Re: Bug#927888: Need to disable the devicetree command in Secure Boot mode
On Sat, May 04, 2019 at 10:44:26PM +0100, Colin Watson wrote:
>On Fri, May 03, 2019 at 10:42:34PM +0100, Steve McIntyre wrote:
>> diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c
>> index c9aee74ef..735c56e45 100644
>> --- a/grub-core/loader/efi/fdt.c
>> +++ b/grub-core/loader/efi/fdt.c
>> @@ -123,6 +123,14 @@ grub_cmd_devicetree (grub_command_t cmd __attribute__ ((unused)),
>> return GRUB_ERR_NONE;
>> }
>>
>> +#ifdef GRUB_MACHINE_EFI
>> + if (grub_efi_secure_boot ())
>> + {
>> + return grub_error (GRUB_ERR_ACCESS_DENIED,
>> + "Secure Boot forbids loading devicetree from %s", argv[0]);
>> + }
>> +#endif
>> +
>> dtb = grub_file_open (argv[0]);
>> if (!dtb)
>> goto out;
>
>Thanks. I've applied this and the rest of the patch as-is, but I'm
>pretty sure that the #ifdef in this file is rather unnecessary - unlike
>grub-core/loader/arm/linux.c, grub-core/loader/efi/fdt.c should only be
>compiled if GRUB_MACHINE_EFI is defined.
True. Ah well. :-)
--
Steve McIntyre, Cambridge, UK. steve@einval.com
Can't keep my eyes from the circling sky,
Tongue-tied & twisted, Just an earth-bound misfit, I...
Reply to: