Update buildroot to 2021.02.1 (#1312)
Signed-off-by: Stefan Agner <stefan@agner.ch>
This commit is contained in:
Stefan Agner
763
buildroot/boot/grub2/0035-kern-Add-lockdown-support.patch
Normal file
763
buildroot/boot/grub2/0035-kern-Add-lockdown-support.patch
Normal file
@@ -0,0 +1,763 @@
|
||||
From 578c95298bcc46e0296f4c786db64c2ff26ce2cc Mon Sep 17 00:00:00 2001
|
||||
From: Javier Martinez Canillas <javierm@redhat.com>
|
||||
Date: Mon, 28 Sep 2020 20:08:02 +0200
|
||||
Subject: [PATCH] kern: Add lockdown support
|
||||
|
||||
When the GRUB starts on a secure boot platform, some commands can be
|
||||
used to subvert the protections provided by the verification mechanism and
|
||||
could lead to booting untrusted system.
|
||||
|
||||
To prevent that situation, allow GRUB to be locked down. That way the code
|
||||
may check if GRUB has been locked down and further restrict the commands
|
||||
that are registered or what subset of their functionality could be used.
|
||||
|
||||
The lockdown support adds the following components:
|
||||
|
||||
* The grub_lockdown() function which can be used to lockdown GRUB if,
|
||||
e.g., UEFI Secure Boot is enabled.
|
||||
|
||||
* The grub_is_lockdown() function which can be used to check if the GRUB
|
||||
was locked down.
|
||||
|
||||
* A verifier that flags OS kernels, the GRUB modules, Device Trees and ACPI
|
||||
tables as GRUB_VERIFY_FLAGS_DEFER_AUTH to defer verification to other
|
||||
verifiers. These files are only successfully verified if another registered
|
||||
verifier returns success. Otherwise, the whole verification process fails.
|
||||
|
||||
For example, PE/COFF binaries verification can be done by the shim_lock
|
||||
verifier which validates the signatures using the shim_lock protocol.
|
||||
However, the verification is not deferred directly to the shim_lock verifier.
|
||||
The shim_lock verifier is hooked into the verification process instead.
|
||||
|
||||
* A set of grub_{command,extcmd}_lockdown functions that can be used by
|
||||
code registering command handlers, to only register unsafe commands if
|
||||
the GRUB has not been locked down.
|
||||
|
||||
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
||||
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||
[Add changes to generated files]
|
||||
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
|
||||
---
|
||||
Makefile.in | 2 ++
|
||||
conf/Makefile.common | 2 ++
|
||||
docs/grub-dev.texi | 27 +++++++++++++++
|
||||
docs/grub.texi | 8 +++++
|
||||
grub-core/Makefile.am | 5 ++-
|
||||
grub-core/Makefile.core.am | 14 ++++----
|
||||
grub-core/Makefile.core.def | 1 +
|
||||
grub-core/Makefile.in | 73 ++++++++++++++++++++++++++++++-----------
|
||||
grub-core/commands/extcmd.c | 23 +++++++++++++
|
||||
grub-core/kern/command.c | 24 ++++++++++++++
|
||||
grub-core/kern/lockdown.c | 80 +++++++++++++++++++++++++++++++++++++++++++++
|
||||
include/grub/command.h | 5 +++
|
||||
include/grub/extcmd.h | 7 ++++
|
||||
include/grub/lockdown.h | 44 +++++++++++++++++++++++++
|
||||
po/POTFILES.in | 2 ++
|
||||
15 files changed, 290 insertions(+), 27 deletions(-)
|
||||
create mode 100644 grub-core/kern/lockdown.c
|
||||
create mode 100644 include/grub/lockdown.h
|
||||
|
||||
diff --git a/Makefile.in b/Makefile.in
|
||||
index e6a185b..ecb3278 100644
|
||||
--- a/Makefile.in
|
||||
+++ b/Makefile.in
|
||||
@@ -2617,7 +2617,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
|
||||
CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' \
|
||||
'-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' \
|
||||
+ '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
||||
'-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' \
|
||||
+ '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
||||
'-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
|
||||
diff --git a/conf/Makefile.common b/conf/Makefile.common
|
||||
index 6cd71cb..2a1a886 100644
|
||||
--- a/conf/Makefile.common
|
||||
+++ b/conf/Makefile.common
|
||||
@@ -84,7 +84,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
|
||||
CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_TERMINAL_LIST += '-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)'
|
||||
+CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)'
|
||||
+CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
|
||||
diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
|
||||
index ee389fd..635ec72 100644
|
||||
--- a/docs/grub-dev.texi
|
||||
+++ b/docs/grub-dev.texi
|
||||
@@ -86,6 +86,7 @@ This edition documents version @value{VERSION}.
