From 578c95298bcc46e0296f4c786db64c2ff26ce2cc Mon Sep 17 00:00:00 2001
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
Date: Mon, 28 Sep 2020 20:08:02 +0200
|
Subject: [PATCH] kern: Add lockdown support
|
|
When the GRUB starts on a secure boot platform, some commands can be
|
used to subvert the protections provided by the verification mechanism and
|
could lead to booting untrusted system.
|
|
To prevent that situation, allow GRUB to be locked down. That way the code
|
may check if GRUB has been locked down and further restrict the commands
|
that are registered or what subset of their functionality could be used.
|
|
The lockdown support adds the following components:
|
|
* The grub_lockdown() function which can be used to lockdown GRUB if,
|
e.g., UEFI Secure Boot is enabled.
|
|
* The grub_is_lockdown() function which can be used to check if the GRUB
|
was locked down.
|
|
* A verifier that flags OS kernels, the GRUB modules, Device Trees and ACPI
|
tables as GRUB_VERIFY_FLAGS_DEFER_AUTH to defer verification to other
|
verifiers. These files are only successfully verified if another registered
|
verifier returns success. Otherwise, the whole verification process fails.
|
|
For example, PE/COFF binaries verification can be done by the shim_lock
|
verifier which validates the signatures using the shim_lock protocol.
|
However, the verification is not deferred directly to the shim_lock verifier.
|
The shim_lock verifier is hooked into the verification process instead.
|
|
* A set of grub_{command,extcmd}_lockdown functions that can be used by
|
code registering command handlers, to only register unsafe commands if
|
the GRUB has not been locked down.
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
[Add changes to generated files]
|
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
|
---
|
Makefile.in | 2 ++
|
conf/Makefile.common | 2 ++
|
docs/grub-dev.texi | 27 +++++++++++++++
|
docs/grub.texi | 8 +++++
|
grub-core/Makefile.am | 5 ++-
|
grub-core/Makefile.core.am | 14 ++++----
|
grub-core/Makefile.core.def | 1 +
|
grub-core/Makefile.in | 73 ++++++++++++++++++++++++++++++-----------
|
grub-core/commands/extcmd.c | 23 +++++++++++++
|
grub-core/kern/command.c | 24 ++++++++++++++
|
grub-core/kern/lockdown.c | 80 +++++++++++++++++++++++++++++++++++++++++++++
|
include/grub/command.h | 5 +++
|
include/grub/extcmd.h | 7 ++++
|
include/grub/lockdown.h | 44 +++++++++++++++++++++++++
|
po/POTFILES.in | 2 ++
|
15 files changed, 290 insertions(+), 27 deletions(-)
|
create mode 100644 grub-core/kern/lockdown.c
|
create mode 100644 include/grub/lockdown.h
|
|
diff --git a/Makefile.in b/Makefile.in
|
index e6a185b..ecb3278 100644
|
--- a/Makefile.in
|
+++ b/Makefile.in
|
@@ -2617,7 +2617,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
|
CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' \
|
'-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' \
|
+ '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
'-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' \
|
+ '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
'-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
|
diff --git a/conf/Makefile.common b/conf/Makefile.common
|
index 6cd71cb..2a1a886 100644
|
--- a/conf/Makefile.common
|
+++ b/conf/Makefile.common
|
@@ -84,7 +84,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
|
CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_TERMINAL_LIST += '-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)'
|
+CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)'
|
+CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
|
diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
|
index ee389fd..635ec72 100644
|
--- a/docs/grub-dev.texi
|
+++ b/docs/grub-dev.texi
|
@@ -86,6 +86,7 @@ This edition documents version @value{VERSION}.
|
* PFF2 Font File Format::
|
* Graphical Menu Software Design::
|
* Verifiers framework::
|
+* Lockdown framework::
|
* Copying This Manual:: Copying This Manual
|
* Index::
|
@end menu
|
@@ -2086,6 +2087,32 @@ Optionally at the end of the file @samp{fini}, if it exists, is called with just
|
the context. If you return no error during any of @samp{init}, @samp{write} and
|
@samp{fini} then the file is considered as having succeded verification.
|
|
+@node Lockdown framework
|
+@chapter Lockdown framework
|
+
|
+The GRUB can be locked down, which is a restricted mode where some operations
|
+are not allowed. For instance, some commands cannot be used when the GRUB is
|
+locked down.
|
+
|
+The function
|
+@code{grub_lockdown()} is used to lockdown GRUB and the function
|
+@code{grub_is_lockdown()} function can be used to check whether lockdown is
|
+enabled or not. When enabled, the function returns @samp{GRUB_LOCKDOWN_ENABLED}
|
+and @samp{GRUB_LOCKDOWN_DISABLED} when is not enabled.
