|
Lines 39-44
opt_target=""
Link Here
|
| 39 |
opt_mode="auto" |
39 |
opt_mode="auto" |
| 40 |
opt_verbose=0 |
40 |
opt_verbose=0 |
| 41 |
opt_dry_run=0 |
41 |
opt_dry_run=0 |
|
|
42 |
secure_boot_extra_fallback_managed=0 |
| 42 |
grub_install_extra_args=() |
43 |
grub_install_extra_args=() |
| 43 |
|
44 |
|
| 44 |
GRUB_SYSCONF="/etc/sysconfig/grub2" |
45 |
GRUB_SYSCONF="/etc/sysconfig/grub2" |
|
Lines 345-350
safe_copy() {
Link Here
|
| 345 |
verbose "copied $src -> $dst" |
346 |
verbose "copied $src -> $dst" |
| 346 |
} |
347 |
} |
| 347 |
|
348 |
|
|
|
349 |
# --- EFI binary ownership --- |
| 350 |
|
| 351 |
is_alt_fallback() { |
| 352 |
local efi_binary="$1" |
| 353 |
local vendor_name="" vendor_package_name="" last_sbat_entry="" |
| 354 |
|
| 355 |
[ -r "$efi_binary" ] || return 1 |
| 356 |
|
| 357 |
last_sbat_entry="$(grub-dumpsbat "$efi_binary" 2>/dev/null | \ |
| 358 |
tr -d '\0' | tail -n1)" || return 1 |
| 359 |
|
| 360 |
IFS=, read -r _ _ vendor_name vendor_package_name _ _ \ |
| 361 |
<<< "$last_sbat_entry" |
| 362 |
|
| 363 |
[ "$vendor_name" = "ALT Linux" ] || return 1 |
| 364 |
|
| 365 |
case "$vendor_package_name" in |
| 366 |
shim|grub) return 0 ;; |
| 367 |
*) return 1 ;; |
| 368 |
esac |
| 369 |
} |
| 370 |
|
| 371 |
install_secure_boot_extra_fallback() { |
| 372 |
local boot_dir="$1" shim_src="$2" mm_src="$3" fb_src="$4" |
| 373 |
local fallback |
| 374 |
|
| 375 |
# Use the spelling returned by the directory scan: uppercase lookup may |
| 376 |
# fail on VFAT mounted with an incompatible iocharset. |
| 377 |
fallback="$(find "$boot_dir" -maxdepth 1 \ |
| 378 |
-iname "BOOT${efi_suffix_upper}.EFI" -print -quit)" |
| 379 |
fallback="${fallback:-$boot_dir/BOOT${efi_suffix_upper}.EFI}" |
| 380 |
|
| 381 |
if [ -e "$fallback" ]; then |
| 382 |
if ! is_alt_fallback "$fallback"; then |
| 383 |
info "preserving existing unrecognized fallback: $fallback" |
| 384 |
return 0 |
| 385 |
fi |
| 386 |
verbose "updating existing ALT fallback: $fallback" |
| 387 |
fi |
| 388 |
|
| 389 |
secure_boot_extra_fallback_managed=1 |
| 390 |
safe_copy "$shim_src" "$fallback" |
| 391 |
safe_copy "$mm_src" "$boot_dir/mm${efi_suffix}.efi" |
| 392 |
safe_copy "$fb_src" "$boot_dir/fb${efi_suffix}.efi" |
| 393 |
} |
| 394 |
|
| 348 |
# --- grub-install --- |
395 |
# --- grub-install --- |
| 349 |
|
396 |
|
| 350 |
run_grub_install() { |
397 |
run_grub_install() { |
|
Lines 407-415
install_secure_boot() {
Link Here
|
| 407 |
safe_copy "$grub_src" "$vendor_dir/grub${efi_suffix}.efi" |
454 |
safe_copy "$grub_src" "$vendor_dir/grub${efi_suffix}.efi" |
| 408 |
generate_grub_cfg "$vendor_dir" |
455 |
generate_grub_cfg "$vendor_dir" |
| 409 |
generate_boot_csv "$vendor_dir" |
456 |
generate_boot_csv "$vendor_dir" |
| 410 |
safe_copy "$shim_src" "$boot_dir/BOOT${efi_suffix_upper}.EFI" |
457 |
install_secure_boot_extra_fallback \ |
| 411 |
safe_copy "$mm_src" "$boot_dir/mm${efi_suffix}.efi" |
458 |
"$boot_dir" "$shim_src" "$mm_src" "$fb_src" |
| 412 |
safe_copy "$fb_src" "$boot_dir/fb${efi_suffix}.efi" |
|
|
| 413 |
fi |
459 |
fi |
| 414 |
} |
460 |
} |
| 415 |
|
461 |
|
|
Lines 478-488
cleanup_esp() {
Link Here
|
| 478 |
"shim${efi_suffix}.efi" \ |
524 |
"shim${efi_suffix}.efi" \ |
| 479 |
"BOOT${efi_suffix_upper}.CSV" |
525 |
"BOOT${efi_suffix_upper}.CSV" |
| 480 |
else |
526 |
else |
| 481 |
cleanup_stale_files "$boot_dir" \ |
527 |
if [ "$secure_boot_extra_fallback_managed" = 1 ]; then |
| 482 |
"grub${efi_suffix}.efi" \ |
528 |
cleanup_stale_files "$boot_dir" \ |
| 483 |
"grub.cfg" \ |
529 |
"grub${efi_suffix}.efi" \ |
| 484 |
"shim${efi_suffix}.efi" \ |
530 |
"grub.cfg" \ |
| 485 |
"BOOT${efi_suffix_upper}.CSV" |
531 |
"shim${efi_suffix}.efi" \ |
|
|
532 |
"BOOT${efi_suffix_upper}.CSV" |
| 533 |
fi |
| 486 |
cleanup_stale_files "$vendor_dir" \ |
534 |
cleanup_stale_files "$vendor_dir" \ |
| 487 |
"fb${efi_suffix}.efi" |
535 |
"fb${efi_suffix}.efi" |
| 488 |
fi |
536 |
fi |
| 489 |
- |
|
|
