Lines Matching +full:secure +full:- +full:firmware
2 # SPDX-License-Identifier: GPL-2.0
6 VERBOSE="${VERBOSE:-1}"
7 IKCONFIG="/tmp/config-`uname -r`"
8 KERNEL_IMAGE="/boot/vmlinuz-`uname -r`"
13 [ $VERBOSE -ne 0 ] && echo "[INFO] $1"
19 [ $VERBOSE -ne 0 ] && echo "$1 [PASS]"
26 [ $VERBOSE -ne 0 ] && echo "$1 [FAIL]"
33 [ $VERBOSE -ne 0 ] && echo "$1"
37 # Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
38 # (Based on kdump-lib.sh)
41 local efivarfs="/sys/firmware/efi/efivars"
48 if ! grep -q "^\S\+ $efivarfs efivarfs" /proc/mounts; then
52 secure_boot_file=$(find "$efivarfs" -name SecureBoot-* 2>/dev/null)
53 setup_mode_file=$(find "$efivarfs" -name SetupMode-* 2>/dev/null)
54 if [ -f "$secure_boot_file" ] && [ -f "$setup_mode_file" ]; then
55 secureboot_mode=$(hexdump -v -e '/1 "%d\ "' \
56 "$secure_boot_file"|cut -d' ' -f 5)
57 setup_mode=$(hexdump -v -e '/1 "%d\ "' \
58 "$setup_mode_file"|cut -d' ' -f 5)
60 if [ $secureboot_mode -eq 1 ] && [ $setup_mode -eq 0 ]; then
61 log_info "secure boot mode enabled (CONFIG_EFIVAR_FS)"
76 if [ ! -d "$efi_vars" ]; then
79 secure_boot_file=$(find "$efi_vars" -name SecureBoot-* 2>/dev/null)
80 setup_mode_file=$(find "$efi_vars" -name SetupMode-* 2>/dev/null)
81 if [ -f "$secure_boot_file/data" ] && \
82 [ -f "$setup_mode_file/data" ]; then
83 secureboot_mode=`od -An -t u1 "$secure_boot_file/data"`
84 setup_mode=`od -An -t u1 "$setup_mode_file/data"`
86 if [ $secureboot_mode -eq 1 ] && [ $setup_mode -eq 0 ]; then
87 log_info "secure boot mode enabled (CONFIG_EFI_VARS)"
94 # Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
95 # The secure boot mode can be accessed either as the last integer
96 # of "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*" or from
97 # "od -An -t u1 /sys/firmware/efi/vars/SecureBoot-*/data". The efi
108 if [ $secureboot_mode -eq 0 ]; then
113 if [ $secureboot_mode -eq 0 ]; then
114 log_info "secure boot mode not enabled"
121 if [ $(id -ru) -ne 0 ]; then
133 grep -E -q $config $IKCONFIG
134 if [ $? -eq 0 ]; then
143 # scripts/extract-ikconfig.
148 local module_dir="/lib/modules/`uname -r`"
151 if [ ! -f $proc_config ]; then
154 if [ -f $proc_config ]; then
156 if [ $? -eq 0 ]; then
161 local extract_ikconfig="$module_dir/source/scripts/extract-ikconfig"
162 if [ ! -f $extract_ikconfig ]; then
163 log_skip "extract-ikconfig not found"
167 if [ $? -eq 1 ]; then
168 if [ ! -f $configs_module ]; then
172 if [ $? -eq 1 ]; then
182 if [ -z $SECURITYFS ]; then
184 mount -t securityfs security $SECURITYFS
187 if [ ! -d "$SECURITYFS" ]; then
192 # The policy rule format is an "action" followed by key-value pairs. This
193 # function supports up to two key-value pairs, in any order.
206 if [ ! -e $ima_policy ]; then
210 if [ -n $keypair2 ]; then
211 grep -e "^$action.*$keypair1" "$ima_policy" | \
212 grep -q -e "$keypair2"
214 grep -q -e "^$action.*$keypair1" "$ima_policy"
217 # invert "grep -q" result, returning 1 for found.
218 [ $? -eq 0 ] && ret=1