system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-10-07 00:30:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

bootctl: optionally install .signed efi file

Browse source 
if /usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed exists
install that instead of /usr/lib/systemd/boot/efi/systemd-bootx64.efi

the idea is that SecureBoot tooling can create the efi.signed file
whenever /usr/lib/systemd/boot/efi/systemd-bootx64.efi from the package
is updated.
This commit is contained in:
Дамјан Георгиевски 2021-11-29 22:44:01 +01:00 committed by Zbigniew Jędrzejewski-Szmek
parent 0264c60d44
commit 12caf72716
2 changed files with 26 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
man/bootctl.xml
View file

@ -286,6 +286,14 @@
</variablelist>
</refsect1>
<refsect1>
<title>Signed .efi files</title>
<para><command>bootctl</command> <option>install</option> and <option>update</option> will look for a
<command>systemd-boot</command> file ending with the <literal>.efi.signed</literal> suffix first, and copy
that instead of the normal <literal>.efi</literal> file. This allows distributions or end-users to provide
signed images for UEFI SecureBoot.</para>
</refsect1>
<refsect1>
<title>Exit status</title>
<para>On success, 0 is returned, a non-zero failure code otherwise.</para>

22
src/boot/bootctl.c
View file

@ -628,14 +628,19 @@ static int create_subdirs(const char *root, const char * const *subdirs) {
static int copy_one_file(const char *esp_path, const char *name, bool force) {
const char *e;
char *p, *q;
char *p, *q, *dest_name, *s;
int r;
dest_name = strdupa_safe(name);
s = endswith_no_case(dest_name, ".signed");
if (s)
*s = 0;
p = strjoina(BOOTLIBDIR "/", name);
q = strjoina(esp_path, "/EFI/systemd/", name);
q = strjoina(esp_path, "/EFI/systemd/", dest_name);
r = copy_file_with_version_check(p, q, force);
e = startswith(name, "systemd-boot");
e = startswith(dest_name, "systemd-boot");
if (e) {
int k;
char *v;
@ -664,9 +669,18 @@ static int install_binaries(const char *esp_path, bool force) {
FOREACH_DIRENT(de, d, return log_error_errno(errno, "Failed to read \""BOOTLIBDIR"\": %m")) {
int k;
if (!endswith_no_case(de->d_name, ".efi"))
if (!endswith_no_case(de->d_name, ".efi") && !endswith_no_case(de->d_name, ".efi.signed"))
continue;
/* skip the .efi file, if there's a .signed version of it */
if (endswith_no_case(de->d_name, ".efi")) {
_cleanup_free_ const char *s = strjoin(BOOTLIBDIR, "/", de->d_name, ".signed");
if (!s)
return log_oom();
if (access(s, F_OK) >= 0)
continue;
}
k = copy_one_file(esp_path, de->d_name, force);
/* Don't propagate an error code if no update necessary, installed version already equal or
* newer version, or other boot loader in place. */