Attachment 22085 Details for Bug 60316 – Набросок патча

[patch] Набросок патча

0001-grub-efi-install-preserve-foreign-extra-fallback.patch (text/plain), 4.02 KB, created by Жора Змейкин on 2026-08-30 14:32:27 MSK

(hide)

Description:

Filename:

MIME Type:

Creator: Жора Змейкин

Created: 2026-08-30 14:32:27 MSK

Size: 4.02 KB

patch

obsolete

>From e82250a59907a18f6ac430f48d8f9ba0c789afaf Mon Sep 17 00:00:00 2001
>From: Zhora Zmeykin <me@katze-942.ru>
>Date: Tue, 25 Aug 2026 02:15:00 +0300
>Subject: grub-efi-install: preserve unrecognized extra fallback
>
>When grub-efi-install runs in SECURE_BOOT mode without --removable, locate an
>existing EFI/BOOT fallback without relying on a lookup of its canonical
>uppercase name. This also handles VFAT entries whose stored spelling differs
>in case.
>
>Only update an existing fallback when its last SBAT vendor row identifies an
>ALT Linux shim or GRUB binary. Preserve unrecognized fallback bundles while
>allowing vendor-file installation and normal NVRAM handling to complete.
>---
> altlinux/grub-efi-install | 64 ++++++++++++++++++++++++++++++++++-----
> 1 file changed, 56 insertions(+), 8 deletions(-)
>
>diff --git a/altlinux/grub-efi-install b/altlinux/grub-efi-install
>index 6e25782ef..30c777118 100755
>--- a/altlinux/grub-efi-install
>+++ b/altlinux/grub-efi-install
>@@ -39,6 +39,7 @@ opt_target=""
> opt_mode="auto"
> opt_verbose=0
> opt_dry_run=0
>+secure_boot_extra_fallback_managed=0
> grub_install_extra_args=()
> 
> GRUB_SYSCONF="/etc/sysconfig/grub2"
>@@ -345,6 +346,52 @@ safe_copy() {
>     verbose "copied $src -> $dst"
> }
> 
>+# --- EFI binary ownership ---
>+
>+is_alt_fallback() {
>+    local efi_binary="$1"
>+    local vendor_name="" vendor_package_name="" last_sbat_entry=""
>+
>+    [ -r "$efi_binary" ] || return 1
>+
>+    last_sbat_entry="$(grub-dumpsbat "$efi_binary" 2>/dev/null | \
>+                          tr -d '\0' | tail -n1)" || return 1
>+
>+    IFS=, read -r _ _ vendor_name vendor_package_name _ _ \
>+        <<< "$last_sbat_entry"
>+
>+    [ "$vendor_name" = "ALT Linux" ] || return 1
>+
>+    case "$vendor_package_name" in
>+        shim|grub) return 0 ;;
>+        *)         return 1 ;;
>+    esac
>+}
>+
>+install_secure_boot_extra_fallback() {
>+    local boot_dir="$1" shim_src="$2" mm_src="$3" fb_src="$4"
>+    local fallback
>+
>+    # Use the spelling returned by the directory scan: uppercase lookup may
>+    # fail on VFAT mounted with an incompatible iocharset.
>+    fallback="$(find "$boot_dir" -maxdepth 1 \
>+        -iname "BOOT${efi_suffix_upper}.EFI" -print -quit)"
>+    fallback="${fallback:-$boot_dir/BOOT${efi_suffix_upper}.EFI}"
>+
>+    if [ -e "$fallback" ]; then
>+        if ! is_alt_fallback "$fallback"; then
>+            info "preserving existing unrecognized fallback: $fallback"
>+            return 0
>+        fi
>+        verbose "updating existing ALT fallback: $fallback"
>+    fi
>+
>+    secure_boot_extra_fallback_managed=1
>+    safe_copy "$shim_src" "$fallback"
>+    safe_copy "$mm_src"   "$boot_dir/mm${efi_suffix}.efi"
>+    safe_copy "$fb_src"   "$boot_dir/fb${efi_suffix}.efi"
>+}
>+
> # --- grub-install ---
> 
> run_grub_install() {
>@@ -407,9 +454,8 @@ install_secure_boot() {
>         safe_copy "$grub_src" "$vendor_dir/grub${efi_suffix}.efi"
>         generate_grub_cfg "$vendor_dir"
>         generate_boot_csv "$vendor_dir"
>-        safe_copy "$shim_src" "$boot_dir/BOOT${efi_suffix_upper}.EFI"
>-        safe_copy "$mm_src"   "$boot_dir/mm${efi_suffix}.efi"
>-        safe_copy "$fb_src"   "$boot_dir/fb${efi_suffix}.efi"
>+        install_secure_boot_extra_fallback \
>+            "$boot_dir" "$shim_src" "$mm_src" "$fb_src"
>     fi
> }
> 
>@@ -478,11 +524,13 @@ cleanup_esp() {
>                     "shim${efi_suffix}.efi" \
>                     "BOOT${efi_suffix_upper}.CSV"
>             else
>-                cleanup_stale_files "$boot_dir" \
>-                    "grub${efi_suffix}.efi" \
>-                    "grub.cfg" \
>-                    "shim${efi_suffix}.efi" \
>-                    "BOOT${efi_suffix_upper}.CSV"
>+                if [ "$secure_boot_extra_fallback_managed" = 1 ]; then
>+                    cleanup_stale_files "$boot_dir" \
>+                        "grub${efi_suffix}.efi" \
>+                        "grub.cfg" \
>+                        "shim${efi_suffix}.efi" \
>+                        "BOOT${efi_suffix_upper}.CSV"
>+                fi
>                 cleanup_stale_files "$vendor_dir" \
>                     "fb${efi_suffix}.efi"
>             fi
>-- 
>2.50.1

Actions: View | Diff

Attachments on bug 60316: 22085