summaryrefslogtreecommitdiffstats
path: root/meta-efi-secure-boot/recipes-bsp/grub
Commit message (Collapse)AuthorAgeFilesLines
* grub-efi: split grub serure builtin option from GRUB_BUILDINHEADmasterHongxu Jia2022-03-151-2/+3
| | | | | | | | | Use variable GRUB_SECURE_BUILDIN to split grub secure builtin option from GRUB_BUILDIN, then GRUB_BUILDIN will not contain secure option for others grub-mkimage to create no secure grub even though secure boot is enabled Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* grub-efi: Remove $cmdpath from configuration for for grub-mkimagePeter Hatina2021-10-291-1/+1
| | | | Signed-off-by: Peter Hatina <peter@hatina.eu>
* meta-secure-core: Convert to new override syntaxYi Zhao2021-08-091-14/+14
| | | | | | Converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* prevent contamining the cache with embeded cfgjbouchard2021-05-011-0/+2
|
* grub: disable inside lockdown and shim_lock verifiersYi Zhao2021-04-212-0/+48
| | | | | | | | | | | | | | | The lockdown support[1] and secure boot detection[2] have been added to grub 2.06. These verifiers are registered when UEFI Secure Boot is enabled. Unfortunately, they conflict with the current MOK2 Verify mechanism. So disable them. Fixes grub error: error: failed to verify kernel /bzImage [1] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=578c95298bcc46e0296f4c786db64c2ff26ce2cc [2] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=d7e54b2e5feee95d2f83058ed30d883c450d1473 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: enable secure-boot support only for target buildsOvidiu Panait2021-04-041-4/+5
| | | | | | | | | grub-efi-native does not benefit from the extra code/modules that get built for secure-boot support, it just increases the build time of the package. Therefore, mark all secure-boot related procedures in the recipe for class-target only. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* grub: Drop useless insmod verify from cfgAlexandru Avadanii2021-03-291-6/+2
| | | | | | | | | | - the 'verify' grub module has been renamed to 'pgp' in grub 2.04; - the 'pgp' grub module is already built-in if GRUB_SIGN_VERIFY is set, so there's no need to call insmod; While at it, remove some unnecessary code duplication. Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
* grub-efi: refresh patches for grub 2.06Yi Zhao2021-03-245-84/+52
| | | | | | | | | | | | Rebase patch: 0001-grub-verify-Add-strict_security-variable.patch Grub-get-and-set-efi-variables.patch mok2verify-support-to-verify-non-PE-file-with-PKCS-7.patch Drop 0001-fs-ext2-fix-the-file-not-found-error-when-symlink-fi.patch since it has been merged upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: update the bbapepnd file nameChen Qi2021-03-241-0/+0
| | | | | | | oe-core now uses the git version for grub-efi, so we'd better to use the '%' wildcard for the bbappend file name. Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
* Grub: Verify buffiles, e.g. fonts and imagesJussi Keranen2021-02-022-1/+33
|
* Grub: Parameterize prefix dirJussi Keranen2021-01-221-5/+6
|
* grub: fix the file not found error when sysmlink filesize is 60Yi Zhao2021-01-192-0/+41
| | | | | | | | | | | | | | | | We encountered a file not found error when the symlink filesize is 60: $ ls -l initrd lrwxrwxrwx 1 root root 60 Jan 6 16:37 initrd -> secure-core-image-initramfs-5.10.2-yoctodev-standard.cpio.gz When booting, we got the following error in grub: error: file `/initrd' not found The root cause is although the size of diro->inode.symlink is 60, it includes the trailing '\0'. So if the symlink filesize is exactly 60, it is also stored in a separate block rather than in the inode. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: refresh patchYi Zhao2020-11-101-32/+57
| | | | | | | Refresh mok2verify-support-to-verify-non-PE-file-with-PKCS-7.patch to adapt the recent CVEs fixing. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi-efi-secure-boot.inc: Adapt to potential psuedo changesHongxu Jia2020-10-141-1/+1