|
||||
* PFF2 Font File Format::
|
||||
* Graphical Menu Software Design::
|
||||
* Verifiers framework::
|
||||
+* Lockdown framework::
|
||||
* Copying This Manual:: Copying This Manual
|
||||
* Index::
|
||||
@end menu
|
||||
@@ -2086,6 +2087,32 @@ Optionally at the end of the file @samp{fini}, if it exists, is called with just
|
||||
the context. If you return no error during any of @samp{init}, @samp{write} and
|
||||
@samp{fini} then the file is considered as having succeded verification.
|
||||
|
||||
+@node Lockdown framework
|
||||
+@chapter Lockdown framework
|
||||
+
|
||||
+The GRUB can be locked down, which is a restricted mode where some operations
|
||||
+are not allowed. For instance, some commands cannot be used when the GRUB is
|
||||
+locked down.
|
||||
+
|
||||
+The function
|
||||
+@code{grub_lockdown()} is used to lockdown GRUB and the function
|
||||
+@code{grub_is_lockdown()} function can be used to check whether lockdown is
|
||||
+enabled or not. When enabled, the function returns @samp{GRUB_LOCKDOWN_ENABLED}
|
||||
+and @samp{GRUB_LOCKDOWN_DISABLED} when is not enabled.
|
||||
+
|
||||
+The following functions can be used to register the commands that can only be
|
||||
+used when lockdown is disabled:
|
||||
+
|
||||
+@itemize
|
||||
+
|
||||
+@item @code{grub_cmd_lockdown()} registers command which should not run when the
|
||||
+GRUB is in lockdown mode.
|
||||
+
|
||||
+@item @code{grub_cmd_lockdown()} registers extended command which should not run
|
||||
+when the GRUB is in lockdown mode.
|
||||
+
|
||||
+@end itemize
|
||||
+
|
||||
@node Copying This Manual
|
||||
@appendix Copying This Manual
|
||||
|
||||
diff --git a/docs/grub.texi b/docs/grub.texi
|
||||
index aefe032..a25459f 100644
|
||||
--- a/docs/grub.texi
|
||||
+++ b/docs/grub.texi
|
||||
@@ -5581,6 +5581,7 @@ environment variables and commands are listed in the same order.
|
||||
* Using digital signatures:: Booting digitally signed code
|
||||
* UEFI secure boot and shim:: Booting digitally signed PE files
|
||||
* Measured Boot:: Measuring boot components
|
||||
+* Lockdown:: Lockdown when booting on a secure setup
|
||||
@end menu
|
||||
|
||||
@node Authentication and authorisation
|
||||
@@ -5795,6 +5796,13 @@ into @file{core.img} in order to avoid a potential gap in measurement between
|
||||
|
||||
Measured boot is currently only supported on EFI platforms.
|
||||
|
||||
+@node Lockdown
|
||||
+@section Lockdown when booting on a secure setup
|
||||
+
|
||||
+The GRUB can be locked down when booted on a secure boot environment, for example
|
||||
+if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
|
||||
+be restricted and some operations/commands cannot be executed.
|
||||
+
|
||||
@node Platform limitations
|
||||
@chapter Platform limitations
|
||||
|
||||
diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
|
||||
index cc6fc7d..30e23ad 100644
|
||||
--- a/grub-core/Makefile.am
|
||||
+++ b/grub-core/Makefile.am
|
||||
@@ -80,6 +80,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fs.h
|
||||
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/i18n.h
|
||||
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/kernel.h
|
||||
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/list.h
|
||||
+KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lockdown.h
|
||||
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/misc.h
|
||||
if COND_emu
|
||||
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/compiler-rt-emu.h
|
||||
@@ -377,8 +378,10 @@ command.lst: $(MARKER_FILES)
|
||||
b=`basename $$pp .marker`; \
|
||||
sed -n \
|
||||
-e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
||||
+ -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
||||
-e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
||||
- -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
||||
+ -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \
|
||||
+ -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
||||
done) | sort -u > $@
|
||||
platform_DATA += command.lst
|
||||
CLEANFILES += command.lst
|
||||
diff --git a/grub-core/Makefile.core.am b/grub-core/Makefile.core.am
|
||||
index 5623a5e..fbfb627 100644
|
||||
--- a/grub-core/Makefile.core.am
|
||||
+++ b/grub-core/Makefile.core.am
|
||||
@@ -22378,7 +22378,7 @@ endif
|
||||
if COND_i386_efi
|
||||
platform_PROGRAMS += kernel.exec
|
||||
kernel_exec_SOURCES = kern/i386/efi/startup.S
|
||||
-kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/i386/efi/init.c bus/pci.c kern/i386/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
+kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/i386/efi/init.c bus/pci.c kern/i386/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
||||
kernel_exec_LDADD =
|
||||
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
||||
@@ -22488,7 +22488,7 @@ endif
|
||||
if COND_x86_64_efi
|
||||
platform_PROGRAMS += kernel.exec
|
||||
kernel_exec_SOURCES = kern/x86_64/efi/startup.S
|
||||
-kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/x86_64/efi/callwrap.S kern/i386/efi/init.c bus/pci.c kern/x86_64/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
+kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/x86_64/efi/callwrap.S kern/i386/efi/init.c bus/pci.c kern/x86_64/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
||||
kernel_exec_LDADD =
|
||||
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
||||
@@ -22664,7 +22664,7 @@ endif
|
||||
if COND_ia64_efi
|
||||
platform_PROGRAMS += kernel.exec
|
||||
kernel_exec_SOURCES =
|
||||
-kernel_exec_SOURCES += kern/ia64/efi/startup.S kern/ia64/efi/init.c kern/ia64/dl.c kern/ia64/dl_helper.c kern/ia64/cache.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
+kernel_exec_SOURCES += kern/ia64/efi/startup.S kern/ia64/efi/init.c kern/ia64/dl.c kern/ia64/dl_helper.c kern/ia64/cache.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
||||
kernel_exec_LDADD =
|
||||
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL) -fno-builtin -fpic -minline-int-divide-max-throughput
|
||||
@@ -22730,7 +22730,7 @@ endif
|
||||
if COND_arm_efi
|
||||
platform_PROGRAMS += kernel.exec
|
||||
kernel_exec_SOURCES = kern/arm/efi/startup.S
|
||||
-kernel_exec_SOURCES += kern/arm/efi/init.c kern/efi/fdt.c kern/arm/dl.c kern/arm/dl_helper.c kern/arm/cache_armv6.S kern/arm/cache_armv7.S kern/arm/cache.c kern/arm/compiler-rt.S lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
+kernel_exec_SOURCES += kern/arm/efi/init.c kern/efi/fdt.c kern/arm/dl.c kern/arm/dl_helper.c kern/arm/cache_armv6.S kern/arm/cache_armv7.S kern/arm/cache.c kern/arm/compiler-rt.S lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
||||
kernel_exec_LDADD =
|
||||
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
||||
@@ -22752,7 +22752,7 @@ endif
|
||||
if COND_arm64_efi
|
||||
platform_PROGRAMS += kernel.exec
|
||||
kernel_exec_SOURCES = kern/arm64/efi/startup.S
|
||||
-kernel_exec_SOURCES += kern/arm64/efi/init.c kern/efi/fdt.c kern/arm64/cache.c kern/arm64/cache_flush.S kern/arm64/dl.c kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
+kernel_exec_SOURCES += kern/arm64/efi/init.c kern/efi/fdt.c kern/arm64/cache.c kern/arm64/cache_flush.S kern/arm64/dl.c kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
||||
kernel_exec_LDADD =
|
||||
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
||||
@@ -22796,7 +22796,7 @@ endif
|
||||
if COND_riscv32_efi
|
||||
platform_PROGRAMS += kernel.exec
|
||||
kernel_exec_SOURCES = kern/riscv/efi/startup.S
|
||||
-kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
+kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
||||
kernel_exec_LDADD =
|
||||
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
||||
@@ -22818,7 +22818,7 @@ endif
|
||||
if COND_riscv64_efi
|
||||
platform_PROGRAMS += kernel.exec
|
||||
kernel_exec_SOURCES = kern/riscv/efi/startup.S
|
||||
-kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
+kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
||||
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
||||
kernel_exec_LDADD =
|
||||
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
||||
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
|
||||
index 4d380ed..ee8dc55 100644
|
||||
--- a/grub-core/Makefile.core.def
|
||||
+++ b/grub-core/Makefile.core.def
|
||||
@@ -205,6 +205,7 @@ kernel = {
|
||||
efi = kern/acpi.c;
|
||||
efi = kern/efi/acpi.c;
|
||||
efi = kern/efi/sb.c;
|
||||
+ efi = kern/lockdown.c;
|
||||
i386_coreboot = kern/i386/pc/acpi.c;
|
||||
i386_multiboot = kern/i386/pc/acpi.c;
|
||||
i386_coreboot = kern/acpi.c;
|
||||
diff --git a/grub-core/Makefile.in b/grub-core/Makefile.in
|
||||
index 09dc802..ac400ea 100644
|
||||
--- a/grub-core/Makefile.in
|
||||
+++ b/grub-core/Makefile.in
|
||||
@@ -10457,13 +10457,14 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
kern/arm64/cache_flush.S kern/arm64/dl.c \
|
||||
kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c \
|
||||
kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c \
|
||||
- kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c \
|
||||
- kern/time.c kern/generic/millisleep.c kern/command.c \
|
||||
- kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c \
|
||||
- kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c \
|
||||
- kern/misc.c kern/parser.c kern/partition.c \
|
||||
- kern/rescue_parser.c kern/rescue_reader.c kern/term.c \
|
||||
- kern/verifiers.c kern/arm/startup.S kern/arm/coreboot/init.c \
|
||||
+ kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c \
|
||||
+ kern/compiler-rt.c kern/mm.c kern/time.c \
|
||||
+ kern/generic/millisleep.c kern/command.c kern/corecmd.c \
|
||||
+ kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c \
|
||||
+ kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c \
|
||||
+ kern/parser.c kern/partition.c kern/rescue_parser.c \
|
||||
+ kern/rescue_reader.c kern/term.c kern/verifiers.c \
|
||||
+ kern/arm/startup.S kern/arm/coreboot/init.c \
|
||||
kern/arm/coreboot/timer.c kern/arm/coreboot/coreboot.S \
|
||||
lib/fdt.c bus/fdt.c term/ps2.c term/arm/pl050.c \
|
||||
term/arm/cros.c term/arm/cros_ec.c bus/spi/rk3288_spi.c \
|
||||
@@ -10572,6 +10573,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
||||
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
||||
@@ -10646,6 +10648,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
||||
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
||||
@@ -10683,6 +10686,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
||||
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
||||
@@ -10884,6 +10888,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
||||
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
||||
@@ -11120,6 +11125,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
||||
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
||||
@@ -11287,6 +11293,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
||||
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
||||
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
||||
@@ -11379,6 +11386,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
||||
@COND_arm64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
||||
@COND_arm64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
||||
+@COND_arm64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
||||
@COND_arm64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
||||
@COND_arm64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
||||
@COND_arm64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
||||
@@ -15379,7 +15387,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
|
||||
CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' \
|
||||
'-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' \
|
||||
+ '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
||||
'-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' \
|
||||
+ '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
||||
'-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
|
||||
CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
|
||||
@@ -16387,6 +16397,7 @@ KERNEL_HEADER_FILES = $(top_srcdir)/include/grub/cache.h \
|
||||
$(top_srcdir)/include/grub/i18n.h \
|
||||
$(top_srcdir)/include/grub/kernel.h \
|
||||
$(top_srcdir)/include/grub/list.h \
|
||||
+ $(top_srcdir)/include/grub/lockdown.h \
|
||||
$(top_srcdir)/include/grub/misc.h $(am__append_5794) \
|
||||
$(am__append_5795) $(top_srcdir)/include/grub/mm.h \
|
||||
$(top_srcdir)/include/grub/parser.h \
|
||||
@@ -25594,7 +25605,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
||||
@COND_arm64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
||||
@COND_arm64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
||||
@COND_arm64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
|
||||
-@COND_arm64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
||||
+@COND_arm64_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
||||
+@COND_arm64_efi_TRUE@ kern/mm.c kern/time.c \
|
||||
@COND_arm64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
||||
@COND_arm64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
||||
@COND_arm64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
||||
@@ -25645,7 +25657,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
||||
@COND_arm_efi_TRUE@ kern/efi/init.c kern/efi/mm.c \
|
||||
@COND_arm_efi_TRUE@ term/efi/console.c kern/acpi.c \
|
||||
@COND_arm_efi_TRUE@ kern/efi/acpi.c kern/efi/sb.c \
|
||||
-@COND_arm_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
||||
+@COND_arm_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
||||
+@COND_arm_efi_TRUE@ kern/mm.c kern/time.c \
|
||||
@COND_arm_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
||||
@COND_arm_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
||||
@COND_arm_efi_TRUE@ kern/dl.c kern/env.c kern/err.c kern/file.c \
|
||||
@@ -25725,7 +25738,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
||||
@COND_i386_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
||||
@COND_i386_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
||||
@COND_i386_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
|
||||
-@COND_i386_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
||||
+@COND_i386_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
||||
+@COND_i386_efi_TRUE@ kern/mm.c kern/time.c \
|
||||
@COND_i386_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
||||
@COND_i386_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
||||
@COND_i386_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
||||
@@ -25843,7 +25857,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
||||
@COND_ia64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
||||
@COND_ia64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
||||
@COND_ia64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
