Skip to content

[secure boot]Fix mokutil check issue with ONIE version older than 202… #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
davidpil2002 wants to merge 6 commits into
base: master
Choose a base branch
from
Open

[secure boot]Fix mokutil check issue with ONIE version older than 202… #5

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
29cdac1
[secure boot]Fix mokutil check issue with ONIE version older than 202…
davidpil2002 Apr 10, 2023
81d0874
[secure boot]define a MACRO for enable state
davidpil2002 Apr 13, 2023
67051ff
[secure boot]Made the condition of secure boot state more safe
davidpil2002 Apr 14, 2023
b4807e4
[secure boot]Fix lower case print
davidpil2002 Apr 19, 2023
1130eff
[secure boot]Fix Grub linuxefi call issue, by using this cmd only in …
davidpil2002 Apr 23, 2023
c48f111
secure boot: add delimiter to reggex
davidpil2002 May 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 14 additions & 16 deletions installer/default_platform.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -434,14 +434,23 @@ bootloader_menu_config()
${onie_bin} onie-support /tmp
mv $onie_initrd_tmp/tmp/onie-support*.tar.bz2 $demo_mnt/$image_dir/

echo "firmware=$firmware"
if [ "$firmware" = "uefi" ] ; then
secure_boot_state=$(mokutil --sb-state)
secure_boot_state=0
reg_sb_guid=""
ENABLED=1
echo "checking secure boot state"
reg_sb_guid=$(efivar -l | grep "SecureBoot$") || echo "Secure Boot GUID not found in efivar list"
echo "Secure Boot GUID=$reg_sb_guid"
if [ -n "$reg_sb_guid" ]; then
secure_boot_state=$(efivar -d --name $reg_sb_guid) || echo "Could not read Secure Boot state from efivar"
fi
echo secure_boot_state=$secure_boot_state
if [ "$secure_boot_state" = "SecureBoot enabled" ]; then
echo "UEFI Secure Boot is enabled"
if expr "$secure_boot_state" : '[[:digit:]]\{1,\}' >/dev/null && [ "$secure_boot_state" -eq "$ENABLED" ]; then
echo "UEFI Secure Boot is enabled - Installing shim bootloader"
demo_install_uefi_shim "$demo_mnt" "$blk_dev"
else
echo "UEFI Secure Boot is disabled"
echo "UEFI Secure Boot is disabled - Installing regular grub bootloader"
demo_install_uefi_grub "$demo_mnt" "$blk_dev"
fi
else
Expand Down Expand Up @@ -561,7 +570,7 @@ echo "EXTRA_CMDLINE_LINUX=$extra_cmdline_linux"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX $extra_cmdline_linux"
GRUB_CFG_LINUX_CMD=""
GRUB_CFG_INITRD_CMD=""
if [ "$firmware" = "uefi" ] ; then
if [ "$firmware" = "uefi" ] && expr "$secure_boot_state" : '[[:digit:]]\{1,\}' >/dev/null && [ "$secure_boot_state" -eq "$ENABLED" ]; then
# grub.cfg when BIOS is UEFI and support Secure Boot
GRUB_CFG_LINUX_CMD="linuxefi"
GRUB_CFG_INITRD_CMD="initrdefi"
Expand Down Expand Up @@ -608,17 +617,6 @@ EOF
cp $grub_cfg $onie_initrd_tmp/$demo_mnt/grub/grub.cfg
fi

if [ "$secure_boot_state" = "SecureBoot enabled" ]; then
# Secure Boot grub.cfg support
# Saving grub_cfg in the same place where is grubx64.efi,
# this grub_cfg file will be called by first grub.cfg file from: /boot/efi/EFI/debian/grub.cfg
if [ -f $NVOS_BOOT_DIR/grub.cfg ]; then
rm $NVOS_BOOT_DIR/grub.cfg
fi

cp $grub_cfg $NVOS_BOOT_DIR/grub.cfg
fi

cd /

echo "Installed SONiC base image $demo_volume_label successfully"
Expand Down