summaryrefslogtreecommitdiffstats
path: root/src/shared/efi-loader.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* efi-loader: rename efi_stub_measured() → efi_measured_uki()Lennart Poettering2023-09-271-2/+2
| | | | | | | | | | Let's say "uki" rather than "stub", since that is just too generic, and we shouldn't limit us to our own stub anyway, but generally define a concept of a "measured UKI", which is a UKI that measures its part to PCR 11. This is mostly preparation for exposing this check to the user via ConditionSecurity=.
* shared/efi-loader: fix compilation with !ENABLE_EFI, improve messagesZbigniew Jędrzejewski-Szmek2023-01-251-1/+6
| | | | | | | | | | | | When compiled without ENABLE_EFI, efi_stub_measured() was not defined, so compilation would fail. But it's not enough to add a stub that returns -EOPNOTSUPP. We call this function in various places and usually print the error at warning or error level, so we'd print a confusing message. We also can't add a stub that always returns 0, because then we'd print a message like "Kernel stub did not measure", which would be confusing too. Adding special handling for -EOPNOTSUPP in every caller is also unattractive. So instead efi_stub_measured() is reworked to log the warning or error internally, and such logging is removed from the callers, and a stub is added that logs a custom message.
* tpm2: add common helper for checking if we are running on UKI with TPM ↵Lennart Poettering2023-01-171-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | measurements Let's introduce a common implementation of a function that checks whether we are booted on a kernel with systemd-stub that has TPM PCR measurements enabled. Do our own userspace measurements only if we detect that. PCRs are scarce and most likely there are projects which already make use of them in other ways. Hence, instead of blindly stepping into their territory let's conditionalize things so that people have to explicitly buy into our PCR assignments before we start measuring things into them. Specifically bind everything to an UKI that reported measurements. This was previously already implemented in systemd-pcrphase, but with this change we expand this to all tools that process PCR measurement settings. The env var to override the check is renamed to SYSTEMD_FORCE_MEASURE, to make it more generic (since we'll use it at multiple places now). This is not a compat break, since the original env var for that was not included in any stable release yet.
* bootctl: show stub feature set in status outputLennart Poettering2022-08-021-0/+5
|
* efi-loader: split efi-api.[ch] from efi-loader.[ch]Lennart Poettering2022-03-241-57/+4
| | | | | | | | | | | | | | Some refactoring: split efi-loader.[ch] in two: isolate the calls that implement out boot loader interface spec, and those which implement access to upstream UEFI firmware features. They are quite different in nature and behaviour, and even semantically it makes to keep these two separate. At the very least because the previous name "efi-loader.[ch]" suggests all was about loader-specific APIs, but much of it is generic uefi stuff... While we are at it, I renamed a bunch of return parameters to follow our usual ret_xyz naming. But besides renaming no real code changes.
* sd-boot: Be more precise about secure boot modesJan Janssen2021-10-221-1/+1
| | | | Fixes: #11559
* efi-loader: add efi_has_tpm2() helperLennart Poettering2021-02-111-0/+6
| | | | | | | | The helper checks if the UEFI firmware is hooked up to a TPM2 chip. This is useful to know in trusted boot scenarios, in particular during early boot in auto-enroll scenarios where we want to know whether TPM2 is available or not, and the Linux drivers are not loaded yet, and where it might or not be worth waiting for it.
* efi: create symbolic link to efi/loader-feature.hYu Watanabe2021-01-181-2/+3
| | | | To drop src/boot/efi from include directories for binaries later.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* logind: also cache LoaderEntryOneShot EFI variableLennart Poettering2020-06-261-0/+7
| | | | | | | | | With this we are now caching all EFI variables that we expose as property in logind. Thus a client invoking GetAllProperties() should only trgger a single read of each variable, but never repeated ones. Obsoletes: #16190 Fixes: #14828
* efi-loader: cache LoaderConfigTimeoutOneShot tooLennart Poettering2020-06-261-0/+6
| | | | | | | The data from this EFI variable is exposed as dbus property, and gdbus clients are happy to issue GetAllProperties() as if it was free. Hence make sure it's actually free and cache LoaderConfigTimeoutOneShot, since it's easy.
* Disable reading SystemdOptions EFI Var when in SecureBoot modeArian van Putten2020-01-161-15/+0
| | | | | | | | | In SecureBoot mode this is probably not what you want. As your cmdline is cryptographically signed like when using Type #2 EFI Unified Kernel Images (https://systemd.io/BOOT_LOADER_SPECIFICATION/) The user's intention is then that the cmdline should not be modified. You want to make sure that the system starts up as exactly specified in the signed artifact.
* util-lib: split shared/efivars into basic/efivars and shared/efi-loaderZbigniew Jędrzejewski-Szmek2019-09-161-0/+99
I want to use efivars.[ch] in proc-cmdline.c, but most of the efivars stuff is not needed in basic/. Move the file from shared/ to basic/, but then move back most of the higher-level functions to the new shared/efi-loader.c file.
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-30 08:47:51 +0100