|
||||
-@COND_ia64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
||||
+@COND_ia64_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
||||
+@COND_ia64_efi_TRUE@ kern/mm.c kern/time.c \
|
||||
@COND_ia64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
||||
@COND_ia64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
||||
@COND_ia64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
||||
@@ -25956,8 +25971,9 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
||||
@COND_riscv32_efi_TRUE@ kern/efi/init.c kern/efi/mm.c \
|
||||
@COND_riscv32_efi_TRUE@ term/efi/console.c kern/acpi.c \
|
||||
@COND_riscv32_efi_TRUE@ kern/efi/acpi.c kern/efi/sb.c \
|
||||
-@COND_riscv32_efi_TRUE@ kern/compiler-rt.c kern/mm.c \
|
||||
-@COND_riscv32_efi_TRUE@ kern/time.c kern/generic/millisleep.c \
|
||||
+@COND_riscv32_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
||||
+@COND_riscv32_efi_TRUE@ kern/mm.c kern/time.c \
|
||||
+@COND_riscv32_efi_TRUE@ kern/generic/millisleep.c \
|
||||
@COND_riscv32_efi_TRUE@ kern/command.c kern/corecmd.c \
|
||||
@COND_riscv32_efi_TRUE@ kern/device.c kern/disk.c kern/dl.c \
|
||||
@COND_riscv32_efi_TRUE@ kern/env.c kern/err.c kern/file.c \
|
||||
@@ -25974,9 +25990,9 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
||||
@COND_riscv64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
||||
@COND_riscv64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
||||
@COND_riscv64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c \
|
||||
-@COND_riscv64_efi_TRUE@ kern/efi/sb.c kern/compiler-rt.c \
|
||||
-@COND_riscv64_efi_TRUE@ kern/mm.c kern/time.c \
|
||||
-@COND_riscv64_efi_TRUE@ kern/generic/millisleep.c \
|
||||
+@COND_riscv64_efi_TRUE@ kern/efi/sb.c kern/lockdown.c \
|
||||
+@COND_riscv64_efi_TRUE@ kern/compiler-rt.c kern/mm.c \
|
||||
+@COND_riscv64_efi_TRUE@ kern/time.c kern/generic/millisleep.c \
|
||||
@COND_riscv64_efi_TRUE@ kern/command.c kern/corecmd.c \
|
||||
@COND_riscv64_efi_TRUE@ kern/device.c kern/disk.c kern/dl.c \
|
||||
@COND_riscv64_efi_TRUE@ kern/env.c kern/err.c kern/file.c \
|
||||
@@ -26022,8 +26038,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
||||
@COND_x86_64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
||||
@COND_x86_64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
||||
@COND_x86_64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c \
|
||||
-@COND_x86_64_efi_TRUE@ kern/efi/sb.c kern/compiler-rt.c \
|
||||
-@COND_x86_64_efi_TRUE@ kern/mm.c kern/time.c \
|
||||
+@COND_x86_64_efi_TRUE@ kern/efi/sb.c kern/lockdown.c \
|
||||
+@COND_x86_64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
||||
@COND_x86_64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
||||
@COND_x86_64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
||||
@COND_x86_64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
||||
@@ -27994,6 +28010,8 @@ kern/efi/kernel_exec-acpi.$(OBJEXT): kern/efi/$(am__dirstamp) \
|
||||
kern/efi/$(DEPDIR)/$(am__dirstamp)
|
||||
kern/efi/kernel_exec-sb.$(OBJEXT): kern/efi/$(am__dirstamp) \
|
||||
kern/efi/$(DEPDIR)/$(am__dirstamp)
|
||||
+kern/kernel_exec-lockdown.$(OBJEXT): kern/$(am__dirstamp) \
|
||||
+ kern/$(DEPDIR)/$(am__dirstamp)
|
||||
kern/kernel_exec-compiler-rt.$(OBJEXT): kern/$(am__dirstamp) \
|
||||
kern/$(DEPDIR)/$(am__dirstamp)
|
||||
kern/kernel_exec-mm.$(OBJEXT): kern/$(am__dirstamp) \
|
||||
@@ -30945,6 +30963,7 @@ distclean-compile:
|
||||
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-file.Po@am__quote@
|
||||
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-fs.Po@am__quote@
|
||||
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-list.Po@am__quote@
|
||||
+@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-lockdown.Po@am__quote@
|
||||
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-main.Po@am__quote@
|
||||
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-misc.Po@am__quote@
|
||||
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-mm.Po@am__quote@
|
||||
@@ -35293,6 +35312,20 @@ kern/efi/kernel_exec-sb.obj: kern/efi/sb.c
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/efi/kernel_exec-sb.obj `if test -f 'kern/efi/sb.c'; then $(CYGPATH_W) 'kern/efi/sb.c'; else $(CYGPATH_W) '$(srcdir)/kern/efi/sb.c'; fi`
|
||||
|
||||
+kern/kernel_exec-lockdown.o: kern/lockdown.c
|
||||
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-lockdown.o -MD -MP -MF kern/$(DEPDIR)/kernel_exec-lockdown.Tpo -c -o kern/kernel_exec-lockdown.o `test -f 'kern/lockdown.c' || echo '$(srcdir)/'`kern/lockdown.c
|
||||
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-lockdown.Tpo kern/$(DEPDIR)/kernel_exec-lockdown.Po
|
||||
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='kern/lockdown.c' object='kern/kernel_exec-lockdown.o' libtool=no @AMDEPBACKSLASH@
|
||||
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/kernel_exec-lockdown.o `test -f 'kern/lockdown.c' || echo '$(srcdir)/'`kern/lockdown.c