|
+
|
+The following functions can be used to register the commands that can only be
|
+used when lockdown is disabled:
|
+
|
+@itemize
|
+
|
+@item @code{grub_cmd_lockdown()} registers command which should not run when the
|
+GRUB is in lockdown mode.
|
+
|
+@item @code{grub_cmd_lockdown()} registers extended command which should not run
|
+when the GRUB is in lockdown mode.
|
+
|
+@end itemize
|
+
|
@node Copying This Manual
|
@appendix Copying This Manual
|
|
diff --git a/docs/grub.texi b/docs/grub.texi
|
index aefe032..a25459f 100644
|
--- a/docs/grub.texi
|
+++ b/docs/grub.texi
|
@@ -5581,6 +5581,7 @@ environment variables and commands are listed in the same order.
|
* Using digital signatures:: Booting digitally signed code
|
* UEFI secure boot and shim:: Booting digitally signed PE files
|
* Measured Boot:: Measuring boot components
|
+* Lockdown:: Lockdown when booting on a secure setup
|
@end menu
|
|
@node Authentication and authorisation
|
@@ -5795,6 +5796,13 @@ into @file{core.img} in order to avoid a potential gap in measurement between
|
|
Measured boot is currently only supported on EFI platforms.
|
|
+@node Lockdown
|
+@section Lockdown when booting on a secure setup
|
+
|
+The GRUB can be locked down when booted on a secure boot environment, for example
|
+if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
|
+be restricted and some operations/commands cannot be executed.
|
+
|
@node Platform limitations
|
@chapter Platform limitations
|
|
diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
|
index cc6fc7d..30e23ad 100644
|
--- a/grub-core/Makefile.am
|
+++ b/grub-core/Makefile.am
|
@@ -80,6 +80,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fs.h
|
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/i18n.h
|
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/kernel.h
|
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/list.h
|
+KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lockdown.h
|
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/misc.h
|
if COND_emu
|
KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/compiler-rt-emu.h
|
@@ -377,8 +378,10 @@ command.lst: $(MARKER_FILES)
|
b=`basename $$pp .marker`; \
|
sed -n \
|
-e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
+ -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
-e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
- -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
+ -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \
|
+ -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
done) | sort -u > $@
|
platform_DATA += command.lst
|
CLEANFILES += command.lst
|
diff --git a/grub-core/Makefile.core.am b/grub-core/Makefile.core.am
|
index 5623a5e..fbfb627 100644
|
--- a/grub-core/Makefile.core.am
|
+++ b/grub-core/Makefile.core.am
|
@@ -22378,7 +22378,7 @@ endif
|
if COND_i386_efi
|
platform_PROGRAMS += kernel.exec
|
kernel_exec_SOURCES = kern/i386/efi/startup.S
|
-kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/i386/efi/init.c bus/pci.c kern/i386/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
+kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/i386/efi/init.c bus/pci.c kern/i386/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
kernel_exec_LDADD =
|
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
@@ -22488,7 +22488,7 @@ endif
|
if COND_x86_64_efi
|
platform_PROGRAMS += kernel.exec
|
kernel_exec_SOURCES = kern/x86_64/efi/startup.S
|
-kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/x86_64/efi/callwrap.S kern/i386/efi/init.c bus/pci.c kern/x86_64/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
+kernel_exec_SOURCES += kern/i386/efi/tsc.c kern/i386/tsc_pmtimer.c kern/x86_64/efi/callwrap.S kern/i386/efi/init.c bus/pci.c kern/x86_64/dl.c kern/i386/tsc.c kern/i386/tsc_pit.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
kernel_exec_LDADD =
|
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
@@ -22664,7 +22664,7 @@ endif
|
if COND_ia64_efi
|
platform_PROGRAMS += kernel.exec
|
kernel_exec_SOURCES =
|
-kernel_exec_SOURCES += kern/ia64/efi/startup.S kern/ia64/efi/init.c kern/ia64/dl.c kern/ia64/dl_helper.c kern/ia64/cache.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
+kernel_exec_SOURCES += kern/ia64/efi/startup.S kern/ia64/efi/init.c kern/ia64/dl.c kern/ia64/dl_helper.c kern/ia64/cache.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
kernel_exec_LDADD =
|
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL) -fno-builtin -fpic -minline-int-divide-max-throughput
|
@@ -22730,7 +22730,7 @@ endif
|
if COND_arm_efi
|
platform_PROGRAMS += kernel.exec
|
kernel_exec_SOURCES = kern/arm/efi/startup.S
|
-kernel_exec_SOURCES += kern/arm/efi/init.c kern/efi/fdt.c kern/arm/dl.c kern/arm/dl_helper.c kern/arm/cache_armv6.S kern/arm/cache_armv7.S kern/arm/cache.c kern/arm/compiler-rt.S lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
+kernel_exec_SOURCES += kern/arm/efi/init.c kern/efi/fdt.c kern/arm/dl.c kern/arm/dl_helper.c kern/arm/cache_armv6.S kern/arm/cache_armv7.S kern/arm/cache.c kern/arm/compiler-rt.S lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
kernel_exec_LDADD =
|
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
@@ -22752,7 +22752,7 @@ endif
|
if COND_arm64_efi
|
platform_PROGRAMS += kernel.exec
|
kernel_exec_SOURCES = kern/arm64/efi/startup.S
|
-kernel_exec_SOURCES += kern/arm64/efi/init.c kern/efi/fdt.c kern/arm64/cache.c kern/arm64/cache_flush.S kern/arm64/dl.c kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
+kernel_exec_SOURCES += kern/arm64/efi/init.c kern/efi/fdt.c kern/arm64/cache.c kern/arm64/cache_flush.S kern/arm64/dl.c kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
kernel_exec_LDADD =
|
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
@@ -22796,7 +22796,7 @@ endif
|
if COND_riscv32_efi
|
platform_PROGRAMS += kernel.exec
|
kernel_exec_SOURCES = kern/riscv/efi/startup.S
|
-kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
+kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c lib/division.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
kernel_exec_LDADD =
|
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
@@ -22818,7 +22818,7 @@ endif
|
if COND_riscv64_efi
|
platform_PROGRAMS += kernel.exec
|
kernel_exec_SOURCES = kern/riscv/efi/startup.S
|
-kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
+kernel_exec_SOURCES += kern/riscv/efi/init.c kern/efi/fdt.c kern/riscv/cache.c kern/riscv/cache_flush.S kern/riscv/dl.c disk/efi/efidisk.c kern/efi/efi.c kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c kern/compiler-rt.c kern/mm.c kern/time.c kern/generic/millisleep.c kern/command.c kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c kern/parser.c kern/partition.c kern/rescue_parser.c kern/rescue_reader.c kern/term.c kern/verifiers.c
|
nodist_kernel_exec_SOURCES = symlist.c ## platform nodist sources
|
kernel_exec_LDADD =
|
kernel_exec_CFLAGS = $(AM_CFLAGS) $(CFLAGS_KERNEL)
|
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
|
index 4d380ed..ee8dc55 100644
|
--- a/grub-core/Makefile.core.def
|
+++ b/grub-core/Makefile.core.def
|
@@ -205,6 +205,7 @@ kernel = {
|
efi = kern/acpi.c;
|
efi = kern/efi/acpi.c;
|
efi = kern/efi/sb.c;
|
+ efi = kern/lockdown.c;
|
i386_coreboot = kern/i386/pc/acpi.c;
|
i386_multiboot = kern/i386/pc/acpi.c;
|
i386_coreboot = kern/acpi.c;
|
diff --git a/grub-core/Makefile.in b/grub-core/Makefile.in
|
index 09dc802..ac400ea 100644
|
--- a/grub-core/Makefile.in
|
+++ b/grub-core/Makefile.in
|
@@ -10457,13 +10457,14 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
kern/arm64/cache_flush.S kern/arm64/dl.c \
|
kern/arm64/dl_helper.c disk/efi/efidisk.c kern/efi/efi.c \
|
kern/efi/init.c kern/efi/mm.c term/efi/console.c kern/acpi.c \
|
- kern/efi/acpi.c kern/efi/sb.c kern/compiler-rt.c kern/mm.c \
|
- kern/time.c kern/generic/millisleep.c kern/command.c \
|
- kern/corecmd.c kern/device.c kern/disk.c kern/dl.c kern/env.c \
|
- kern/err.c kern/file.c kern/fs.c kern/list.c kern/main.c \
|
- kern/misc.c kern/parser.c kern/partition.c \
|
- kern/rescue_parser.c kern/rescue_reader.c kern/term.c \
|
- kern/verifiers.c kern/arm/startup.S kern/arm/coreboot/init.c \
|
+ kern/efi/acpi.c kern/efi/sb.c kern/lockdown.c \
|
+ kern/compiler-rt.c kern/mm.c kern/time.c \
|
+ kern/generic/millisleep.c kern/command.c kern/corecmd.c \
|
+ kern/device.c kern/disk.c kern/dl.c kern/env.c kern/err.c \
|
+ kern/file.c kern/fs.c kern/list.c kern/main.c kern/misc.c \
|
+ kern/parser.c kern/partition.c kern/rescue_parser.c \
|
+ kern/rescue_reader.c kern/term.c kern/verifiers.c \
|
+ kern/arm/startup.S kern/arm/coreboot/init.c \
|
kern/arm/coreboot/timer.c kern/arm/coreboot/coreboot.S \
|
lib/fdt.c bus/fdt.c term/ps2.c term/arm/pl050.c \
|
term/arm/cros.c term/arm/cros_ec.c bus/spi/rk3288_spi.c \
|
@@ -10572,6 +10573,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_FALSE@@COND_sparc64_ieee1275_FALSE@@COND_x86_64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
@@ -10646,6 +10648,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_FALSE@@COND_riscv64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
@@ -10683,6 +10686,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_FALSE@@COND_mips_arc_FALSE@@COND_mips_loongson_FALSE@@COND_mips_qemu_mips_FALSE@@COND_powerpc_ieee1275_FALSE@@COND_riscv32_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
@@ -10884,6 +10888,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_FALSE@@COND_i386_ieee1275_FALSE@@COND_i386_multiboot_FALSE@@COND_i386_pc_FALSE@@COND_i386_qemu_FALSE@@COND_i386_xen_FALSE@@COND_i386_xen_pvh_FALSE@@COND_ia64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
@@ -11120,6 +11125,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_FALSE@@COND_arm_uboot_FALSE@@COND_emu_FALSE@@COND_i386_coreboot_FALSE@@COND_i386_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
@@ -11287,6 +11293,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
+@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
@COND_arm64_efi_FALSE@@COND_arm_coreboot_FALSE@@COND_arm_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
@@ -11379,6 +11386,7 @@ am__kernel_exec_SOURCES_DIST = kern/arm64/efi/startup.S \
|
@COND_arm64_efi_TRUE@ kern/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_TRUE@ kern/efi/kernel_exec-acpi.$(OBJEXT) \
|
@COND_arm64_efi_TRUE@ kern/efi/kernel_exec-sb.$(OBJEXT) \
|
+@COND_arm64_efi_TRUE@ kern/kernel_exec-lockdown.$(OBJEXT) \
|
@COND_arm64_efi_TRUE@ kern/kernel_exec-compiler-rt.$(OBJEXT) \
|
@COND_arm64_efi_TRUE@ kern/kernel_exec-mm.$(OBJEXT) \
|
@COND_arm64_efi_TRUE@ kern/kernel_exec-time.$(OBJEXT) \
|
@@ -15379,7 +15387,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER
|
CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' \
|
'-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' \
|
+ '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
'-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' \
|
+ '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' \
|
'-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)'
|
CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \
|
@@ -16387,6 +16397,7 @@ KERNEL_HEADER_FILES = $(top_srcdir)/include/grub/cache.h \
|
$(top_srcdir)/include/grub/i18n.h \
|
$(top_srcdir)/include/grub/kernel.h \
|
$(top_srcdir)/include/grub/list.h \
|
+ $(top_srcdir)/include/grub/lockdown.h \
|
$(top_srcdir)/include/grub/misc.h $(am__append_5794) \
|
$(am__append_5795) $(top_srcdir)/include/grub/mm.h \
|
$(top_srcdir)/include/grub/parser.h \
|
@@ -25594,7 +25605,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
@COND_arm64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
@COND_arm64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
@COND_arm64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
|
-@COND_arm64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
+@COND_arm64_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
+@COND_arm64_efi_TRUE@ kern/mm.c kern/time.c \
|
@COND_arm64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
@COND_arm64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
@COND_arm64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
@@ -25645,7 +25657,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
@COND_arm_efi_TRUE@ kern/efi/init.c kern/efi/mm.c \
|
@COND_arm_efi_TRUE@ term/efi/console.c kern/acpi.c \
|
@COND_arm_efi_TRUE@ kern/efi/acpi.c kern/efi/sb.c \
|
-@COND_arm_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
+@COND_arm_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
+@COND_arm_efi_TRUE@ kern/mm.c kern/time.c \
|
@COND_arm_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
@COND_arm_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
@COND_arm_efi_TRUE@ kern/dl.c kern/env.c kern/err.c kern/file.c \
|
@@ -25725,7 +25738,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
@COND_i386_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
@COND_i386_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
@COND_i386_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
|
-@COND_i386_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
+@COND_i386_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
+@COND_i386_efi_TRUE@ kern/mm.c kern/time.c \
|
@COND_i386_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
@COND_i386_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
@COND_i386_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
@@ -25843,7 +25857,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
@COND_ia64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
@COND_ia64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
@COND_ia64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c kern/efi/sb.c \
|
-@COND_ia64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
+@COND_ia64_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
+@COND_ia64_efi_TRUE@ kern/mm.c kern/time.c \
|
@COND_ia64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
@COND_ia64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
@COND_ia64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
@@ -25956,8 +25971,9 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
@COND_riscv32_efi_TRUE@ kern/efi/init.c kern/efi/mm.c \
|
@COND_riscv32_efi_TRUE@ term/efi/console.c kern/acpi.c \
|
@COND_riscv32_efi_TRUE@ kern/efi/acpi.c kern/efi/sb.c \
|
-@COND_riscv32_efi_TRUE@ kern/compiler-rt.c kern/mm.c \
|
-@COND_riscv32_efi_TRUE@ kern/time.c kern/generic/millisleep.c \
|
+@COND_riscv32_efi_TRUE@ kern/lockdown.c kern/compiler-rt.c \
|
+@COND_riscv32_efi_TRUE@ kern/mm.c kern/time.c \
|
+@COND_riscv32_efi_TRUE@ kern/generic/millisleep.c \
|
@COND_riscv32_efi_TRUE@ kern/command.c kern/corecmd.c \
|
@COND_riscv32_efi_TRUE@ kern/device.c kern/disk.c kern/dl.c \
|
@COND_riscv32_efi_TRUE@ kern/env.c kern/err.c kern/file.c \
|
@@ -25974,9 +25990,9 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
@COND_riscv64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
@COND_riscv64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
@COND_riscv64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c \
|
-@COND_riscv64_efi_TRUE@ kern/efi/sb.c kern/compiler-rt.c \
|
-@COND_riscv64_efi_TRUE@ kern/mm.c kern/time.c \
|
-@COND_riscv64_efi_TRUE@ kern/generic/millisleep.c \
|
+@COND_riscv64_efi_TRUE@ kern/efi/sb.c kern/lockdown.c \
|
+@COND_riscv64_efi_TRUE@ kern/compiler-rt.c kern/mm.c \
|
+@COND_riscv64_efi_TRUE@ kern/time.c kern/generic/millisleep.c \
|
@COND_riscv64_efi_TRUE@ kern/command.c kern/corecmd.c \
|
@COND_riscv64_efi_TRUE@ kern/device.c kern/disk.c kern/dl.c \
|
@COND_riscv64_efi_TRUE@ kern/env.c kern/err.c kern/file.c \
|
@@ -26022,8 +26038,8 @@ gcry_whirlpool_module_DEPENDENCIES = $(TARGET_OBJ2ELF)
|
@COND_x86_64_efi_TRUE@ kern/efi/efi.c kern/efi/init.c \
|
@COND_x86_64_efi_TRUE@ kern/efi/mm.c term/efi/console.c \
|
@COND_x86_64_efi_TRUE@ kern/acpi.c kern/efi/acpi.c \
|
-@COND_x86_64_efi_TRUE@ kern/efi/sb.c kern/compiler-rt.c \
|
-@COND_x86_64_efi_TRUE@ kern/mm.c kern/time.c \
|
+@COND_x86_64_efi_TRUE@ kern/efi/sb.c kern/lockdown.c \
|
+@COND_x86_64_efi_TRUE@ kern/compiler-rt.c kern/mm.c kern/time.c \
|
@COND_x86_64_efi_TRUE@ kern/generic/millisleep.c kern/command.c \
|
@COND_x86_64_efi_TRUE@ kern/corecmd.c kern/device.c kern/disk.c \
|
@COND_x86_64_efi_TRUE@ kern/dl.c kern/env.c kern/err.c \
|
@@ -27994,6 +28010,8 @@ kern/efi/kernel_exec-acpi.$(OBJEXT): kern/efi/$(am__dirstamp) \
|
kern/efi/$(DEPDIR)/$(am__dirstamp)
|
kern/efi/kernel_exec-sb.$(OBJEXT): kern/efi/$(am__dirstamp) \
|
kern/efi/$(DEPDIR)/$(am__dirstamp)
|
+kern/kernel_exec-lockdown.$(OBJEXT): kern/$(am__dirstamp) \
|
+ kern/$(DEPDIR)/$(am__dirstamp)
|
kern/kernel_exec-compiler-rt.$(OBJEXT): kern/$(am__dirstamp) \
|
kern/$(DEPDIR)/$(am__dirstamp)
|
kern/kernel_exec-mm.$(OBJEXT): kern/$(am__dirstamp) \
|
@@ -30945,6 +30963,7 @@ distclean-compile:
|
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-file.Po@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-fs.Po@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-list.Po@am__quote@
|
+@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-lockdown.Po@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-main.Po@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-misc.Po@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@kern/$(DEPDIR)/kernel_exec-mm.Po@am__quote@
|
@@ -35293,6 +35312,20 @@ kern/efi/kernel_exec-sb.obj: kern/efi/sb.c
|
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/efi/kernel_exec-sb.obj `if test -f 'kern/efi/sb.c'; then $(CYGPATH_W) 'kern/efi/sb.c'; else $(CYGPATH_W) '$(srcdir)/kern/efi/sb.c'; fi`
|
|
+kern/kernel_exec-lockdown.o: kern/lockdown.c
|
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-lockdown.o -MD -MP -MF kern/$(DEPDIR)/kernel_exec-lockdown.Tpo -c -o kern/kernel_exec-lockdown.o `test -f 'kern/lockdown.c' || echo '$(srcdir)/'`kern/lockdown.c
|
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-lockdown.Tpo kern/$(DEPDIR)/kernel_exec-lockdown.Po
|
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='kern/lockdown.c' object='kern/kernel_exec-lockdown.o' libtool=no @AMDEPBACKSLASH@
|
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/kernel_exec-lockdown.o `test -f 'kern/lockdown.c' || echo '$(srcdir)/'`kern/lockdown.c
|
+
|
+kern/kernel_exec-lockdown.obj: kern/lockdown.c
|
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-lockdown.obj -MD -MP -MF kern/$(DEPDIR)/kernel_exec-lockdown.Tpo -c -o kern/kernel_exec-lockdown.obj `if test -f 'kern/lockdown.c'; then $(CYGPATH_W) 'kern/lockdown.c'; else $(CYGPATH_W) '$(srcdir)/kern/lockdown.c'; fi`
|
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-lockdown.Tpo kern/$(DEPDIR)/kernel_exec-lockdown.Po
|
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='kern/lockdown.c' object='kern/kernel_exec-lockdown.obj' libtool=no @AMDEPBACKSLASH@
|
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -c -o kern/kernel_exec-lockdown.obj `if test -f 'kern/lockdown.c'; then $(CYGPATH_W) 'kern/lockdown.c'; else $(CYGPATH_W) '$(srcdir)/kern/lockdown.c'; fi`
|
+
|
kern/kernel_exec-compiler-rt.o: kern/compiler-rt.c
|
@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(kernel_exec_CPPFLAGS) $(CPPFLAGS) $(kernel_exec_CFLAGS) $(CFLAGS) -MT kern/kernel_exec-compiler-rt.o -MD -MP -MF kern/$(DEPDIR)/kernel_exec-compiler-rt.Tpo -c -o kern/kernel_exec-compiler-rt.o `test -f 'kern/compiler-rt.c' || echo '$(srcdir)/'`kern/compiler-rt.c
|
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) kern/$(DEPDIR)/kernel_exec-compiler-rt.Tpo kern/$(DEPDIR)/kernel_exec-compiler-rt.Po
|
@@ -46650,8 +46683,10 @@ command.lst: $(MARKER_FILES)
|
b=`basename $$pp .marker`; \
|
sed -n \
|
-e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
+ -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
-e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \
|
- -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
+ -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \
|
+ -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \
|
done) | sort -u > $@
|
|
partmap.lst: $(MARKER_FILES)
|
diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
