From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Jan Hlavac Date: Fri, 20 Nov 2020 23:51:47 +0100 Subject: [PATCH] grub-install: disable support for EFI platforms For each platform, GRUB is shipped as a kernel image and a set of modules. These files are then used by the grub-install utility to install GRUB on a specific device. However, in order to support UEFI Secure Boot, the resulting EFI binary must be signed by a recognized private key. For this reason, for EFI platforms, most distributions also ship prebuilt EFI binaries signed by a distribution-specific private key. In this case, however, the grub-install utility should not be used because it would overwrite the signed EFI binary. The current fix is suboptimal because it preserves all EFI-related code. A better solution could be to modularize the code and provide a build-time option. Resolves: rhbz#1737444 Signed-off-by: Jan Hlavac [rharwood: drop man page] --- util/grub-install.c | 41 +++++++++++++++++++---------------------- docs/grub.texi | 7 +++++++ 2 files changed, 26 insertions(+), 22 deletions(-) diff --git a/util/grub-install.c b/util/grub-install.c index 66ef9494d9d..828e8722ba5 100644 --- a/util/grub-install.c +++ b/util/grub-install.c @@ -915,6 +915,25 @@ main (int argc, char *argv[]) platform = grub_install_get_target (grub_install_source_directory); + switch (platform) + { + case GRUB_INSTALL_PLATFORM_ARM_EFI: + case GRUB_INSTALL_PLATFORM_ARM64_EFI: + case GRUB_INSTALL_PLATFORM_I386_EFI: + case GRUB_INSTALL_PLATFORM_IA64_EFI: + case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: + case GRUB_INSTALL_PLATFORM_RISCV32_EFI: + case GRUB_INSTALL_PLATFORM_RISCV64_EFI: + case GRUB_INSTALL_PLATFORM_X86_64_EFI: + is_efi = 1; + grub_util_error (_("this utility cannot be used for EFI platforms" + " because it does not support UEFI Secure Boot")); + break; + default: + is_efi = 0; + break; + } + { char *platname = grub_install_get_platform_name (platform); fprintf (stderr, _("Installing for %s platform.\n"), platname); @@ -1029,27 +1048,6 @@ main (int argc, char *argv[]) grub_hostfs_init (); grub_host_init (); - switch (platform) - { - case GRUB_INSTALL_PLATFORM_I386_EFI: - case GRUB_INSTALL_PLATFORM_X86_64_EFI: - case GRUB_INSTALL_PLATFORM_ARM_EFI: - case GRUB_INSTALL_PLATFORM_ARM64_EFI: - case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: - case GRUB_INSTALL_PLATFORM_RISCV32_EFI: - case GRUB_INSTALL_PLATFORM_RISCV64_EFI: - case GRUB_INSTALL_PLATFORM_IA64_EFI: - is_efi = 1; - break; - default: - is_efi = 0; - break; - - /* pacify warning. */ - case GRUB_INSTALL_PLATFORM_MAX: - break; - } - switch (platform) { case GRUB_INSTALL_PLATFORM_I386_IEEE1275: @@ -1065,7 +1063,6 @@ main (int argc, char *argv[]) } /* Find the EFI System Partition. */ - if (is_efi) { grub_fs_t fs; diff --git a/docs/grub.texi b/docs/grub.texi index 44c4e665a0d..1e577d2fee9 100644 --- a/docs/grub.texi +++ b/docs/grub.texi @@ -7112,6 +7112,13 @@ grub2-install @var{install_device} The device name @var{install_device} is an OS device name or a GRUB device name. +In order to support UEFI Secure Boot, the resulting GRUB EFI binary must +be signed by a recognized private key. For this reason, for EFI +platforms, most distributions also ship prebuilt GRUB EFI binaries +signed by a distribution-specific private key. In this case, however, +@command{grub2-install} should not be used because it would overwrite +the signed EFI binary. + @command{grub2-install} accepts the following options: @table @option