **ret) {
return read_one_line_file("/proc/cmdline", ret);
}
/* In SecureBoot mode this is probably not what you want. As your cmdline is
* cryptographically signed like when using Type #2 EFI Unified Kernel Images
* (https://systemd.io/BOOT_LOADER_SPECIFICATION/) The user's intention is then
* that the cmdline should not be modified. You want to make sure that the
* system starts up as exactly specified in the signed artifact. */
static int systemd_options_variable(char **line) {
if (is_efi_secure_boot())
return -ENODATA;
return systemd_efi_options_variable(line);
}
static int proc_cmdline_extract_first(const char **p, char **ret_word, ProcCmdlineFlags flags) {
const char *q = *p;
int r;
@@ -131,7 +119,7 @@ int proc_cmdline_parse(proc_cmdline_parse_t parse_item, void *data, ProcCmdlineF
/* We parse the EFI variable first, because later settings have higher priority. */
r = systemd_options_variable(&line);
r = systemd_efi_options_variable(&line);
if (r < 0 && r != -ENODATA)
log_debug_errno(r, "Failed to get SystemdOptions EFI variable, ignoring: %m");
@@ -262,7 +250,7 @@ int proc_cmdline_get_key(const char *key, ProcCmdlineFlags flags, char **ret_val
return r;
line = mfree(line);
r = systemd_options_variable(&line);
r = systemd_efi_options_variable(&line);
if (r == -ENODATA)
return false; /* Not found */
if (r < 0)