| | | | | | | | | | | | | | | | If we do adopt path filtering for pseudo, we may filter out ${DEPLOY_DIR} as not needing to be tracked for "root" permissions. but we do track the data in ${D} though, when we copy file from ${D} to ${DEPLOY_DIR}, pseudo report a failure ... |cp: failed to preserve ownership for 'tmp-glibc/work/corei7-64-wrs-linux/ grub-efi/2.04-r0/deploy-grub-efi/efi-unsigned/x86_64-efi/fdt.lst' : Operation not permitted ... Disable pseudo for the copy operation Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* modified grub-efi-efi-secure-boot.inc to install also the grub configuration ↵richard2020-03-011-0/+13
| | | | files in the DEPLOYDIR
* grub-efi-efi-secure-boot.inc: append do_deploy instead overriding itSandra Tobajas2020-01-161-2/+2
| | | | | | Append do_deploy function instead of overriding it. Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* grub-efi-efi-secure-boot.inc: let EFI_BOOT_PATH be overridedSandra Tobajas2020-01-161-2/+2
| | | | | | Let the EFI_BOOT_PATH Bitbake variable be overrided if needed. Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* grub-efi-efi-secure-boot.inc: use task_prepend instead of prefuncs for do_signYi Zhao2019-12-131-2/+6
| | | | | | | | | | The grub-efi-native build doesn't need to run do_sign task but there are two prefuncs for do_sign still run in native build. This will cause a build error when there is no gpg command on the host. Move the functions to do_sign_prepend_class-target to make sure they only run in target build. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub: Make SELoader optional and add gpg verify supportJason Wessel2019-11-084-74/+247
| | | | | | | | | | | | | | | | | | | | Allow SELoader to be an optional component for secure boot verification. The GPG_SIGN_VERIFY variable was added to control the ability to have grub perform all of the verification of the loaded files using a public key which gets built into grub at the time that mkimage is run. It is not intended that GPG_SIGN_VERIFY and UEFI_SELOADER would both be set to "1". While this configuration could work, it makes very little sense to use the system that way. Also enabled is the tftp feature for grub as a builtin. This allows grub to start from the network when the UEFI is configured to boot off the network with tftp. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* grub-efi/boot-menu.inc: remove invalid menuentry (#122)Zhao Yi2019-11-011-5/+0
| | | | | | Currently the recovery menuentry is not available because we don't provide bzImage_backup and initrd_backup. Remove this entry. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: support mok2 verify in multiboot2 protocolDmitry Eremin-Solenikov2019-09-042-0/+55
| | | | | | | Add support for verifying PKCS#7 signatures via MOK2 protocol to multiboot2 command enabling one to load multiboot-capable kernels. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* grub-efi: fix uid contamination by host QA warningLiwei Song2019-08-261-0/+10
| | | | | | | | | Fix the following QA issue: WARNING: grub-efi-2.04-r0 do_package_qa: QA Issue: grub-efi: /boot/efi/EFI/BOOT/grub.cfg.p7b is owned by uid 19183 chown to root for p7b file to fix uid contamination by host. Signed-off-by: Liwei Song <liwei.song@windriver.com>
* meta-efi-secure-boot: only apply if efi-secure-boot distro flag setMark Hatle2019-08-132-148/+149
| | | | | | | | Only apply grub-efi and linux-yocto bbappend if feature efi-secure-boot set Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: update bbappend and refresh patchesYi Zhao2019-08-132-22/+28
| | | | | | | The grub-efi has been upgraded to 2.04 in oe-core. Update the bbappend and refresh patches to adapt it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: fix the potential uninitialized error for variable 'err'Wenzong Fan2018-12-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the build errors with DEBUG_BUILD enabled: grub-core/loader/linux.c: In function 'grub_initrd_load': grub-core/loader/linux.c:326:10: error: 'err' may be used \ uninitialized in this function [-Werror=maybe-uninitialized] In function grub_initrd_load: grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, char *argv[], void *target) { [snip] grub_err_t err; [snip] #ifdef GRUB_MACHINE_EFI [snip] err = grub_verify_file (argv[i]); [snip] #endif [snip] fail: [snip] return err; } If the GRUB_MACHINE_EFI is not defined, the function would return an uninitialized value for 'err'. We should initialize it when this variable is assigned. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-efi-secure-boot: Ensure openssl-native exists when we need itTom Rini2018-11-071-1/+2
