Commit 448311e7 authored by Linn Crosetto's avatar Linn Crosetto Committed by Philipp Hahn
Browse files

Disallow unsigned kernels if UEFI Secure Boot is enabled 



If UEFI Secure Boot is enabled and kernel signature verification fails, do not
boot the kernel. Before this change, if kernel signature verification failed
then GRUB would fall back to calling ExitBootServices() and continuing the
boot.

Patch-Name: linuxefi_disable_sb_fallback.patch

Signed-off-by: default avatarLinn Crosetto <linn@hpe.com>
parent 56e169b9

grub-core/loader/i386/linux.c

+3 −5
Original line number Diff line number Diff line
@@ -695,10 +695,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), 
  using_linuxefi = 0;

  if (grub_efi_secure_boot ())

    {

      /* Try linuxefi first, which will require a successful signature check

	 and then hand over to the kernel without calling ExitBootServices.

	 If that fails, however, fall back to calling ExitBootServices

	 ourselves and then booting an unsigned kernel.  */

      /* linuxefi requires a successful signature check and then hand over

	 to the kernel without calling ExitBootServices. */

      grub_dl_t mod;

      grub_command_t linuxefi_cmd;
@@ -720,7 +718,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), 
		  return GRUB_ERR_NONE;

		}

	      grub_dprintf ("linux", "linuxefi failed (%d)\n", grub_errno);

	      grub_errno = GRUB_ERR_NONE;

	      goto fail;

	    }

	}

    }