From bc84821aa4de652c45614de7c5acd804d0ad5d54 Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Wed, 7 Apr 2021 13:27:01 +0800 Subject: [PATCH] grub: disable inside lockdown and shim_lock verifiers The lockdown support[1] and secure boot detection[2] have been added to grub 2.06. These verifiers are registered when UEFI Secure Boot is enabled. Unfortunately, they conflict with the current MOK2 Verify mechanism. So disable them. Fixes grub error: error: failed to verify kernel /bzImage [1] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=578c95298bcc46e0296f4c786db64c2ff26ce2cc [2] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=d7e54b2e5feee95d2f83058ed30d883c450d1473 Signed-off-by: Yi Zhao --- .../grub/grub-efi-efi-secure-boot.inc | 1 + ...disable-inside-lockdown-and-shim_loc.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 meta-efi-secure-boot/recipes-bsp/grub/grub-efi/0001-kern-efi-init.c-disable-inside-lockdown-and-shim_loc.patch diff --git a/meta-efi-secure-boot/recipes-bsp/grub/grub-efi-efi-secure-boot.inc b/meta-efi-secure-boot/recipes-bsp/grub/grub-efi-efi-secure-boot.inc index c3e7a9c..2477a2e 100644 --- a/meta-efi-secure-boot/recipes-bsp/grub/grub-efi-efi-secure-boot.inc +++ b/meta-efi-secure-boot/recipes-bsp/grub/grub-efi-efi-secure-boot.inc @@ -28,6 +28,7 @@ SRC_URI_append_class-target += "\ file://Grub-get-and-set-efi-variables.patch \ file://uefi_verify.patch \ file://0001-grub-verify-Add-strict_security-variable.patch \ + file://0001-kern-efi-init.c-disable-inside-lockdown-and-shim_loc.patch \ file://grub-efi.cfg \ file://boot-menu.inc \ ${@d.getVar('GRUB_MOKVERIFY_PATCH', True) if d.getVar('UEFI_SELOADER', True) == '1' else ''} \ diff --git a/meta-efi-secure-boot/recipes-bsp/grub/grub-efi/0001-kern-efi-init.c-disable-inside-lockdown-and-shim_loc.patch b/meta-efi-secure-boot/recipes-bsp/grub/grub-efi/0001-kern-efi-init.c-disable-inside-lockdown-and-shim_loc.patch new file mode 100644 index 0000000..83f5899 --- /dev/null +++ b/meta-efi-secure-boot/recipes-bsp/grub/grub-efi/0001-kern-efi-init.c-disable-inside-lockdown-and-shim_loc.patch @@ -0,0 +1,47 @@ +From ca81ba93b6536916673b6cb9cb6aef7652aee971 Mon Sep 17 00:00:00 2001 +From: Yi Zhao +Date: Wed, 7 Apr 2021 11:00:37 +0800 +Subject: [PATCH] kern/efi/init.c: disable inside lockdown and shim_lock + verifiers + +The lockdown support[1] and secure boot detection[2] have been added to +grub 2.06. These verifiers are registered when UEFI Secure Boot is +enabled. Unfortunately, they conflict with the current MOK2 Verify +mechanism. So disable them when enable SELoader. + +Fixes grub error: +error: failed to verify kernel /bzImage + +[1] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=578c95298bcc46e0296f4c786db64c2ff26ce2cc +[2] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=d7e54b2e5feee95d2f83058ed30d883c450d1473 + +Upstream-Status: Inappropriate [embedded specific] + +Signed-off-by: Yi Zhao +--- + grub-core/kern/efi/init.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c +index 7facacf..67b18e9 100644 +--- a/grub-core/kern/efi/init.c ++++ b/grub-core/kern/efi/init.c +@@ -95,6 +95,7 @@ grub_efi_init (void) + /* Initialize the memory management system. */ + grub_efi_mm_init (); + ++#if 0 + /* + * Lockdown the GRUB and register the shim_lock verifier + * if the UEFI Secure Boot is enabled. +@@ -104,6 +105,7 @@ grub_efi_init (void) + grub_lockdown (); + grub_shim_lock_verifier_setup (); + } ++#endif + + efi_call_4 (grub_efi_system_table->boot_services->set_watchdog_timer, + 0, 0, 0, NULL); +-- +2.17.1 +