|
index 69574e2..90a5ca2 100644
|
--- a/grub-core/commands/extcmd.c
|
+++ b/grub-core/commands/extcmd.c
|
@@ -19,6 +19,7 @@
|
|
#include <grub/mm.h>
|
#include <grub/list.h>
|
+#include <grub/lockdown.h>
|
#include <grub/misc.h>
|
#include <grub/extcmd.h>
|
#include <grub/script_sh.h>
|
@@ -110,6 +111,28 @@ grub_register_extcmd (const char *name, grub_extcmd_func_t func,
|
summary, description, parser, 1);
|
}
|
|
+static grub_err_t
|
+grub_extcmd_lockdown (grub_extcmd_context_t ctxt __attribute__ ((unused)),
|
+ int argc __attribute__ ((unused)),
|
+ char **argv __attribute__ ((unused)))
|
+{
|
+ return grub_error (GRUB_ERR_ACCESS_DENIED,
|
+ N_("%s: the command is not allowed when lockdown is enforced"),
|
+ ctxt->extcmd->cmd->name);
|
+}
|
+
|
+grub_extcmd_t
|
+grub_register_extcmd_lockdown (const char *name, grub_extcmd_func_t func,
|
+ grub_command_flags_t flags, const char *summary,
|
+ const char *description,
|
+ const struct grub_arg_option *parser)
|
+{
|
+ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED)
|
+ func = grub_extcmd_lockdown;
|
+
|
+ return grub_register_extcmd (name, func, flags, summary, description, parser);
|
+}
|
+
|
void
|
grub_unregister_extcmd (grub_extcmd_t ext)
|
{
|
diff --git a/grub-core/kern/command.c b/grub-core/kern/command.c
|
index acd7218..4aabcd4 100644
|
--- a/grub-core/kern/command.c
|
+++ b/grub-core/kern/command.c
|
@@ -17,6 +17,7 @@
|
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
*/
|
|
+#include <grub/lockdown.h>
|
#include <grub/mm.h>
|
#include <grub/command.h>
|
|
@@ -77,6 +78,29 @@ grub_register_command_prio (const char *name,
|
return cmd;
|
}
|
|
+static grub_err_t
|
+grub_cmd_lockdown (grub_command_t cmd __attribute__ ((unused)),
|
+ int argc __attribute__ ((unused)),
|
+ char **argv __attribute__ ((unused)))
|
+
|
+{
|
+ return grub_error (GRUB_ERR_ACCESS_DENIED,
|
+ N_("%s: the command is not allowed when lockdown is enforced"),
|
+ cmd->name);
|
+}
|
+
|
+grub_command_t
|
+grub_register_command_lockdown (const char *name,
|
+ grub_command_func_t func,
|
+ const char *summary,
|
+ const char *description)
|
+{
|
+ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED)
|
+ func = grub_cmd_lockdown;
|
+
|
+ return grub_register_command_prio (name, func, summary, description, 0);
|
+}
|
+
|
void
|
grub_unregister_command (grub_command_t cmd)
|
{
|
diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c
|
new file mode 100644
|
index 0000000..1e56c0b
|
--- /dev/null
|
+++ b/grub-core/kern/lockdown.c
|
@@ -0,0 +1,80 @@
|
+/*
|
+ * GRUB -- GRand Unified Bootloader
|
+ * Copyright (C) 2020 Free Software Foundation, Inc.
|
+ *
|
+ * GRUB is free software: you can redistribute it and/or modify
|
+ * it under the terms of the GNU General Public License as published by
|
+ * the Free Software Foundation, either version 3 of the License, or
|
+ * (at your option) any later version.
|
+ *
|
+ * GRUB is distributed in the hope that it will be useful,
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
+ * GNU General Public License for more details.
|
+ *
|
+ * You should have received a copy of the GNU General Public License
|
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
+ *
|
+ */
|
+
|
+#include <grub/dl.h>
|
+#include <grub/file.h>
|
+#include <grub/lockdown.h>
|
+#include <grub/verify.h>
|
+
|
+static int lockdown = GRUB_LOCKDOWN_DISABLED;
|
+
|
+static grub_err_t
|
+lockdown_verifier_init (grub_file_t io __attribute__ ((unused)),
|
+ enum grub_file_type type,
|
+ void **context __attribute__ ((unused)),
|
+ enum grub_verify_flags *flags)
|
+{
|
+ *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
|
+
|
+ switch (type & GRUB_FILE_TYPE_MASK)
|
+ {
|
+ case GRUB_FILE_TYPE_GRUB_MODULE:
|
+ case GRUB_FILE_TYPE_LINUX_KERNEL:
|
+ case GRUB_FILE_TYPE_MULTIBOOT_KERNEL:
|
+ case GRUB_FILE_TYPE_XEN_HYPERVISOR:
|
+ case GRUB_FILE_TYPE_BSD_KERNEL:
|
+ case GRUB_FILE_TYPE_XNU_KERNEL:
|
+ case GRUB_FILE_TYPE_PLAN9_KERNEL:
|
+ case GRUB_FILE_TYPE_NTLDR:
|
+ case GRUB_FILE_TYPE_TRUECRYPT:
|
+ case GRUB_FILE_TYPE_FREEDOS:
|
+ case GRUB_FILE_TYPE_PXECHAINLOADER:
|
+ case GRUB_FILE_TYPE_PCCHAINLOADER:
|
+ case GRUB_FILE_TYPE_COREBOOT_CHAINLOADER:
|
+ case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE:
|
+ case GRUB_FILE_TYPE_ACPI_TABLE:
|
+ case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE:
|
+ *flags = GRUB_VERIFY_FLAGS_DEFER_AUTH;
|
+
|
+ /* Fall through. */
|
+
|
+ default:
|
+ return GRUB_ERR_NONE;
|
+ }
|
+}
|
+
|
+struct grub_file_verifier lockdown_verifier =
|
+ {
|
+ .name = "lockdown_verifier",
|
+ .init = lockdown_verifier_init,
|
+ };
|
+
|
+void
|
+grub_lockdown (void)
|
+{
|
+ lockdown = GRUB_LOCKDOWN_ENABLED;
|
+
|
+ grub_verifier_register (&lockdown_verifier);
|
+}
|
+
|
+int
|
+grub_is_lockdown (void)
|
+{
|
+ return lockdown;
|
+}
|
diff --git a/include/grub/command.h b/include/grub/command.h
|
index eee4e84..2a6f7f8 100644
|
--- a/include/grub/command.h
|
+++ b/include/grub/command.h
|
@@ -86,6 +86,11 @@ EXPORT_FUNC(grub_register_command_prio) (const char *name,
|
const char *summary,
|
const char *description,
|
int prio);
|
+grub_command_t
|
+EXPORT_FUNC(grub_register_command_lockdown) (const char *name,
|
+ grub_command_func_t func,
|
+ const char *summary,
|
+ const char *description);
|
void EXPORT_FUNC(grub_unregister_command) (grub_command_t cmd);
|
|
static inline grub_command_t
|
diff --git a/include/grub/extcmd.h b/include/grub/extcmd.h
|
index 19fe592..fe9248b 100644
|
--- a/include/grub/extcmd.h
|
+++ b/include/grub/extcmd.h
|
@@ -62,6 +62,13 @@ grub_extcmd_t EXPORT_FUNC(grub_register_extcmd) (const char *name,
|
const char *description,
|
const struct grub_arg_option *parser);
|
|
+grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_lockdown) (const char *name,
|
+ grub_extcmd_func_t func,
|
+ grub_command_flags_t flags,
|
+ const char *summary,
|
+ const char *description,
|
+ const struct grub_arg_option *parser);
|
+
|
grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_prio) (const char *name,
|
grub_extcmd_func_t func,
|
grub_command_flags_t flags,
|
diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h
|
new file mode 100644
|
index 0000000..40531fa
|
--- /dev/null
|
+++ b/include/grub/lockdown.h
|
@@ -0,0 +1,44 @@
|
+/*
|
+ * GRUB -- GRand Unified Bootloader
|
+ * Copyright (C) 2020 Free Software Foundation, Inc.
|
+ *
|
+ * GRUB is free software: you can redistribute it and/or modify
|
+ * it under the terms of the GNU General Public License as published by
|
+ * the Free Software Foundation, either version 3 of the License, or
|
+ * (at your option) any later version.
|
+ *
|
+ * GRUB is distributed in the hope that it will be useful,
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
+ * GNU General Public License for more details.
|
+ *
|
+ * You should have received a copy of the GNU General Public License
|
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
+ */
|
+
|
+#ifndef GRUB_LOCKDOWN_H
|
+#define GRUB_LOCKDOWN_H 1
|
+
|
+#include <grub/symbol.h>
|
+
|
+#define GRUB_LOCKDOWN_DISABLED 0
|
+#define GRUB_LOCKDOWN_ENABLED 1
|
+
|
+#ifdef GRUB_MACHINE_EFI
|
+extern void
|
+EXPORT_FUNC (grub_lockdown) (void);
|
+extern int
|
+EXPORT_FUNC (grub_is_lockdown) (void);
|
+#else
|
+static inline void
|
+grub_lockdown (void)
|
+{
|
+}
|
+
|
+static inline int
|
+grub_is_lockdown (void)
|
+{
|
+ return GRUB_LOCKDOWN_DISABLED;
|
+}
|
+#endif
|
+#endif /* ! GRUB_LOCKDOWN_H */
|
diff --git a/po/POTFILES.in b/po/POTFILES.in
|
index 49755d3..5e26845 100644
|
--- a/po/POTFILES.in
|
+++ b/po/POTFILES.in
|
@@ -309,6 +309,7 @@
|
./grub-core/kern/ieee1275/mmap.c
|
./grub-core/kern/ieee1275/openfw.c
|
./grub-core/kern/list.c
|
+./grub-core/kern/lockdown.c
|
./grub-core/kern/main.c
|
./grub-core/kern/mips/arc/init.c
|
./grub-core/kern/mips/dl.c
|
@@ -1207,6 +1208,7 @@
|
./include/grub/linux.h
|
./include/grub/list.h
|
./include/grub/loader.h
|
+./include/grub/lockdown.h
|
./include/grub/lvm.h
|
./include/grub/macho.h
|
./include/grub/machoload.h
|
--
|
2.14.2
|