|
||||
+
|
||||
+kern/kernel_exec-lockdown.obj: kern/lockdown.c
|
||||
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-lockdown.obj -MD -MP -MF kern/$(DEPDIR)/kernel_exec-lockdown.Tpo -c -o kern/kernel_exec-lockdown.obj `if test -f 'kern/lockdown.c'; then $(CYGPATH_W) 'kern/lockdown.c'; else $(CYGPATH_W) '$(srcdir)/kern/lockdown.c'; fi`
|
||||
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-lockdown.Tpo kern/$(DEPDIR)/kernel_exec-lockdown.Po
|
||||
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='kern/lockdown.c' object='kern/kernel_exec-lockdown.obj' libtool=no @AMDEPBACKSLASH@
|
||||
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/kernel_exec-lockdown.obj `if test -f 'kern/lockdown.c'; then $(CYGPATH_W) 'kern/lockdown.c'; else $(CYGPATH_W) '$(srcdir)/kern/lockdown.c'; fi`
|
||||
+
|
||||
kern/kernel_exec-compiler-rt.o: kern/compiler-rt.c
|
||||
@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-compiler-rt.o -MD -MP -MF kern/$(DEPDIR)/kernel_exec-compiler-rt.Tpo -c -o kern/kernel_exec-compiler-rt.o `test -f 'kern/compiler-rt.c' || echo '$(srcdir)/'`kern/compiler-rt.c
|
||||
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-compiler-rt.Tpo kern/$(DEPDIR)/kernel_exec-compiler-rt.Po
|
||||
@@ -46650,8 +46683,10 @@ command.lst: $(MARKER_FILES)
|
||||
b=`basename $$pp .marker`; \
|
||||
sed -n \
|
||||
-e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
||||
+ -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
||||
-e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
||||
- -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
||||
+ -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \
|
||||
+ -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
||||
done) | sort -u > $@
|
||||
|
||||
partmap.lst: $(MARKER_FILES)
|
||||
diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
|
||||
index 69574e2..90a5ca2 100644
|
||||
--- a/grub-core/commands/extcmd.c
|
||||
+++ b/grub-core/commands/extcmd.c
|
||||
@@ -19,6 +19,7 @@
|
||||
|
||||
#include <grub/mm.h>
|
||||
#include <grub/list.h>
|
||||
+#include <grub/lockdown.h>
|
||||
#include <grub/misc.h>
|
||||
#include <grub/extcmd.h>
|
||||
#include <grub/script_sh.h>
|
||||
@@ -110,6 +111,28 @@ grub_register_extcmd (const char *name, grub_extcmd_func_t func,
|
||||
summary, description, parser, 1);
|
||||
}
|
||||
|
||||
+static grub_err_t
|
||||
+grub_extcmd_lockdown (grub_extcmd_context_t ctxt __attribute__ ((unused)),
|
||||
+ int argc __attribute__ ((unused)),
|
||||
+ char **argv __attribute__ ((unused)))
|
||||
+{
|
||||
+ return grub_error (GRUB_ERR_ACCESS_DENIED,
|
||||
+ N_("%s: the command is not allowed when lockdown is enforced"),
|
||||
+ ctxt->extcmd->cmd->name);
|
||||
+}
|
||||
+
|
||||
+grub_extcmd_t
|
||||
+grub_register_extcmd_lockdown (const char *name, grub_extcmd_func_t func,
|
||||
+ grub_command_flags_t flags, const char *summary,
|
||||
+ const char *description,
|
||||
+ const struct grub_arg_option *parser)
|
||||
+{
|
||||
+ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED)
|
||||
+ func = grub_extcmd_lockdown;
|
||||
+
|
||||
+ return grub_register_extcmd (name, func, flags, summary, description, parser);
|
||||
+}
|
||||
+
|
||||
void
|
||||
grub_unregister_extcmd (grub_extcmd_t ext)
|
||||
{
|
||||
diff --git a/grub-core/kern/command.c b/grub-core/kern/command.c
|
||||
index acd7218..4aabcd4 100644
|
||||
--- a/grub-core/kern/command.c
|
||||
+++ b/grub-core/kern/command.c
|
||||
@@ -17,6 +17,7 @@
|
||||
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
+#include <grub/lockdown.h>
|
||||
#include <grub/mm.h>
|
||||
#include <grub/command.h>
|
||||
|
||||
@@ -77,6 +78,29 @@ grub_register_command_prio (const char *name,
|
||||
return cmd;
|
||||
}
|
||||
|
||||
+static grub_err_t
|
||||
+grub_cmd_lockdown (grub_command_t cmd __attribute__ ((unused)),
|
||||
+ int argc __attribute__ ((unused)),
|
||||
+ char **argv __attribute__ ((unused)))
|
||||
+
|
||||
+{
|
||||
+ return grub_error (GRUB_ERR_ACCESS_DENIED,
|
||||
+ N_("%s: the command is not allowed when lockdown is enforced"),
|
||||
+ cmd->name);
|
||||
+}
|
||||
+
|
||||
+grub_command_t
|
||||
+grub_register_command_lockdown (const char *name,
|
||||
+ grub_command_func_t func,
|
||||
+ const char *summary,
|
||||
+ const char *description)
|
||||
+{
|
||||
+ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED)
|
||||
+ func = grub_cmd_lockdown;
|
||||
+
|
||||
+ return grub_register_command_prio (name, func, summary, description, 0);
|
||||
+}
|
||||
+
|
||||
void
|
||||
grub_unregister_command (grub_command_t cmd)
|
||||
{
|
||||
diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c
|
||||
new file mode 100644
|
||||
index 0000000..1e56c0b
|
||||
--- /dev/null
|
||||
+++ b/grub-core/kern/lockdown.c
|
||||
@@ -0,0 +1,80 @@
|
||||
+/*
|
||||
+ * GRUB -- GRand Unified Bootloader
|
||||
+ * Copyright (C) 2020 Free Software Foundation, Inc.
|
||||
+ *
|
||||
+ * GRUB is free software: you can redistribute it and/or modify
|
||||
+ * it under the terms of the GNU General Public License as published by
|
||||
+ * the Free Software Foundation, either version 3 of the License, or
|
||||
+ * (at your option) any later version.
|
||||
+ *
|
||||
+ * GRUB is distributed in the hope that it will be useful,
|
||||
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
+ * GNU General Public License for more details.
|
||||
+ *
|
||||
+ * You should have received a copy of the GNU General Public License
|
||||
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
+ *
|
||||
+ */
|
||||
+
|
||||
+#include <grub/dl.h>
|
||||
+#include <grub/file.h>
|
||||
+#include <grub/lockdown.h>
|
||||
+#include <grub/verify.h>
|
||||
+
|
||||
+static int lockdown = GRUB_LOCKDOWN_DISABLED;
|
||||
+
|
||||
+static grub_err_t
|
||||
+lockdown_verifier_init (grub_file_t io __attribute__ ((unused)),
|
||||
+ enum grub_file_type type,
|
||||
+ void **context __attribute__ ((unused)),
|
||||
+ enum grub_verify_flags *flags)
|
||||
+{
|
||||
+ *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
|
||||
+
|
||||
+ switch (type & GRUB_FILE_TYPE_MASK)
|
||||
+ {
|
||||
+ case GRUB_FILE_TYPE_GRUB_MODULE:
|
||||
+ case GRUB_FILE_TYPE_LINUX_KERNEL:
|
||||
+ case GRUB_FILE_TYPE_MULTIBOOT_KERNEL:
|
||||
+ case GRUB_FILE_TYPE_XEN_HYPERVISOR:
|
||||
+ case GRUB_FILE_TYPE_BSD_KERNEL:
|
||||
+ case GRUB_FILE_TYPE_XNU_KERNEL:
|
||||
+ case GRUB_FILE_TYPE_PLAN9_KERNEL:
|
||||
+ case GRUB_FILE_TYPE_NTLDR:
|
||||
+ case GRUB_FILE_TYPE_TRUECRYPT:
|
||||
+ case GRUB_FILE_TYPE_FREEDOS:
|
||||
+ case GRUB_FILE_TYPE_PXECHAINLOADER:
|
||||
+ case GRUB_FILE_TYPE_PCCHAINLOADER:
|
||||
+ case GRUB_FILE_TYPE_COREBOOT_CHAINLOADER:
|
||||
+ case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE:
|
||||
+ case GRUB_FILE_TYPE_ACPI_TABLE:
|
||||
+ case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE:
|
||||
+ *flags = GRUB_VERIFY_FLAGS_DEFER_AUTH;
|
||||
+
|
||||
+ /* Fall through. */
|
||||
+
|
||||
+ default:
|
||||
+ return GRUB_ERR_NONE;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+struct grub_file_verifier lockdown_verifier =
|
||||
+ {
|
||||
+ .name = "lockdown_verifier",
|
||||
+ .init = lockdown_verifier_init,
|
||||
+ };
|
||||
+
|
||||
+void
|
||||
+grub_lockdown (void)
|
||||
+{
|
||||
+ lockdown = GRUB_LOCKDOWN_ENABLED;
|
||||
+
|
||||
+ grub_verifier_register (&lockdown_verifier);
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+grub_is_lockdown (void)
|
||||
+{
|
||||
+ return lockdown;
|
||||
+}
|
||||
diff --git a/include/grub/command.h b/include/grub/command.h
|
||||
index eee4e84..2a6f7f8 100644
|
||||
--- a/include/grub/command.h
|
||||
+++ b/include/grub/command.h
|
||||
@@ -86,6 +86,11 @@ EXPORT_FUNC(grub_register_command_prio) (const char *name,
|
||||
const char *summary,
|
||||
const char *description,
|
||||
int prio);
|
||||
+grub_command_t
|
||||
+EXPORT_FUNC(grub_register_command_lockdown) (const char *name,
|
||||
+ grub_command_func_t func,
|
||||
+ const char *summary,
|
||||
+ const char *description);
|
||||
void EXPORT_FUNC(grub_unregister_command) (grub_command_t cmd);
