f1d3c74
From 7a65d7b558974c89f19afaf0d78b54dc0327f56c Mon Sep 17 00:00:00 2001
5c5b940
From: Matthew Garrett <mjg@redhat.com>
f1d3c74
Date: Wed, 15 Aug 2012 09:53:05 -0400
f1d3c74
Subject: [PATCH] Don't permit insmod on secure boot
f1d3c74
f1d3c74
---
f1d3c74
 grub-core/kern/corecmd.c |  9 +++++++++
f1d3c74
 grub-core/kern/efi/efi.c | 28 ++++++++++++++++++++++++++++
f1d3c74
 include/grub/efi/efi.h   |  1 +
f1d3c74
 3 files changed, 38 insertions(+)
f742f42
f742f42
diff --git a/grub-core/kern/corecmd.c b/grub-core/kern/corecmd.c
f742f42
index eec575c..3df9dbd 100644
f742f42
--- a/grub-core/kern/corecmd.c
f742f42
+++ b/grub-core/kern/corecmd.c
f742f42
@@ -28,6 +28,10 @@
f742f42
 #include <grub/command.h>
f742f42
 #include <grub/i18n.h>
f742f42
 
f742f42
+#ifdef GRUB_MACHINE_EFI
f742f42
+#include <grub/efi/efi.h>
f742f42
+#endif
f742f42
+
f742f42
 /* set ENVVAR=VALUE */
f742f42
 static grub_err_t
f742f42
 grub_core_cmd_set (struct grub_command *cmd __attribute__ ((unused)),
176f649
@@ -81,6 +85,13 @@ grub_core_cmd_insmod (struct grub_command *cmd __attribute__ ((unused)),
f742f42
 {
f742f42
   grub_dl_t mod;
f742f42
 
f742f42
+#ifdef GRUB_MACHINE_EFI
176f649
+  if (grub_efi_secure_boot()) {
176f649
+    //grub_printf("%s\n", N_("Secure Boot forbids insmod"));
176f649
+    return 0;
176f649
+  }
f742f42
+#endif
f742f42
+
f742f42
   if (argc == 0)
f742f42
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected"));
f742f42
 
f742f42
diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
f1d3c74
index 820968f..ad7aa8d 100644
f742f42
--- a/grub-core/kern/efi/efi.c
f742f42
+++ b/grub-core/kern/efi/efi.c
f1d3c74
@@ -259,6 +259,34 @@ grub_efi_set_variable(const char *var, const grub_efi_guid_t *guid,
f1d3c74
   return grub_error (GRUB_ERR_IO, "could not set EFI variable `%s'", var);
f742f42
 }
f742f42
 
f742f42
+grub_efi_boolean_t
f742f42
+grub_efi_secure_boot (void)
f742f42
+{
f742f42
+  grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
f742f42
+  grub_size_t datasize;
f742f42
+  char *secure_boot = NULL;
f742f42
+  char *setup_mode = NULL;
f742f42
+  grub_efi_boolean_t ret = 0;
f742f42
+
f742f42
+  secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
f742f42
+
f742f42
+  if (datasize != 1 || !secure_boot)
f742f42
+    goto out;
f742f42
+
f742f42
+  setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);
f742f42
+
f742f42
+  if (datasize != 1 || !setup_mode)
f742f42
+    goto out;
f742f42
+
f742f42
+  if (*secure_boot && !*setup_mode)
f742f42
+    ret = 1;
f742f42
+
f742f42
+ out:
f742f42
+  grub_free (secure_boot);
f742f42
+  grub_free (setup_mode);
f742f42
+  return ret;
f742f42
+}
f742f42
+
f742f42
 #pragma GCC diagnostic ignored "-Wcast-align"
f742f42
 
f742f42
 /* Search the mods section from the PE32/PE32+ image. This code uses
f742f42
diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
f1d3c74
index 9370fd5..a000c38 100644
f742f42
--- a/include/grub/efi/efi.h
f742f42
+++ b/include/grub/efi/efi.h
f1d3c74
@@ -72,6 +72,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
f1d3c74
 				     const grub_efi_guid_t *guid,
f1d3c74
 				     void *data,
f1d3c74
 				     grub_size_t datasize);
f742f42
+grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);
f742f42
 int
f742f42
 EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
f742f42
 					     const grub_efi_device_path_t *dp2);
f1d3c74
-- 
f1d3c74
1.7.11.2
f1d3c74