| | | | | | | | | | | In order to deploy our secure boot keys in DER format we need to use openssl. This must be listed in our DEPENDS line in order for the sysroot to be populated correctly when we run do_sign. Also drop the explicit fakeroot on our empty grub-efi do_sign as we may not have globally populated virtual/fakeroot-native at that point in time. Fixes: 92316d4b402b ("meta-signing-key: When deploying keys UEFI keys, deploy DER format") Signed-off-by: Tom Rini <trini@konsulko.com>
* Add root parameter configuration in boot command line.Jinliang Li2018-06-261-0/+6
| | | | | | | It is helpful when secure boot is enabled, because you can not modify boot command line after boot-menu.inc is signed before deploying. Signed-off-by: Jinliang Li <jinliang.li@linux.alibaba.com>
* grub-efi: remove aarch64 from COMPATIBLE_HOSTKai Kang2018-05-161-0/+3
| | | | | | | Functions efi_call_foo and efi_shim_exit are not implemented for arm64 yet, so remove 'aarch64' from COMPATIBLE_HOST for now. Signed-off-by: Kai Kang <kai.kang@windriver.com>
* grub-efi: fix compile errors for arm64Kai Kang2018-05-112-20/+32
| | | | | | | It fails to build grub-efi for arm64. Add definitions of missing macros and replace x86 specified asm codes with function grub_halt(). Signed-off-by: Kai Kang <kai.kang@windriver.com>
* grub-efi: refresh patches to fix QA warningYi Zhao2018-05-103-13/+23
| | | | | | | | | Refresh the following patches: 0003-efi-chainloader-implement-an-UEFI-Exit-service-for-s.patch 0005-efi-chainloader-use-shim-to-load-and-verify-an-image.patch Grub-get-and-set-efi-variables.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub/boot-menu: Rename _bakup suffix to _backupJia Zhang2018-03-191-3/+3
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* grub-efi: fix build error with qemux86 (#24)Wenzong Fan2017-09-291-1/+1
| | | | | | | | | Fix the error: mok2verify.c:169:53: error: \ format '%lx' expects argument of type 'long unsigned int', \ but argument 3 has type 'grub_efi_status_t {aka int}' \ [-Werror=format=] Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* encrypted-storage: use luks as the feature name for current implementationJia Zhang2017-08-201-5/+4
| | | | | | | | encrypted-storage layer will include more security features about encrypted storage so the term "encrypted-storage" won't be used to specify a dedicated technology term such as "LUKS". Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* grub-efi: remove the unused patchJia Zhang2017-08-181-30/+0
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* meta-secure-core: code style fixupLans Zhang2017-07-281-1/+1
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* grub-efi: remove the depreciated replacement for initrd= parameterLans Zhang2017-07-281-7/+1
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* grub/boot-menu.inc: use linux and initrd commands instead of chainloader to ↵Lans Zhang2017-07-271-2/+4
| | | | | | | | boot kernel Since bzImage is not signed during the build. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* grub-efi: carry forward mok2verify to grub-2.02Lans Zhang2017-07-132-76/+156
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* grub-efi: rebased to 2.02Lans Zhang2017-07-124-110/+24
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* Fix the occurrence of checking the existence of signing keysLans Zhang2017-07-121-0/+1
| | | | | | packagegroups are not the end consumers of using user-key-store. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* code style fixupLans Zhang2017-06-291-3/+3
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* meta-secure-core: initial commitLans Zhang2017-06-2221-0/+2951
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-09 12:52:10 +0000