|
||||
|
||||
static inline grub_command_t
|
||||
diff --git a/include/grub/extcmd.h b/include/grub/extcmd.h
|
||||
index 19fe592..fe9248b 100644
|
||||
--- a/include/grub/extcmd.h
|
||||
+++ b/include/grub/extcmd.h
|
||||
@@ -62,6 +62,13 @@ grub_extcmd_t EXPORT_FUNC(grub_register_extcmd) (const char *name,
|
||||
const char *description,
|
||||
const struct grub_arg_option *parser);
|
||||
|
||||
+grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_lockdown) (const char *name,
|
||||
+ grub_extcmd_func_t func,
|
||||
+ grub_command_flags_t flags,
|
||||
+ const char *summary,
|
||||
+ const char *description,
|
||||
+ const struct grub_arg_option *parser);
|
||||
+
|
||||
grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_prio) (const char *name,
|
||||
grub_extcmd_func_t func,
|
||||
grub_command_flags_t flags,
|
||||
diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
|
||||
new file mode 100644
|
||||
index 0000000..40531fa
|
||||
--- /dev/null
|
||||
+++ b/include/grub/lockdown.h
|
||||
@@ -0,0 +1,44 @@
|
||||
+/*
|
||||
+ * GRUB -- GRand Unified Bootloader
|
||||
+ * Copyright (C) 2020 Free Software Foundation, Inc.
|
||||
+ *
|
||||
+ * GRUB is free software: you can redistribute it and/or modify
|
||||
+ * it under the terms of the GNU General Public License as published by
|
||||
+ * the Free Software Foundation, either version 3 of the License, or
|
||||
+ * (at your option) any later version.
|
||||
+ *
|
||||
+ * GRUB is distributed in the hope that it will be useful,
|
||||
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
+ * GNU General Public License for more details.
|
||||
+ *
|
||||
+ * You should have received a copy of the GNU General Public License
|
||||
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
||||
+ */
|
||||
+
|
||||
+#ifndef GRUB_LOCKDOWN_H
|
||||
+#define GRUB_LOCKDOWN_H 1
|
||||
+
|
||||
+#include <grub/symbol.h>
|
||||
+
|
||||
+#define GRUB_LOCKDOWN_DISABLED 0
|
||||
+#define GRUB_LOCKDOWN_ENABLED 1
|
||||
+
|
||||
+#ifdef GRUB_MACHINE_EFI
|
||||
+extern void
|
||||
+EXPORT_FUNC (grub_lockdown) (void);
|
||||
+extern int
|
||||
+EXPORT_FUNC (grub_is_lockdown) (void);
|
||||
+#else
|
||||
+static inline void
|
||||
+grub_lockdown (void)
|
||||
+{
|
||||
+}
|
||||
+
|
||||
+static inline int
|
||||
+grub_is_lockdown (void)
|
||||
+{
|
||||
+ return GRUB_LOCKDOWN_DISABLED;
|
||||
+}
|
||||
+#endif
|
||||
+#endif /* ! GRUB_LOCKDOWN_H */
|
||||
diff --git a/po/POTFILES.in b/po/POTFILES.in
|
||||
index 49755d3..5e26845 100644
|
||||
--- a/po/POTFILES.in
|
||||
+++ b/po/POTFILES.in
|
||||
@@ -309,6 +309,7 @@
|
||||
./grub-core/kern/ieee1275/mmap.c
|
||||
./grub-core/kern/ieee1275/openfw.c
|
||||
./grub-core/kern/list.c
|
||||
+./grub-core/kern/lockdown.c
|
||||
./grub-core/kern/main.c
|
||||
./grub-core/kern/mips/arc/init.c
|
||||
./grub-core/kern/mips/dl.c
|
||||
@@ -1207,6 +1208,7 @@
|
||||
./include/grub/linux.h
|
||||
./include/grub/list.h
|
||||
./include/grub/loader.h
|
||||
+./include/grub/lockdown.h
|
||||
./include/grub/lvm.h
|
||||
./include/grub/macho.h
|
||||
./include/grub/machoload.h
|
||||
--
|
||||
2.14.2
|
||||
|
||||
Reference in New Issue
Block a user